Comment by European Union Agency for Cybersecurity (ENISA)

At the European level, the existing legal frameworks, including NIS2, CRA and the EU AI Act should be leveraged, to ensure that systemic risks stemming from the most advanced AI models are assessed and mitigated. To this end, it may be useful to establish EU-wide state-of-the-art benchmarks for the security evaluation of advanced AI models, including standardised testing against cyber ranges, exploitability metrics, and simulations of chained attacks, to set a consistent bar for assessing their capabilities. Through the GPAI Code of Practice, providers commit to identifying systemic risks, including large-scale cyberattack risks, applying safety and cybersecurity measures across the model lifecycle, and reporting relevant information and evaluation results to the European AI Office.