Capgemini to assess cyber offence risks of AI models for the EU

Capgemini to assess cyber offence risks of AI models for the EU

5 November 2026: Capgemini says the European Commission's AI Office has selected a consortium it leads to support cyber threat modelling and risk assessment of advanced AI systems under the EU AI Act. The work covers the cyber offence risks of general-purpose AI models: the ability to find vulnerabilities automatically, generate exploits or orchestrate large attacks. It sits within the EU's AI Safety programme. The consortium partners are the consultancy Wavestone and LNE, France's national metrology and testing laboratory. Capgemini names the procurement as Lot 2 of tender EC-CNECT-2025-OP-0032.

Not yet independently verified. Capgemini states no contract value or duration, and we have not found the award notice for the tender lot it names. We will update this when it can be confirmed, and remove this note.

The work the AI Office is buying

Capgemini lists four strands: modelling emerging cyber offence risks, developing evaluation tools, designing technical compliance methodologies, and carrying out technical assessments on demand. The stated aim is to help the AI Office identify systemic risks and enforce the AI Act's obligations on providers of general-purpose AI models. The AI Office sits within DG CNECT, the Commission's directorate for communications networks, content and technology. Its AI Safety programme develops tools, methods and benchmarks for evaluating what general-purpose models can do and for classifying those that carry systemic risk.

"As Europe deploys the world's first comprehensive AI safety framework, this work with the European Commission reflects our shared commitment to ensuring AI technologies are developed and deployed responsibly," said Andrea Falleni, who runs Capgemini's Southern Europe region and sits on its Group Executive Board.

Why model providers and their customers should note it

For the providers of general-purpose models sold in the EU, this is the team that will help the regulator test whether their models can be turned to cyber attack, and the methods it builds are likely to shape what evidence the AI Office asks them for. Businesses that buy those models do not carry the provider obligations themselves, but they can expect evaluation results and systemic-risk classifications to start appearing in the documentation providers hand over. A security team that relies on a model for code review or vulnerability research can ask its provider how it is preparing for these assessments.

A consultancy on the regulator's side of the table

The award puts one of Europe's largest IT services firms on the evaluation side of the AI Act while it also sells AI services to companies the Act covers. Capgemini's release does not say how the consortium will handle that, and states no value or duration for the contract. We list Capgemini in our catalogue.

Sources

• Capgemini: Capgemini selected to lead European Commission consortium for AI safety and cyber risk assessment of advanced AI models, 5 November 2026
• European Commission: European AI Office (read 5 November 2026), 5 November 2026