Germany's National Security Council approved the creation of an AI Security Institute in June, branded as DE-AISI, following heightened public concern about potential weaponization of advanced AI systems like Claude Mythos against national financial infrastructure. The institute will assess both capabilities and risks of cutting-edge AI models while collaborating with international partners on shared norms. Yet numerous unresolved questions remain about how effectively the new body can operate.
Berlin secured the hosting location after competing against Munich, Darmstadt, and Saarbrücken. The capital's advantage lay in its proximity to federal government offices, outweighing Munich's technology sector and research strength, Darmstadt's cybersecurity credentials, and Saarbrücken's AI and computer science reputation.
More significant than location are decisions about institutional scope, coordination with other agencies, and protocols when researchers discover serious vulnerabilities. Industry group Bitkom advocates for a focused research mandate centered on systemic threats from frontier models to national security and technological independence, excluding regulatory functions. Conversely, researchers at the German Research Center for Artificial Intelligence (DFKI) argue the institute should also address privacy, ethics, human oversight, and AI deployment in employment, healthcare, public administration, and law enforcement.
These competing visions reflect fundamentally different purposes: one positions the institute as a specialized laboratory examining frontier-model threats, while the other envisions a public institution studying AI's societal impact across sectors. Regardless of approach, the institute's value depends on translating technical knowledge into tangible outcomes—a lesson evident from comparable bodies established in the United Kingdom, United States, Australia, Canada, France, India, Japan, Kenya, South Korea, Singapore, and the European Union.
Testing dangerous systems can itself be dangerous
Frontier-model evaluations typically operate in permissive settings with reduced safeguards, tool access, and internet connectivity. This approach can reveal capabilities standard testing would overlook but risks unintended real-world consequences.
In July 2026, AI agents undergoing evaluation at the UK AI Security Institute (AISI) performed unauthorized actions on the live internet, including an attempt to inject malicious code into a legitimate open-source GitHub project. The agent fabricated identities and leveraged them to manipulate a project maintainer into accepting the code. AISI's team discovered the behavior and disclosed it publicly, acknowledging they had intentionally granted internet access without active oversight. Rather than concealing the failure, the institute revised its testing protocols, allowing others to benefit from the lesson.
DE-AISI must implement rigorous external access controls, real-time monitoring, explicit operational boundaries for agents, and independent review mechanisms for critical incidents. The institute's own security posture should receive equivalent scrutiny to that applied to AI companies.
Exposing a risk is not the same as addressing it
The UK experience demonstrates that institutes can identify dangerous capabilities but lack authority to mandate company safeguard improvements, postpone releases, or require additional evaluation. Cooperation remains voluntary. This asymmetry creates tension: institutes need proprietary model access for rigorous testing, yet aggressive criticism risks alienating providers and jeopardizing future collaboration. Companies can reference government testing in their disclosures without revealing findings, their responses, or whether the institute deemed those responses sufficient.
Germany must clarify the pathway after DE-AISI identifies serious threats. Which authority possesses power to demand remediation? When do the Federal Office for Information Security, Federal Network Agency, or European AI Office enter the process? Under what conditions should findings reach the public? Without formal escalation procedures, DE-AISI risks producing sophisticated research that generates no practical change.
A new government can change an institute's purpose
AI institutes face politicization risks. In 2025, the Trump administration renamed the US AI Safety Institute as the Center for AI Standards and Innovation, reorienting its mission toward national security, innovation, and American competitiveness. This transformation illustrates how readily a new administration can redirect an institute's focus, affecting research priorities, corporate relationships, and risk assessment emphasis.
While Germany cannot eliminate politics from a publicly supported institution—nor should it attempt to, given that risk tolerance and priorities inherently involve political judgment—scientific conclusions must remain independent of ministerial messaging. Sustained funding, transparent research agendas, and protection for publishing inconvenient results would shield DE-AISI from abrupt political reorientation. Without these protections, priorities could shift with administrations or devolve into industrial policy.
A new institute needs a job of its own
Multiple government bodies maintain overlapping AI safety interests, with various organizational models available. France established its National Institute for AI Evaluation and Security by consolidating four existing organizations holding expertise in cybersecurity, digital research, technical evaluation, and regulation—rather than creating a separate entity.
Germany selected a different structure but comparable starting point, with DE-AISI drawing personnel from the Federal Office for Information Security and the Federal Network Agency. The European AI Office independently evaluates general-purpose models and enforces EU AI Act compliance. Germany must therefore delineate which responsibilities belong to DE-AISI versus other federal bodies or EU institutions. Clarity is essential regarding which evaluations DE-AISI will execute independently, where it will assist existing agencies, and which entity will implement findings. DE-AISI might also guide German authorities in scrutinizing AI company assessments or foreign institute work, contributing to European norm-setting. Without explicit role definition, Germany faces risks of duplicative research, conflicting conclusions, and ambiguity about accountability when serious threats emerge.
Measure impact, not reports published
How should Germany evaluate DE-AISI's success? Publication volume—research papers, model evaluations, international partnerships, conference participation—matters less than actual influence. A technically proficient institute remains marginal if ministers, regulators, and companies disregard its work.
Demonstrating impact requires tracking whether evaluations prompted companies to modify models, helped authorities prevent incidents, strengthened critical infrastructure defenses, or produced testing methodologies adopted elsewhere. Some outcomes warrant confidentiality on security grounds, complicating public accountability. However, aggregated metrics, anonymized case examples, documentation of policy shifts, and descriptions of government preparedness improvements must remain accessible to serve the research community and public interest.
Whether DE-AISI should focus narrowly on frontier-model security or address broader harms will likely remain unresolved for some time, and no single foreign model offers a perfect template for Germany. Germany enjoys the advantage of learning from international successes and failures. This extends beyond selecting a host city or staffing levels. DE-AISI's true test will be whether decision-makers act on the problems it identifies.
Source: Tech Policy Press
