CeSIA Calls for AI Act Enforcement on Offensive-Capable Models
What happened
CeSIA published AI-powered cyberattacks: CeSIA calls for emergency measures, a policy brief recommending emergency action on AI-enabled cyber threats. The brief calls on French authorities to accelerate cyberdefense implementation and secure additional resources for ANSSI. It also urges faster transposition of the EU AI Act (Regulation (EU) 2024/1689) and the NIS2 Directive into national law. CeSIA specifically recommends that regulators enforce EU AI Act (Regulation (EU) 2024/1689) risk controls on models with significant offensive cyber capabilities. It also recommends mandatory independent evaluations of those models and deployment restrictions where risks cannot be brought under control. It also recommends that cybersecurity researchers receive early access to advanced AI models to study offensive potential before deployment. Documented incidents of AI-assisted attacks have multiplied. Recent examples include AI agent campaigns targeting enterprise infrastructure and findings that AI-discovered flaws are twice as dangerous as those found by humans.
Why it matters
- ·Enterprises operating essential services in the EU now face pressure on two regulatory tracks at once. NIS2 security obligations and EU AI Act (Regulation (EU) 2024/1689) risk controls can both be triggered by a single offensive-capable AI model. Compliance programs that treat these as separate workstreams may have uncovered gaps.
- ·CeSIA's call for independent evaluations of offensive-capable models signals that vendor self-attestation will not satisfy regulators. Organizations procuring frontier AI tools need third-party assessments, not just supplier-provided safety documentation, before deployment.
- ·The recommendation to restrict deployment where risks cannot be controlled raises the bar for AI procurement risk assessments. Compliance teams must now assess not only what a model can do for the business, but whether its offensive potential can be adequately bounded before it goes live.
Stay ahead of stories like this
Get every EU AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Map your AI vendor portfolio against both NIS2 security obligations and EU AI Act risk categories, and identify models that may qualify as high-risk or that have documented offensive cyber capabilities.
- ☐Ask your AI vendors whether their models have been independently evaluated for offensive potential, and request the evaluation reports rather than relying on the vendor's own safety summaries.
- ☐Review your AI procurement contracts to confirm they require vendors to notify you if regulators impose restrictions or deployment conditions on models you are using.
- ☐Confirm that your incident response program covers AI-enabled cyberattacks as a distinct scenario, with clear escalation paths that connect your cybersecurity team and your AI governance function.
- ☐Assess whether your cybersecurity research team has access to frontier AI models early enough to evaluate offensive risk before those tools are approved for broader enterprise use.
What to watch next
Compliance teams should monitor whether other EU member states follow France. The question is whether they push for joint enforcement under both the EU AI Act (Regulation (EU) 2024/1689) and NIS2 for AI models with offensive capabilities. The European Commission's enforcement powers over general-purpose AI models, now in force, could be applied to models CeSIA identifies as posing uncontrolled cyber risks. Guidance from the EU AI Office on adequate risk controls for offensive-capable models is a key signal. It will indicate how stringent independent evaluation requirements become in practice.