EU GPAI Code of Practice Safety and Security chapter lists cyber offence as a specified systemic risk

Key facts

As stated in the sources, with where to find them.

• Specified systemic risk 'Cyber offence': risks from enabling large-scale sophisticated cyber-attacks including on critical infrastructure, e.g. through automated vulnerability discovery, exploit generation, operational use and attack scaling.Appendix 1.4 Specified systemic risks
• Serious incident reporting: disruption of critical infrastructure within 2 days; serious cybersecurity breach, including (self-)exfiltration of model weights and cyberattacks, within 5 days; death within 10 days; other serious harms within 15 days.Commitment 9, Measure 9.3
• Measure 6.1 requires a Security Goal naming threat actors, including non-state external threats and insider threats; the rationale may reference the RAND Securing AI Model Weights report.Commitment 6, Measures 6.1-6.2
• Measure 5.1 lists techniques to enable safe ecosystems of AI agents, such as model identification, specialised communication protocols or incident monitoring tools, as possible safety mitigations.Commitment 5, Measure 5.1

Findings that cite this record

No tracked finding cites this record yet.

Key questions this bears on

• Is AI shifting the balance between finding and fixing vulnerabilities?Discovery is ahead. AI finds real vulnerabilities faster than they are fixed, and simple checks overstate how often AI patches work.
• How are attackers using AI agents in real operations?Increasingly to run parts of intrusions: providers and vendors report agent-driven espionage, extortion and credential theft, and malware that queries LLMs.

Sources

• The General-Purpose AI Code of PracticeEuropean CommissionJul 10, 2025Primary sourceAccessed Sep 25, 2026
• Safety & Security chaptercode-of-practice.ai (text of the Code)Secondary sourceAccessed Sep 25, 2026

Related records