Capgemini to lead EU effort to standardize AI cyber testing

Capgemini has been selected to lead a European consortium supporting cyber threat modeling and risk assessment for advanced AI systems. Established by the European Commission’s AI Office, the group also includes technology consultancy Wavestone and France’s national metrology and testing laboratory, the Laboratoire National de Métrologie et d’Essais (LNE).

The initiative aims to standardize adversarial testing, software vulnerability discovery and offensive cyber capability evaluations. It will address risks including automated vulnerability discovery, exploit generation and the orchestration of large-scale cyber attacks. Capgemini will model emerging threats, develop evaluation tools, design technical compliance methodologies and conduct on-demand assessments to help enforce AI Act obligations for advanced general-purpose AI providers.

The EU AI Act came into force in mid-2024 and established a systemic-risk classification for models trained on cumulative computational thresholds over 10^25 floating-point operations (FLOPs). A voluntary code of practice followed, but it did not specify how systems should be tested. Combining private-sector expertise with LNE is intended to accelerate the development and updating of penetration testing and structured verification protocols.

The work could eventually lead to mandatory technical audits before high-capability models are deployed within the EU. The nonprofit AI For Developing Countries Forum cautioned that success would depend on rigorous, transparent audit frameworks that resist regulatory capture and provide predictable benchmarks.