Capgemini said the European Commission AI Office selected it to lead a consortium with Wavestone and Laboratoire National de Métrologie et d'Essais (LNE) for planned cyber-risk work on advanced general-purpose AI (GPAI) models. The company’s November 5, 2026, announcement identifies the assignment as Lot 2 of procurement procedure EC-CNECT-2025-OP-0032.
What the consortium is expected to do
Capgemini says the work, set in the context of the EU AI Act and the EU AI Safety program, is intended to help the AI Office assess, monitor and mitigate systemic cyber-offence risks associated with advanced GPAI models. The planned work has four parts:
- Model emerging cyber risks.
- Develop evaluation tools.
- Design technical compliance methods.
- Conduct technical assessments at the AI Office’s request.
The risk examples Capgemini names include automated vulnerability discovery, exploit generation and the orchestration of large-scale cyberattacks. They describe the kinds of capabilities the assessment work will address.
The announced assignment is technical risk-assessment work; a possible future audit requirement is a separate policy outcome.
Does the announcement make audits mandatory?
Capgemini’s announcement describes the consortium’s remit. ITPro has reported mandatory pre-deployment technical audits as a possible future consequence of that work, not as a requirement adopted in the announcement.
