Germany begins building AI Security Institute for frontier model risks

The new DE-AISI is already operating through a virtual nucleus at two federal agencies, while its long-term mandate, legal structure, funding and location remain undecided

Germany has begun establishing the DE-AISI AI Security Institute to strengthen government capacity for evaluating advanced AI models and security risks

Germany has begun building a national AI Security Institute to give the Federal Government its own technical capacity to assess advanced AI models and their potential security risks.

The decision to establish the German AI Security Institute, known as DE-AISI, was adopted by Germany’s National Security Council on June 8, 2026. As of early August, an initial nucleus drawing on existing expertise at the Federal Office for Information Security (BSI) and Federal Network Agency (BNetzA) was already operational.

Technical exchanges are also underway with partner institutions in France and the UK, as well as the EU AI Office.

The institute is intended to provide scientific and technical expertise on advanced AI models and support government risk assessments. Germany has positioned it as complementary to the EU AI Act rather than another enforcement body, with the BNetzA and other authorities retaining their regulatory responsibilities.

For now, DE-AISI is not a standalone institution. The government is using a step-by-step, virtual model while decisions are made on its permanent structure.

An August analysis by Maximilian Pralle, Tarmio Frei, Oskar Wernitz, Hannes Bastians and Christoph Winter examines the choices still facing the government, including how wide the institute’s remit should be and whether it can attract specialist AI talent within normal public-sector constraints. The piece is forthcoming in the Journal of AI Law and Regulation.

Cybersecurity first, but the final remit could go wider

The National Security Council decision centers heavily on the cybersecurity consequences of advanced AI models.

The current nucleus brings together the BSI on security and BNetzA on safety, while later government comments have pointed toward a broader institution with greater capacity.

Policy proposals considered in the analysis would give DE-AISI a technical and scientific role rather than regulatory powers. Under that model, its work could include recurring AI risk assessments for government departments, technical evaluation of frontier models, supporting research, contributing to technical standards and working with international partner institutes.

Some proposals would expand that beyond cybersecurity to chemical, biological, radiological and nuclear risks, alongside potential loss-of-control risks.

The authors argue that the institute’s eventual scope will affect how willing AI developers are to give it confidential access to unreleased models. A body seen as closely tied to regulatory enforcement could face greater difficulty securing that access.

Both agencies supporting the initial nucleus already hold enforcement responsibilities. BNetzA is part of Germany’s national AI Act enforcement architecture, while the BSI has powers in information security.

The BSI has reportedly indicated that DE-AISI will not focus on regulatory work.

Germany is also drawing heavily on the UK AI Security Institute as it develops the model. Joint statements with the UK and France indicate that DE-AISI is expected to participate in the wider international network of AI Safety and Security Institutes.

Germany weighs how to compete for AI talent

Recruitment is another unresolved part of the design. Germany’s Federal Digital Minister has said DE-AISI should be staffed with “top expertise from world class experts,” but specialist AI salaries can sit well above conventional public-sector pay scales.

The analysis points to the UK AI Security Institute, which operates with £66 million in annual funding, priority access to computing resources and a more flexible salary structure than much of the civil service.

German proposals cited by the authors have suggested annual funding of between €60 million and at least €75 million, although no final budget for DE-AISI has been confirmed.

One option being proposed is to establish the institute as a federally owned limited liability company, or GmbH.

The model would keep the institute under state ownership while potentially giving it more flexibility over recruitment, salaries and spending. Germany already uses a similar structure for the Federal Agency for Disruptive Innovation, SPRIND.

The researchers argue that a GmbH could allow DE-AISI to compete more effectively for specialist staff and react more quickly as AI research priorities change. Any such flexibility would still depend on the legislation used to establish the institute.

The Federal Government has not yet confirmed its preferred long-term legal structure.

Berlin, Bonn, Munich and Saarland in contention

The institute also needs a permanent home. Berlin, Bonn, Munich and Saarland are among the locations currently under consideration.

Saarland has already made a formal case for Saarbrücken, which is home to Saarland University, the German Research Center for Artificial Intelligence, the CISPA Helmholtz Center for Information Security and two Max Planck Institutes. Both BSI and BNetzA also have offices there.

Bonn would place DE-AISI alongside the BSI headquarters, while Munich and Berlin both offer established AI industry clusters.

The authors favor Berlin if advising the Federal Government becomes one of the institute’s defining functions, citing its proximity to federal ministries and the National Security Council alongside recruitment advantages.

No final location has been announced.

Germany committed in 2024, through the Seoul Declaration’s Statement of Intent, to support the development of AI Safety and Security Institutes. The June decision now moves that commitment into an operational phase, with the initial DE-AISI nucleus already running while its permanent mandate, structure, funding and location are worked out.