Wavestone selected by the European Commission to evaluate the cyber offence risks of advanced AI models
November 10, 2026 · Press Releases
Paris, 9 November 2026
In brief
The 36-month contract covers Lot 2, “Cyber Offence Risk Modelling and Evaluation”, of the Commission’s “AI Safety Tools” call for tenders. It will support the AI Office, part of the Directorate-General for Communications Networks, Content and Technology, in enforcing the EU AI Act’s rules for general-purpose AI (GPAI) models, in particular those with systemic risk. The goal is to help Europe identify, measure and mitigate the risk that these models could be misused for large-scale or sophisticated cyberattacks, including against critical infrastructure.
Addressing emerging cyber threats and autonomous capabilities
GPAI models are becoming more autonomous, and this is changing the global cyber risk landscape. The main concerns are that advanced models could find software vulnerabilities on their own, develop targeted exploits, support offensive operations and scale up attacks far beyond what human operators could do alone.
To ensure these models are deployed safely and responsibly across the European Union, the EU AI Act mandates that providers of the most advanced GPAI models identify and mitigate these systemic risks. To supervise compliance, the AI Office needs reliable, scientifically sound methods and technical tools. These must measure what models can do and test whether the safeguards meant to prevent misuse actually work.
Within this initiative, Wavestone brings its cybersecurity and AI expertise to four main areas:
- Cyber offence risk modelling: assessing how advanced AI could be used to support cyberattacks.
- Continuous risk monitoring: tracking emerging AI-enabled cyber threats, attack techniques and new model capabilities.
- AI evaluation and testing: contributing to methods and tools for assessing offensive cyber capabilities and safeguards of advanced AI models.
- On-demand technical assessments: conducting targeted evaluations of GPAI models, including red teaming and stress-testing of security mitigating measures.
A consortium with complementary expertise
Wavestone is part of a consortium led by Capgemini that also includes LNE (Laboratoire National de Métrologie et d’Essais), France’s national metrology and testing laboratory. Together, the partners combine complementary expertise in cybersecurity risk management, operational security, AI evaluation, and formal conformity assessment to support the European AI Office in carrying out its tasks under the AI Act.
AI is changing the cyber threat landscape as fast as it is opening up new opportunities. Keeping advanced AI models safe means testing what they can really do: whether they could help find vulnerabilities or support attacks, and whether their safeguards hold. This work for the AI Office complements the cybersecurity support we provide to ENISA, eu-LISA and other EU institutions, by focusing on the cyber risks that AI models themselves can pose. We are proud to bring our expertise to this initiative, alongside our consortium partners, and to help put the requirements of the AI Act into practice.
About Wavestone
Born out of the rise of digital innovation, Wavestone has grown into a leading consulting firm at the intersection of business and technology. It supports major organisations in deploying new ways of working, transforming their operations, and reinventing their business models in the AI era.
With 6,000 employees across Europe and North America, Wavestone combines industry expertise, transformation capabilities, and technology to deliver end-to-end consulting services. AI is embedded across all of the firm’s areas of expertise and delivery models, enabling clients to turn its potential into tangible and lasting value.
Wavestone is listed on Euronext Paris and certified as a Great Place to Work®. For more information, visit www.wavestone.com
Press contact
Burson – wavestone.france@bursonglobal.com