The European Commission will set up a “capacity” to evaluate new leading-edge AI models, Tech Commissioner Henna Virkkunen announced on Tuesday, unveiling an action plan on AI and cybersecurity.

The plan is the EU’s reaction to cybersecurity concerns around Mythos, an AI model developed by American AI lab Anthropic which restricted early release of the cyber-focused technology to predominantly US-based entities.

That raised fears that the EU could be cut off from a tool that might soon prove indispensable for online security.

These fears were heightened by the US government later directly stepping in to restrict access to Mythos and a comparable model made by Anthropic rival OpenAI.

Washington has since lifted these restrictions, though the EU still does not have access to Mythos.

More AI expertise

During this time, the European Commission has focused on pushing for its cybersecurity agency – ENISA – to gain access to evaluate the cyber models to determine how capable they are.

In June, the Commission said ENISA was also “exploring” a testing strategy for one new AI model – GPT 5.5-Cyber – together with EU capitals.

This strategy would “help to inform broader European efforts to shape a more coherent approach to testing at the intersection of cybersecurity and AI”, according to a Commission spokesperson.

Under Tuesday’s plan, the Commission will now set up an “EU evaluation capacity” for advanced AI. This will also cover cybersecurity – potentially cutting into ENISA’s responsibilities.

The capacity will be set up through a “dedicated call” and is expected to be operational in 2027, the Commission said.

The plan will aim to provide AI model providers with a European option for conducting the third party evaluations that are required under the EU’s AI Act. In turn, the Commission expects this capacity to also support its AI Office in enforcing the law.

It also sets out how the EU could address restrictions being put on models like Mythos, which hinder European organisations from accessing cutting-edge models – though here the language is highly coded.

The Commission and ENISA will work on a “blueprint” – essentially guidance on how AI providers can safely give EU organisations access to models – per the plan.

It also mentions “contingency measures” if companies or governments withdraw access, without specifying what these are.

The plan further notes that the Commission and capitals could step in to buy access to models if needed.

(nl)