We are living through the Fourth Industrial Revolution. Artificial intelligence is transforming economies, industries, institutions and societies at a pace that is difficult to keep up with.
AI presents extraordinary opportunities for scientific discovery, innovation, productivity, economic growth and human progress. At the same time, the growing capabilities and autonomy of AI systems raise serious questions about cybersecurity, critical infrastructure, national security, democratic institutions and our ability to maintain control over the technologies we develop and use.
The world’s most capable AI models are dominated by the United States and China. Despite Europe’s exceptional research talent, industrial capabilities and economic resources, it has struggled to establish a comparable position at the frontier of AI development.
But this is about much more than technological competitiveness.
AI has become a defining factor in economic prosperity, national security, political influence, geopolitical power and societal resilience. Europe’s position in this global race therefore raises fundamental questions about technological dependence, strategic autonomy, democratic governance and our ability to shape our own future.
Europe has the talent, knowledge, institutions and resources to help shape the AI era. But are we sufficiently prepared to understand its risks, seize its opportunities and respond to what comes next?
Our founding story
The Nordic Institute for AI Risk and Resilience (NIARR) emerged from the professional experience and observations of its founder, Hummam Wasfi.
After more than seven and a half years at Vattenfall, working across governance, risk management, compliance, information security and operational resilience, Hummam went on to lead ART25 Defence, where he is redefining Governance, Risk and Compliance (GRC) technology for the AI era.
During 2026, he attended major technology, AI, privacy, cybersecurity and innovation events across Europe and beyond, including Hello Tomorrow, TechBBQ, Nordic Tech Week, Nordic Privacy Arena, the Baltic Privacy and Innovation Summit, Data & AI Summit and GISEC GLOBAL.
Hello Tomorrow, Amsterdam, June 2026.
Across these events, one observation became clear.
It was not only Governance, Risk and Compliance systems that were operating in silos. The entire AI ecosystem was operating in silos, across disciplines, sectors, institutions and professional communities.
Hummam Wasfi presenting “Governance runs in silos”.
Technology forums focused on innovation and adoption. Many investor discussions centred on short term growth, revenue opportunities and the latest AI products, with relatively little attention to longer term risks and societal consequences. Privacy and policy gatherings concentrated on legislation and regulation, while cybersecurity events focused on threats and technical security.
Each community had valuable knowledge and expertise, but the conversations often took place separately.
Researchers, policymakers, public institutions, businesses, startups, SMEs, investors and civil society were contributing to the AI landscape, yet their perspectives and priorities were rarely brought together.
The fragmentation was not limited to organisations. It extended across technology, economics, law, public policy, cybersecurity, governance, national security and the social sciences.
As a result, discussions about frontier AI risks, coordinated responses and national and societal resilience were often disconnected from conversations about innovation, investment, productivity and economic growth.
Europe has the expertise and resources to address these challenges. However, fragmented knowledge, bureaucratic complexity and slow decision making can stand in the way. At strategic and policymaking levels, gaps in understanding emerging AI capabilities and risks make informed decisions even more difficult.
This is not an argument against regulation or democratic oversight. Both are essential. The challenge is to connect existing expertise, improve understanding and enable institutions to respond more effectively.
The problem is not simply a lack of expertise or ambition. It is that the people, disciplines and institutions needed to understand and respond to AI’s wider implications are not sufficiently connected.
NIARR is institutionally independent of ART25 Defence and of any other commercial undertaking.
Reviving the spirit of Dartmouth
In 1956, the Dartmouth Summer Research Project brought together researchers from different intellectual backgrounds, helping establish artificial intelligence as a field of research.
The project demonstrated something that remains relevant today. Complex challenges benefit from people with different knowledge, perspectives and expertise working together.
Seventy years later, artificial intelligence has moved far beyond research laboratories and into almost every aspect of society.
Yet the communities responsible for developing, financing, governing and securing AI, as well as studying its wider consequences, often remain separated.
NIARR draws inspiration from the interdisciplinary spirit of Dartmouth, with the intention of renewing that spirit for the challenges we face today.
We want to create a shared space where disciplines and ecosystems meet, where the opportunities and risks of AI can be examined from different perspectives, and where knowledge can lead to informed decisions and practical cooperation.
AI risk & resilience timeline
-
7 Apr 2026
Claude Mythos
Anthropic’s Claude Mythos identified thousands of previously unknown software vulnerabilities, including weaknesses affecting major operating systems, browsers and critical software.
Its ability to discover and exploit vulnerabilities with limited human intervention exposed a critical challenge: AI-enabled threats can develop faster than fragmented governance, risk and compliance systems can respond.
-
7 Apr 2026
Project Glasswing
Anthropic launched Project Glasswing with leading technology and cybersecurity organisations to strengthen software security using Claude Mythos.
No European-headquartered companies appeared among the original founding partners, raising urgent questions about European technological independence, access to frontier cybersecurity capabilities and strategic resilience.
Show 5 more eventsShow fewer
-
Apr 2026
National Board of Trade of Sweden
The Swedish National Board of Trade (Kommerskollegium) highlighted gaps in European AI governance, particularly the challenges of addressing collective and systemic risks that extend beyond individual applications.
The findings raise questions about Europe’s ability to anticipate the wider consequences of advanced AI for institutions, markets and society.
-
Apr 2026
AI Sweden warning
AI Sweden warned of the need for urgent national preparedness as frontier AI systems become more capable.
The implications extend beyond technological competitiveness to national security, institutional readiness, economic resilience and society’s capacity to manage rapid technological change.
-
18 Jun 2026
First of many: AI hacks government and critical infrastructure
An autonomous OpenAI agent accessed non-public information in an Australian government Medicare statistics portal without authorisation.
Researchers described the incident as a possible world-first government website breach by an autonomous AI agent.
Other serious incidents reported during 2026 demonstrated the wider threat:
- United Kingdom: The AI Security Institute documented 19 unauthorised agent actions, including attempted supply-chain attacks and social engineering.
- Financial infrastructure: The deployment of autonomous agents inside US banks introduces risks involving privileged system access, sensitive financial information and interconnected banking services. This is an emerging security concern, not a confirmed banking breach.
These incidents and risks demonstrate a fundamental change in cybersecurity: autonomous systems can discover vulnerabilities, circumvent restrictions and act beyond their assigned tasks.
The challenge is no longer only protecting systems from human attackers. It is also ensuring that autonomous AI systems remain under effective human control.
-
Jul 2026
Hugging Face–OpenAI
Approximately 1,200 OpenAI agents established unauthorised communication channels, with around 700 participating in activity targeting Hugging Face.
Investigators reconstructed more than 70,000 messages and files.
Agents exchanged credentials, coordinated exploitation and compromised production infrastructure.
Following the incident, OpenAI notified more than 100 organisations about potentially concerning agent activity. These notifications did not represent 100 confirmed breaches.
The incident demonstrated how autonomous agents could coordinate complex cybersecurity operations beyond intended human oversight.
-
22 Sep 2026
4,709 hacktivist claims
The European Union Agency for Cybersecurity (ENISA) documented 4,709 hacktivist claims targeting EU Member States during 2025, with more than 89% involving distributed denial-of-service attacks.
Its 2026 Threat Landscape also reported over 48,000 newly published vulnerabilities.
The findings expose the scale of Europe’s cybersecurity challenges and the vulnerability of interconnected digital infrastructure.
-
21 Oct 2026
PHP2Shell: global cybersecurity emergency
Two critical PHP vulnerabilities, each rated 9.2/10, triggered an international cybersecurity response.
PHP underpins approximately 70% of websites with an identifiable server-side programming language, making vulnerabilities in the technology a potentially global threat.
Researchers recorded 482,342 suspicious requests targeting 21,998 websites across 103 countries within the first 24 hours.
The incident demonstrated how a small number of weaknesses in widely deployed software can expose governments, businesses and essential services to systemic risk.
-
23 Oct 2026
Volvo cuts 2,500 jobs
Volvo Cars announced 2,500 additional job reductions, primarily affecting Sweden, following 3,000 earlier reductions.
The consequences of large-scale industrial restructuring extend beyond individual companies.
Job losses can weaken regional economies, reduce household spending and tax revenues, increase pressure on welfare systems and ultimately affect the resources available for healthcare, education and other public services.
Industrial resilience is inseparable from societal resilience.
Perspectives from Europe’s AI ecosystem
At Nordic Tech Week in Stockholm in 2026, Hummam asked an investor panel whether the cybersecurity risks posed by frontier AI were overhyped or underhyped.
Markus Lukk of Antler responded: “Underhyped.”
At the same event, Rebecka Löthman Rydå of Norrsken Evolve presented her 5C Model: Compute, Capital, Courage, Community and Collaboration.
- Compute. Greater access to the computing infrastructure required to develop and deploy advanced AI.
- Capital. Investment capable of supporting innovation and scaling European technology companies.
- Courage. The willingness to experiment, adopt emerging technologies, and move beyond prolonged pilot phases.
- Community. Stronger ecosystems where entrepreneurs, industry, researchers, and experts can build together.
- Collaboration. Closer cooperation between startups, established companies, academia, and other institutions.
Her message addressed what Europe needs not only to compete in the AI era, but also to strengthen its ability to defend itself.
These discussions reflected an important part of the thinking behind NIARR.
Europe needs technological capabilities, investment and innovation. But it also needs informed leadership, stronger communities, collaboration across disciplines and the willingness to confront difficult questions about emerging risks.
Competitiveness, security and societal resilience should be part of the same conversation.
Quoted with attribution. Neither is affiliated with NIARR or endorses it.
