The federal government has decided to establish its own AI security institute. The German AI Security Institute is intended to test new AI models, assess risks and enable the state to act – before it is too late. But between the claim and implementation there are open questions about budget, personnel and the demarcation from existing authorities. We classify what the institute should achieve and where the stumbling blocks lie. A commentary analysis.
What is behind the new AI security institute?
- With the help of a new committee, the federal government wants to be able to better assess the opportunities and risks of modern AI models in the future. According to an official announcement, the National Security Council decided to set up a special AI security institute. The aim is to To pool capacities for the analysis of artificial intelligence. The institute is intended to network with foreign institutions and promote uniform AI standards at the international level.
- The new AI authority has the working title “German AI Security Institute (DE-AISI)”. First of all it will be only be a virtual institutionwhich can access existing structures and competencies of the Federal Network Agency and the Federal Office for Information Security (BSI). A separate location is planned for the long term. The new German AI institute will deal with questions relating to AI cybersecurity and secure AI products. Other countries already have similar facilities.
- The goal of the National Security Council is to build a team of experts that will… Quickly test and evaluate new AI models like Claude Mythos from Anthropic is intended to advise the federal government and public administration. The institute could then use and assess new AI models at an early stage. The background: Anthropic initially limited access to its Claude Mythos model to a small group of US companies and authorities. The AI is simply too good at detecting security gaps and is too dangerous for the general public because it can be exploited.
Why the institute is not a new regulatory authority
As soon as the federal government announced a new institute, in many places there was a sound of almost reflexive accusation from the next bureaucracy building block and authorities money burner. Of course: the EU’s AI Act already has an extensive set of rules. But anyone who prematurely labels the new AI security institute as another level of regulation is wrong. Because setting and enforcing rules is one thing.
Understanding what modern AI systems can actually do in order to identify risks or use tools themselves is important something completely different. And that’s exactly where the institute should start. It should not be a new supervisory authority that provides companies with additional forms, but rather a technical testing and advice center. While the AI Act defines what is permitted and what obligations apply, the institute is supposed to analyze models, assess risks and identify capabilities at an early stage.
Or to put it another way: The state doesn’t just want to be a referee, it also wants to understand what game is being played and perhaps even take part in it. That is basically understandable. The development of powerful AI is now happening faster than legal texts can be written.
But of course: the costs should be kept within limits and in line with a certain benefit. Ideally, for us citizens too. At the same time, the question arises as to why Germany is again building its own structure instead of bundling existing competencies more consistently. Because: Institutional sexual intercourse is not synonymous with sensible security precautions. However, the history of German digital policy provides plenty of examples of how easy it is to end up on the wrong side.
Voices
- Susanne Dehmel, member of the management board of the digital association Bitkomin a statement: “By setting up a security institute for AI, Germany is creating the conditions to be able to make a well-founded assessment of such risks at an early stage. The DE-AISI should be given a research mandate that is separate from existing institutions and create a situation report with a view to the new so-called frontier models. The focus must be on new systemic risks to Germany’s security and sovereignty. Questions of labor, consumer and data protection or AI ethics are already being dealt with competently elsewhere. The new security institute will only be successful if “We are recruiting top international talent for this.”
- Joachim Bühler, Managing Director of the TÜV Associationexplains: “AI systems must be able to be tested and evaluated reliably. It will be crucial to develop scientifically sound methods and make them applicable in practice. It is also important to bring together existing competencies from science, business, supervision and testing. This is the only way to create an institute that is internationally compatible and that effectively supports companies in the safe development and use of AI.”
- It’s in a Reddit forum Meanwhile, criticism is relatively relevant. One user writes: “And presto, a few more officers.” Another added: “This screams like a waste of money again.” Yet another user scoffs: “If you don’t know what to do, start a working group.” Another opinion: “And it’s even harder for companies to remain competitive in the area of AI. But we’re still years ahead of the others anyway and can afford that… right? OR?”
AI security institute for Germany with many open questions
Whether the new German AI security institute becomes an important early warning center or ends up in the next administrative chapter with little effect, will only be decided in the coming months and not now. The concerns about an additional regulatory apparatus and a bureaucratic monster are not unrealistic. Especially in a digital environment that thrives on speed, every additional coordination loop can become a competitive disadvantage.
Added to this is that Many central questions are still open are. The federal government has not explained in detail how the institute will be staffed or what the budget will be.
The demarcation from the BSI also seems more sketchy than formulated so far. The problem: Experience has shown that where responsibilities become blurred, frictional losses often arise, which Germany often produces more reliably than digital innovations. However, if it succeeds in attracting highly qualified specialists and actually building up independent technical expertise, the institute could fulfill an important function.
Because the next generation of AI models will not wait until authorities have agreed their rules of procedure. The real challenge However, the aim is less to found a new institute than to prevent a security initiative from ultimately becoming an employment program for the administration.
Also interesting:
