EU AI Testing Access Exposes the UK’s Frontier-Model Safety Gap

The UK’s reported exclusion from pre-release testing of Anthropic’s Claude Mythos 5.1 is less a verdict on British technical expertise than a warning about access. A national evaluator cannot independently assess a frontier model on time if participation ultimately rests on the developer’s consent. ENISA’s access to Anthropic’s Mythos 5 and OpenAI’s GPT-6 Astra is important, but it does not mean the EU has a standing right to test every successor model—or that it had access to Mythos 5.1. 920

The key distinction: access is model-specific

The European Union’s cybersecurity agency, ENISA, has been granted access to Mythos 5 and GPT-6 Astra for testing, according to a European Commission spokesperson. 9 Separately, reporting says Anthropic did not provide the UK AI Security Institute with Mythos 5.1 for testing before release—the first reported instance of Anthropic withholding a major model from that body’s pre-release process. 2023

Those facts should not be flattened into a simple story of an EU win and a UK loss. ENISA’s access concerns two named models under particular arrangements. Mythos 5.1 is a different release and a more restricted access case. The practical lesson is that safety evaluation is becoming segmented by model version, capability, intended use, jurisdiction and the developer’s own partner criteria.

Why Mythos 5.1 is a tougher governance case

Anthropic says Claude Fable 5.1 and Claude Mythos 5.1 are the same underlying model with different safeguards. Fable 5.1 is generally available, while Mythos 5.1 is available only through trusted-access programmes designed for work in cybersecurity and the life sciences. 12

That makes the question more than routine product testing. A system intended for sensitive cyber or scientific work raises issues around controlled environments, misuse monitoring, personnel vetting and national-security handling. Reporting says Mythos 5.1 access was initially limited to vetted US organisations. 1824

The evidence provided does not establish that Anthropic excluded the UK because it distrusted the country or its institute. The restricted-programme design, operational-security concerns and commercial control of access are all plausible explanations. But the outcome still matters: established cooperation and an evaluator’s reputation did not guarantee timely access to a high-consequence model.

What ENISA’s access says about EU leverage

The EU has a stronger legal baseline than a purely voluntary regime. Under Article 55 of the EU AI Act, providers of general-purpose AI models with systemic risk must conduct model evaluations using standardised protocols and tools, assess and mitigate systemic risks, track and report serious incidents, and ensure an appropriate level of cybersecurity protection. 4337

The Act also contemplates evaluation before a model’s first placing on the market, including documented adversarial testing, which may be internal or independent external testing as appropriate. 3534

However, those provider obligations are not the same as a blanket entitlement for ENISA to receive model weights, unrestricted system access or pre-release access to every frontier release. ENISA’s testing arrangement is consequential precisely because it appears to have been secured through engagement with the companies as well as through the EU’s broader regulatory position. 49

In other words, regulation can improve the EU’s ability to demand evidence, risk management and compliance. It cannot eliminate the operational need for secure cooperation when testing models with sensitive cyber, biological or agentic capabilities.

Why the UK is more exposed

The UK’s reported Mythos 5.1 exclusion puts the limits of voluntary access into sharp relief. Reporting on the episode notes calls for stronger statutory footing and powers for the UK AI Security Institute after Anthropic did not grant it access to the latest model. 23

A voluntary approach can work well when labs see value in collaboration. It may be faster and more technically flexible than rigid rules. Its weakness is predictability: a developer can restrict access, change the eligible partner group or decide that a model belongs in a tighter national-security channel.

That creates a strategic risk for the UK. If its evaluators receive frontier systems only after release—or only after other governments and approved partners have tested them—the UK could move from helping shape safety evidence to consuming evidence generated elsewhere.

A more durable UK approach

The immediate policy objective need not be compulsory handover of model weights. For highly capable models, that could create security and intellectual-property risks of its own. A stronger framework could instead focus on controlled, auditable access.

Possible measures include:

1. Pre-deployment notification for designated frontier models. Developers could be required to notify a designated authority before deploying models that meet defined capability or risk thresholds.
2. Statutory powers to request evidence. The UK AI Security Institute could have clear authority to obtain safety cases, evaluation results, incident information and relevant technical documentation.
3. Secure evaluation environments. Rules could require time-bounded access through monitored APIs, sandboxed systems or other controlled environments, rather than requiring access to weights.
4. A national-security review pathway. Models with material cyber, life-sciences or autonomous-agent implications could trigger coordinated review involving cyber, biosecurity, intelligence and AI-evaluation expertise.
5. Formal EU cooperation. Shared evaluation protocols, reciprocal secure-testing channels and compatible serious-incident processes would reduce duplication and help prevent the UK from being excluded from European testing networks.

These proposals address the central weakness exposed by the case: access must be designed into the governance system rather than left entirely to relationships with individual labs.

Frontier-AI testing is likely to become tiered

The likely direction is a layered evaluation system. Broad market-facing models will be subject to provider testing, regulatory documentation and incident obligations. More sensitive cyber, biological and autonomous-agent capabilities will increasingly be assessed in restricted settings. The highest-risk systems may be accessible only to a small set of vetted government, laboratory and security partners.

The EU’s ENISA arrangement and the UK’s Mythos 5.1 exclusion illustrate why that distinction matters. The central competition is no longer only over who can build the strongest model. It is also over who can inspect, test and govern the most consequential versions before they reach wider deployment. 91220

For the UK, technical evaluation capability remains valuable, but it is not sufficient on its own. Maintaining influence will require dependable legal powers at home and durable, security-aware access arrangements with partners abroad.