On May 17, 2026, Arthur Mensch — co-founder and CEO of Mistral AI — sat in front of a French parliamentary commission of inquiry and told it, in as many words, that the French army should not let Anthropic's Mythos read its source code. The exact line, as quoted in The Decoder's writeup, is the one to keep: "It is impossible to have the source code of the French army checked by Mythos. That creates such an irreversible dependency that we absolutely must find solutions."

The framing was sovereignty, not capability. Mensch did not say Mythos cannot find the vulnerabilities. He said Mistral can find them too, and so can the Chinese models, and the question was which jurisdiction the resulting graph of who-knows-what about the French army lives in. The reason the testimony matters is that France is the EU member with the most expensive vote on that question, and Mensch is the founder of the only EU company with a frontier-class model the French state can plausibly buy as a substitute.

What the EU has been asking for, and what it got back

The Mensch testimony slots into a bilateral that has been running since the Mythos launch. On May 11, OpenAI offered the European Commission vetted access to GPT-5.5-Cyber — the same SKU the Loop covered at launch — through an "EU Cyber Action Plan" pitched as access for cyber authorities, vetted security teams, and EU institutions including the AI Office. George Osborne, OpenAI's lead European executive and the former UK Chancellor, told a European Parliament hearing on May 6 that the goal was "to work with them to make sure that they are properly defended."

Anthropic's response to the same approach has been a sequence of meetings that have not produced an offer. The European Commission has held "four or five" meetings with Anthropic without reaching a concrete proposal, per IAPP's reporting. Commission spokesperson Thomas Regnier framed the patience as conditional: "once the enforcement powers of the AI Office start in August 2026, we will ensure to receive, if needed, (Mythos) access." That is the Commission saying it has a regulatory tool it has not yet used, and the calendar on which it expects to start using it. The August 2 enforcement date is the deadline.

That is the policy context Mensch's testimony was speaking into. The EU does want Mythos. France does not want Mythos near its army's source tree. Mistral wants the contract that fills the gap.

What France has already bought

The other half of the story is that Mistral has been building the procurement story for this exact moment since the end of last year. On December 16, 2025, France's Ministry of the Armed Forces notified Mistral AI of a three-year framework agreement covering the armed services and the directorates and public establishments under the ministry, including the CEA, ONERA, and the Navy's SHOM. Governance sits with AMIAD — the Agence ministérielle pour l'intelligence artificielle de défense, created May 1, 2024 and reporting directly to the Minister of the Armed Forces — with a budget trendingtopics.eu has reported at around €300 million per year. AMIAD's director Bertrand Rondepierre called the partnership "a major step," per the ministry's communiqué.

The deal is conditioned, per the IREDIC analysis of the agreement, on Mistral models running on French infrastructure rather than the commercial US clouds — a clause that exists precisely because Mistral's commercial product runs on Azure and Google Cloud and would otherwise sit inside the US Cloud Act's reach. The framework reads as a sovereignty hedge with a known catch, written up as a sovereignty win.

What it gives Mensch, in May 2026, is the right to walk into a French parliamentary inquiry and argue against Mythos from inside a counterparty role. He is not a competitor protesting being shut out. He is the contracted supplier explaining why the other guy should not get the next contract.

The ECB, the banks, and the same argument one industry over

The military testimony is the loudest version of an argument that already exists in financial services. The European Central Bank issued a warning on May 13 that European banks face elevated cyberattack risk from Mythos-class capabilities, NL Times reported. In the same window, mezha.ua reported that European banks were in talks with Mistral about a vulnerability-detection model positioned as a Mythos alternative.

The two stories are the same story at different altitudes. A European regulator warns its supervised entities that a US lab's model raises the threat ceiling. Those entities go shopping for an EU-domiciled supplier with similar capabilities and a friendlier jurisdiction. The EU's national champion in language models has one ready.

Mensch's choice of words in front of the inquiry — calling some of the Mythos discussion "fear mongering" even as he asked the state not to deploy it on military code — is the line a vendor walks when its argument requires both that the technology is dangerous enough to be regulated and unremarkable enough that the regulator should buy the local version. He delivered it without flinching.

The OpenAI move that complicates everything

The wrinkle in the European pitch is that OpenAI has already said yes to the access ask Anthropic has been resisting. GPT-5.5-Cyber, the model the Loop covered when it shipped, is now the model the European Commission can touch. OpenAI's Osborne ran the play through Brussels with a former-Chancellor's instinct for what the institution will accept. The EU got a US model on the table before its own national champion got there.

That puts Mistral in the awkward position of arguing for sovereignty in a market where the US incumbent it most wants to displace has already complied. Mensch's testimony does not address GPT-5.5-Cyber by name. The structure of his case — irreversibility, dependency, source code that should not leave French jurisdiction — applies to both Mythos and the OpenAI model. The reason he singled out Mythos is that Mythos is the one the EU is still chasing. The vendor for whom regulatory friction is the marketing pitch picks the most friction-laden target.

What this means

Three takeaways.

1. August 2 is the date to circle. Regnier's "if needed" clause exists because the Commission expects it may have to use it. Anthropic has roughly eleven weeks to either move a concrete access proposal across the table or face the EU AI Office's first enforcement test on its first month of authority. The Loop's read: a structured access deal is more likely than a regulatory confrontation, because the AI Office under Lucilla Sioli is understaffed enough that nobody on either side wants the first enforcement action to be the one that defines the agency's appetite. But the calendar gives Anthropic the choice and a deadline, which is what the Commission wanted.
2. France just told the EU what its sovereignty floor looks like. The Mensch testimony is, functionally, a French national-interest position read into the parliamentary record at the moment EU-level negotiations with US labs are ongoing. The next defence procurement in the same domain — vulnerability scanning, code review, internal pen-testing — is now politically harder to award to a US frontier vendor than it was a week ago. Mistral did not need to win the contract today. It needed to make the alternative procurement unembarrassing to defend.
3. The sovereignty premium is becoming the only premium that matters. Anthropic and OpenAI capture 89% of the revenue among the 34 leading AI startups, per The Information's May 18 analysis. Mistral is in the long tail of the remaining 11%. The competitive position it has is the one no US lab can buy with capex: an EU corporate address, a French-state customer reference, and a CEO who can deliver an "irreversible dependency" line in front of a parliamentary inquiry without sounding like a lobbyist. That is the market Mensch is selling into. The price he is asking is a regulatory regime that treats the address as part of the product spec.

The Loop's view: the European AI-cyber question is being decided by which vendor's lawyers move faster, not which model scores higher on the benchmarks. Anthropic shipped the better model and got the worse procurement position. OpenAI shipped roughly the same capability and got the European Commission's first invitation. Mistral shipped a smaller model and got the parliamentary microphone. The order tells you what the buyers are actually pricing.