The European Commission confirmed April 17 that it is engaged in ongoing discussions with Anthropic, the San Francisco-based AI developer, covering the company's range of AI models, including cybersecurity-specific systems not currently available to the bloc's 27 member states. Anthropic has committed to respect the EU's General Purpose AI (GPAI) Code of Practice, Commission spokesman Thomas Regnier told reporters in Brussels. Regnier stated that under the Code's framework, "there is an obligation to assess and mitigate risks that could come from a service that may or may not be offered in Europe." The talks center on Claude Mythos, Anthropic's advanced cybersecurity model, which the company itself has declined to release to the general public.
Anthropic publicly introduced Mythos on April 7 and withheld it from general availability on national-security grounds. A pre-publication document described the model as posing "unprecedented cybersecurity risks." Mythos represents a significant advance in AI's ability to automate complex cyberattacks, specifically the identification of vulnerabilities and the generation of exploits. An assessment by the UK's AI Security Institute (AISI), which received early access, found the model succeeded in expert-level hacking tasks 73 percent of the time. Prior to April 2025, no AI model could complete those tasks at all. Rather than a public rollout, Anthropic released Mythos to a limited group as part of an initiative called Project Glasswing, billing it as more effective than competing AI systems at detecting software vulnerabilities.
The Commission's engagement with Anthropic proceeds under the GPAI Code of Practice, which the European AI Office published in final form on July 10, 2025. The Code is a voluntary tool, prepared by independent experts through a multi-stakeholder process, designed to help industry comply with the AI Act's obligations for providers of general-purpose AI models. The Safety and Security chapter applies to the small number of providers of the most advanced models, specifically those subject to obligations for GPAI models with systemic risk under Article 55 of the AI Act. The Commission's formal enforcement powers remain prospective. From Aug. 2, 2026, the Commission's enforcement powers enter into application, and it will enforce compliance with obligations for providers of GPAI models, including fines. Failure to satisfy those requirements may result in penalties of the greater of €15 million or 3 percent of a company's global annual turnover. Commission spokesman Regnier signaled the August 2026 date during the April 17 briefing, noting that "certain rules will kick in" by then, and underscored that the Commission is currently receiving information from Anthropic and will proceed from there. [POLITICO]
The talks unfold against a backdrop of mounting concern across Western governments and financial institutions. The heads of America's largest banks reportedly met this month with Federal Reserve Chairman Jerome Powell and Treasury Secretary Scott Bessent to weigh the security implications of the as-yet unreleased model. The European Central Bank plans to engage the chief risk officers of eurozone banks to evaluate potential threats linked to Mythos. Anthropic CEO Dario Amodei separately met with senior officials from the Trump administration "for a productive discussion on how Anthropic and the U.S. government can work together on key shared priorities such as cybersecurity, America's lead in the AI race, and AI safety." The EU's regulatory posture is further complicated by a reported access gap: at the April 17 briefing, reporters pressed Regnier on why the Commission had not yet obtained direct access to Mythos, noting that approximately 40 unnamed organizations in the UK have already received it. Regnier acknowledged that no governmental or intergovernmental body has access to the model at this stage. [POLITICO]
The timeline places pressure on the Commission's AI Office to build capacity before enforcement begins. Analysts have noted that the AI Office appears to lack the internal capacity to scan trends at the frontier of AI development, with exceptional but few staff facing constant deadline pressure that leaves no one specifically tasked with monitoring frontier AI developments and translating them into regulatory action. Within six days of Anthropic's announcement, UK AISI published results of comprehensive cyber-capability testing of Mythos, illustrating the gap between the UK's evaluation pace and the EU's. The Commission's decision to engage Anthropic through a voluntary compliance channel rather than an adversarial enforcement posture signals a strategic choice, but the Aug. 2, 2026 enforcement trigger means that window is narrowing. Whether the Commission can obtain adequate model access and technical expertise to complete a meaningful risk assessment before that date remains the central unresolved question.
References:
[1] Reuters via Investing.com. (2026, April 17). Anthropic talks to EU, including on its cyber security models, Commission says. https://www.investing.com/news/economy-news/anthropic-talks-to-eu-including-on-its-cyber-security-models-commission-says-4619976
Sources:
Comments (0)