Comment by European Union Agency for Cybersecurity (ENISA)

At the European level, the existing legal frameworks, including NIS2, CRA and the EU AI Act should be leveraged, to ensure that systemic risks stemming from the most advanced AI models are assessed and mitigated. To this end, it may be useful to establish EU-wide state-of-the-art benchmarks for the security evaluation of advanced AI models, including standardised testing against cyber ranges, exploitability metrics, and simulations of chained attacks, to set a consistent bar for assessing their capabilities.