The European Union Agency for Cybersecurity (ENISA) has been testing open-weight AI models of Chinese origin on fully isolated systems with no internet connection. Executive Director Juhan Lepassaar confirmed that the tests are being carried out on the agency's secure internal infrastructure — but the agency is not disclosing which models are being examined or what methods are being used.

This quiet evaluation is far more than a routine technical exercise. Europe wants to protect data security while also laying concrete groundwork for upcoming legislation. Here are the three core goals behind the tests.

2

Eliminating the data leakage risk at the root

The most critical reason the tests run on so-called air-gapped hardware rather than via APIs is Chinese law. The National Intelligence Law, which came into force in 2017, obliges all China-based companies to unconditionally support state intelligence requests.

That means data sent to the servers of providers such as DeepSeek or Alibaba is effectively open to access by the Chinese state. By downloading model weights onto its own infrastructure and cutting all external connections, ENISA can examine the models' capabilities and weaknesses without putting its own data at risk.

Are there hidden threats inside the models?

2

Even when an open-weight model runs locally and sends nothing outward, its training-derived parameters can contain hidden backdoors, vulnerabilities or traces of manipulation. That is precisely the question at the heart of ENISA's work.

The threats the agency aims to map include:

  • Harmful content generation: Determining how easily safety filters can be bypassed, and whether the models give harmful instructions on cybercrime tools or chemical and biological threats.
  • Manipulation of reasoning: Establishing whether model architectures can be compromised by attackers, and whether decision mechanisms are open to covert interference.
  • Structural coding flaws: Documenting, with concrete evidence, vulnerabilities stemming from the training process and possible hidden steering.

A foundation for enforcement under the EU AI Act

2

The most strategic output of the tests will feed directly into audits under the EU AI Act. Chinese providers have not signed up to the voluntary compliance rules in Europe, leaving a significant gap in risk assessments.

Findings gathered on isolated networks will give the EU AI Office formal grounds for enforcement. Based on these results, the EU could restrict the sale of certain models in the market, classify models as high-risk and impose heavy obligations, or set firm rules on which systems may be used in critical sectors such as energy, finance, healthcare and public administration.

In short, ENISA's covert tests form both the technical and the legal foundation of Europe's approach to AI security. When the test results will be made public, however, remains unclear.