EU selects Capgemini-led consortium to assess advanced AI’s cyber risks

The European Commission’s AI Office has selected a Capgemini-led consortium to help assess how advanced AI could enable cyberattacks. Working with Wavestone and France’s public testing institution LNE, the group will develop evaluation tools and technical compliance methods to support the EU AI Act’s obligations for general-purpose AI model providers.

Capgemini disclosed the selection in its November 5, 2026 announcement. The assignment sits within the EU’s AI Safety program, which develops tools, methods and benchmarks for evaluating general-purpose AI models and classifying those that pose systemic risks.

The focus is offensive cyber capability: what a model might help an attacker accomplish, rather than simply whether the model itself can withstand an attack. Capgemini identified automated vulnerability discovery, exploit generation and the orchestration of large-scale cyberattacks as capabilities driving the need for consistent evaluation frameworks.

From potential attacks to technical assessments

The announced work spans both the design of assessments and their use. Capgemini’s responsibilities include modeling emerging cyber-offense risks, building evaluation tools, designing technical compliance methods and conducting technical assessments when requested.

ITPro describes the initiative’s testing goals in three related areas. Each examines a different part of the problem, from probing a model’s behavior to evaluating its usefulness in offensive cyber activity:

• Adversarial testing: deliberately challenging a model to examine how it behaves under attempts to expose weaknesses.
• Software vulnerability discovery: assessing capabilities related to finding weaknesses in software, one of the cyber uses highlighted in Capgemini’s announcement.
• Offensive capability evaluation: assessing cyberattack-related abilities, with the announced risk focus extending to exploit generation and large-scale attack orchestration.

Wavestone confirmed its participation on November 6 and said it would contribute cybersecurity and AI expertise. Its announcement frames the task around understanding how advanced general-purpose models could enable cyberattacks. It also singles out increasing autonomy as a concern because of the potential for models to help orchestrate attacks at scale.

The consortium combines commercial consulting expertise with a French public institution. LNE is the Laboratoire National de Métrologie et d’Essais, France’s national metrology and testing laboratory. The partners describe their combined expertise as covering cybersecurity risk management, operational security, AI evaluation and conformity assessment—checking whether something meets applicable requirements.

Supporting enforcement without replacing the regulator

That places the consortium in a technical support role: developing ways to examine risk and compliance, while supporting the Commission office responsible for the regulatory work.

Capgemini identifies the selection as Lot 2 of procurement procedure EC-CNECT-2025-OP-0032.