Europe’s AI testing gap
Recent reporting argues Europe has built legal AI frameworks but lacks consistent institutional capacity to access, inspect and test frontier AI models. The ‘Claude Mythos’ episode reportedly exposed limits — Germany’s BSI and other bodies are talking to vendors without direct model access — while a separate Spanish legal analysis says the EU is quietly clarifying how agentic AI fits into the AI Act. ( )
Europe has rules for artificial intelligence, but many of its public bodies still do not have routine access to the frontier models they may need to inspect and test. (digital-strategy.ec.europa.eu) The European Union’s Artificial Intelligence Act entered into force on August 1, 2024, with banned practices and artificial-intelligence-literacy duties applying from February 2, 2025, general-purpose-model obligations from August 2, 2025, and broader high-risk rules due on August 2, 2026. (digital-strategy.ec.europa.eu; digital-strategy.ec.europa.eu) On October 8, 2025, the European Commission launched the Artificial Intelligence Act Service Desk and Single Information Platform, with an online form for questions handled in cooperation with the Artificial Intelligence Office rather than a public testing lab with standing model access. (digital-strategy.ec.europa.eu) A frontier model is a top-end system trained with vast computing power; the Commission’s July 18, 2025 guidance says general-purpose models are those trained above 10^23 floating-point operations and able to generate language, audio, images, or video. (digital-strategy.ec.europa.eu) Testing those models means more than reading policy documents. In a British government evaluation published April 14, 2026, the United Kingdom’s Artificial Intelligence Security Institute said Anthropic’s Claude Mythos Preview solved expert-level capture-the-flag cyber tasks at a 73 percent rate and completed a 32-step attack simulation in 3 of 10 tries on a weakly defended network. (the-decoder.com) That result came with limits the institute spelled out: the simulated networks had no active defenders or security monitoring, so the test did not show how the model would perform against a well-protected real system. (the-decoder.com) Germany’s Federal Office for Information Security, known as the Bundesamt für Sicherheit in der Informationstechnik, says it is working on artificial-intelligence security, fairness, robustness, and governance, and publishes criteria catalogs and guidance for generative models. Its public materials describe assessment frameworks, not a standing regime for direct access to frontier systems from foreign labs. (bsi.bund.de; bsi.bund.de) At the same time, Brussels is still filling in legal details. A Spanish legal analysis published April 14, 2026 said new answers in the Artificial Intelligence Act Service Desk confirm that “artificial intelligence agents,” whether generative or not, fall under Regulation (European Union) 2024/1689 without creating a new legal category. (economistjurist.es) The Service Desk’s public frequently asked questions page now includes the question, “How are AI agents addressed within the AI Act?” and the Spanish analysis said the answers were visible there as of April 13, 2026. (ai-act-service-desk.ec.europa.eu; economistjurist.es) That interpretation rests on existing definitions, the analysis said: an agent usually combines at least one general-purpose model with extra components such as an interface, so it fits within the Act’s current categories instead of opening a separate bucket for “agentic” software. (economistjurist.es) The Commission has presented this phase as implementation support, with more guidance in preparation and full roll-out continuing through August 2, 2027. Europe’s position in April 2026 is a legal framework that is far ahead of its enforcement calendar and still catching up on the practical business of getting systems in the door and putting them under test. (digital-strategy.ec.europa.eu; digital-strategy.ec.europa.eu)
