Capgemini to lead EU AI Safety consortium assessing cyber risks of advanced AI models

Capgemini has been selected by the European Commission’s AI Office to lead a consortium that will assess the cyber risks of advanced AI systems, the company announced on November 5, 2026. The assignment sits inside the EU’s AI Safety program and the EU AI Act, and it targets the cyber offence risks of general-purpose AI (GPAI) models — the powerful, general-purpose systems at the center of the Act’s toughest obligations.

The work is practical, not ceremonial. The consortium will model emerging cyber offence risks, build evaluation tools, design technical compliance methodologies, and run on-demand technical assessments for the AI Office. The goal is to give the Office the evidence it needs to identify systemic risks in GPAI models and enforce the Act’s obligations on their providers — the part of the law that turns principles about safe AI into checkable requirements.

What the consortium will actually do

The risks in scope are the ones the AI Office worries about most as models gain autonomous, cyber-relevant capabilities: automated vulnerability discovery, exploit generation, and large-scale cyber-attack orchestration. Those are not hypothetical failure modes. Security teams are already building red teams around them — CrowdStrike’s new AI red team attacks a customer’s systems, hardens them, then re-attacks to prove the fix — and the UK’s National Cyber Security Centre has warned that AI malware is “highly likely” to feature in a ransomware attack on critical infrastructure by 2028. The consortium’s job is to turn that worry into repeatable evaluation: tools and benchmarks that can say, with evidence, whether a given model can be turned into a cyber weapon, and how far its reach extends.

The AI Safety program’s remit is to develop the tools, methodologies, and benchmarks for evaluating the capabilities and reach of general-purpose AI models and classifying models with systemic risks — the classification that triggers the Act’s strictest duties. Capgemini’s brief is to supply the cyber half of that apparatus.

Who is in the consortium

Capgemini leads, with Wavestone and LNE, the French public institution for metrology and testing (Laboratoire National de Métrologie et d’Essais). The three bring complementary expertise: cybersecurity risk management, operational security, AI evaluation, and conformity assessment. The contract was awarded under Lot 2 of the EC-CNECT-2025-OP-0032 procurement procedure. The companies did not disclose the contract’s value.

“As Europe deploys the world’s first comprehensive AI safety framework, this work with the European Commission reflects our shared commitment to ensuring AI technologies are developed and deployed responsibly,” said Andrea Falleni, CEO of Capgemini’s Southern Europe region and a member of the group’s executive board. “By combining scientific rigor, operational expertise, and experience in operationalizing trusted AI, Capgemini is proud to help strengthen Europe’s digital resilience.”

Why this matters now

The EU AI Act is the world’s first comprehensive AI law, and its GPAI chapter is where enforcement gets concrete. The Act’s first enforcement probes began in October, after rogue agents raised questions about providers’ duties. A regulator can only enforce what it can measure — and measuring the cyber capabilities of a frontier model requires the kind of evaluation tooling this consortium is being paid to build. Without it, systemic-risk classification rests largely on providers’ own reporting. With it, the AI Office gains an independent technical basis for its decisions.

The appointment also lands as governments treat AI cyber risk as a live operational question, not a research topic. The UK cyber chief’s warning about AI malware in ransomware attacks put a date on the threat; the Capgemini consortium is the EU’s answer on the assessment side — a standing capacity to probe models before they are deployed at scale, rather than after an incident.

Sources: Capgemini’s press release and the same announcement via GlobeNewswire; MLex’s summary of the selection.