Lobby, Levy, Legislate
How Mistral is trying to convert a perishable contact list into permanent law.
On May 12, in a near-empty hearing room of the French National Assembly, Arthur Mensch did something that tells you everything about how Mistral actually competes.
He didn’t talk about his models. He warned the deputies about someone else’s — and the deputies, mostly, hadn’t bothered to come. He delivered his warning about the fate of European civilization to a scattering of empty benches for ninety minutes, with the cameras running. [1]
The warning itself: Anthropic — the American lab that sits ahead of Mistral at the frontier, and whose restricted-access Claude Mythos Preview model can autonomously hunt down and exploit software vulnerabilities [2] — had been circling the French defense establishment, offering to scan the army’s code bases. Mensch’s counsel to the Republic was to keep them out. Letting a foreign model that deep into French defense, he argued, would create a dependency that is “hard to unwind.” [3]
There’s a real security argument buried in there, and Mensch made the fair version of it himself: you might reasonably not want any vulnerability-hunting model — foreign or domestic — crawling through your defense code, and he conceded in the same breath that Mistral’s own models or Chinese ones could find the same flaws. [3] But notice how neatly the sovereignty case lands on the one outcome that also protects Mistral’s existing contract with the French armed forces — and that it asks France to turn away the strongest defensive tool on the market during the worst run of data breaches in its history, a point we’ll come back to.
That convenience — a principled-sounding argument that happens, every time, to favor Mistral — is the thread running through everything Mensch has said and done this spring.
Once you pull it, the whole confusing season snaps into focus.
The eight days that looked like hypocrisy
Here is the sequence in which French Twitter called Mensch a hypocrite.
May 7. Brussels agrees to the “Digital Omnibus,” delaying the AI Act’s high-risk obligations by sixteen months — from August 2026 to December 2027. Mistral is among the industry voices that lobbied for the slowdown. [4]
May 12. Five days after winning that delay, Mensch sits before the National Assembly and warns that Europe over-regulates, that it has “heavy regulation and a fragmented market,” that the stack of GDPR, copyright rules, and the AI Act is an “empilement“ — a pile-up. [5] Europe, he says, has two years to build its own AI infrastructure or become America’s “vassal state.” [6]
May 15. It’s the front page of the Journal du Dimanche.
A man lobbies to weaken a regulation, wins, and then days later complains that Europe is over-regulated — and lands the front page doing it. The hypocrisy reading writes itself. It’s also wrong, or at least lazy. Mensch isn’t confused. He’s running a press strategy with a clock on it, and the clock matters more than the contradiction.
And the empty room is the proof. If your goal is to persuade legislators, you care whether legislators are in the seats. If your goal is the front page, the seats are set dressing, and the camera is the audience. Mensch wasn’t talking to the handful of deputies who showed up. He was talking, through them, to the JDD, to Bercy — the Finance Ministry — to the Élysée, and to every procurement officer in France who would read about it three days later.
The benches were empty because, on some level, everyone involved understood the room wasn’t the point.
Then there’s the third move people keep filing separately. In March, in the Financial Times, Mensch proposed a 1–1.5% levy on the European revenues of all AI providers — including the American and Chinese ones — to fund a European cultural pot. A tax on AI, from the CEO of an AI company. [7] And back in September, asked about France’s proposed Zucman wealth tax, he offered warm words — “at the risk of disappointing the polemicists, I’m rather convinced we need more fiscal justice in France” — while making clear in the same sentence that he could not and would not pay it himself. [8]
Pro-tax, anti-tax, pro-rules, anti-rules. It looks incoherent. It isn’t. Every one of these positions serves the same end.
Mistral isn’t winning on capability
Start with the thing the sovereignty conversation is engineered to make you forget: Mistral does not make the best models, and its own strategy quietly concedes the point.
This isn’t a knock on the engineering. Mistral’s latest flagship, Medium 3.5, is a genuinely strong model: a dense 128-billion-parameter system that posts 77.6% on SWE-Bench Verified, a respected coding benchmark, and undercuts the closed frontier models on price by roughly half. [9] Mistral does benchmark it against the frontier leaders — and that comparison is exactly the tell. On SWE-Bench, it lands about two points behind Claude Sonnet 4.6 (77.6% versus 79.6%); the pitch is not “we win,” it’s “we come close and cost less, and you can run the weights yourself.” [10] That is a deliberate, coherent position — near-frontier at a fraction of the price — and it is, by design, a second-place pitch. The pace-setting systems on reasoning and agents remain American.
Which is exactly the point. If your strategy is to be the affordable, open, sovereign alternative rather than the best model in the world — and the capex math says it has to be; Mistral’s roughly $400M in annual recurring revenue, with €1bn targeted for the year [11] sits against OpenAI’s $20bn-plus annualized run-rate as of late 2025 [12] — then “best model” can never be your moat. You need a different one.
So what is the moat?
The fashionable answer is “sovereignty.” And there’s a real version of that argument. Europe genuinely should worry about routing every critical digital service through American infrastructure governed by American law. The CLOUD Act is real. Dependency is real. Mensch is not wrong that a continent with no domestic frontier lab has no leverage.
But watch what happens when you ask which kind of sovereignty actually protects Mistral, and you find the real answer is none of the ones he names.
It isn’t technical sovereignty — data-stays-in-Europe. Microsoft, AWS, and OpenAI are all racing to offer EU data residency. That checkbox is being commoditized by the quarter.
It isn’t legal sovereignty — open weights you can self-host. Llama and Qwen are open too. A French integrator could run them on a French cloud under French law and undercut Mistral on price tomorrow.
It isn’t corporate sovereignty, either — the cleanest version of Mensch’s own case. He told the Assembly that US investors hold less than 30% of Mistral and that the founders keep strategic control, aiming for a European listing. [13] That’s true, and it does distinguish Mistral from a Microsoft-funded OpenAI. But a European cap table is a governance fact, not a competitive one. It tells you who controls the company; it tells you nothing about why a customer would choose the product over a cheaper, equally European-hosted open model. Ownership is a moat against acquisition, not against competition.
The moat that’s left, when you subtract the ones that don’t hold, is the customer list. And the customer list gives the game away.
Mistral was born inside the Rolodex
Before we read that list, rewind to where it came from. It’s tempting to picture three research “kids” who somehow assembled a blue-chip roster of backers from scratch. That gets them backward. Guillaume Lample and Timothée Lacroix were core authors of Meta’s LLaMA; Arthur Mensch came from DeepMind with his name on Chinchilla and RETRO. In the frenzied weeks after ChatGPT, they were arguably the most bankable large-model team in Europe — and all three had met years earlier at École Polytechnique, the grande école that functions as the spine of the French establishment. [14]
So they didn’t pitch their way in; the network reached out and pulled them through it. The bridge was the founders of Alan, the French insurtech unicorn: Jean-Charles Samuelian-Werve and Charles Gorintin, who introduced the team around, talked Lightspeed into leading, and worked the phones to fill the round. Gorintin and Cédric O — Macron’s former minister for digital — signed on as founding advisors. [15] The result was €105M one month after incorporation, before a single product: the largest seed in European history. [16]
And look who was already in that first cheque: Bpifrance — the French state’s own investment bank — Xavier Niel, and the shipping billionaire Rodolphe Saadé, whose CMA-CGM would two years later become Mistral’s marquee customer. The customer-patron was present at the founding. So was the political bridge, represented by Cédric O, Macron’s campaign treasurer, whose story I’ve told before.
The point isn’t that any of this was secret. It’s that none of it was. Mistral didn’t earn its way to the French establishment; it was incorporated into it. Which is why the customer list reads the way it does.
There’s a darker reading here for anyone following the question of why national AI ecosystems succeed or fail. The usual diagnosis is exclusion — the most significant builders are outsiders, the system pushed away, or had to be imported. France is the inverse. Its champion was built by the consummate insiders the system produces by design — Polytechnique, DeepMind, the right dinners — and the system’s reward for producing them was to wire them straight into state procurement. The failure mode here isn’t a talent the country couldn’t keep. It’s the opposite: a talent the country captured so completely that the product never had to compete.
For now, the Rolodex is the product
When Mensch defends Mistral’s traction, he names the same flagship customers: France Travail, CMA-CGM, Stellantis, and TotalEnergies. This spring, he added the Caisse des Dépôts, the French state investment bank. [19] Read that list not as wins but as buying decisions:
France Travail is a French government agency. TotalEnergies is a French strategic asset whose CEO doesn’t sneeze without an Élysée check-in. [20] Stellantis carries the French state’s industrial legacy through its old stake in PSA, the Peugeot-Citroën group that merged into Stellantis. [21] Caisse des Dépôts is a French state-owned institution. And CMA-CGM is owned by Rodolphe Saadé — the shipping billionaire whom Macron meets on his trips to Marseille, and who assembled BFM-TV, RMC, La Provence, La Tribune, and Brut into one of the largest newsrooms in France. [22] When La Provence ran a 2024 front page the Élysée disliked, Saadé suspended its editorial director; the journalists’ union called it political pressure. [23]
The CMA-CGM deal is the one to study. In April 2025, Saadé’s group invested €100M into Mistral and signed a five-year, $110M service contract — investor and customer, same party, the same circular structure now standard at hyperscaler scale. [24] And here’s the part that should end the “Mistral is winning enterprise on merit” story for good: the same CMA-CGM had already signed a separate $150M AI deal with Google. [25] Saadé bought Mistral the press release and Google the workload.
Now hold the strongest version of the counterargument. At the same hearing, Mensch noted that 70% of Mistral’s revenue is non-French — proof, he argued, of a genuine export champion rather than a subsidized domestic pet. [26] Take the number at face value. It doesn’t touch the argument because the moat was never part of the revenue base. Wherever that 70% lives — cross-border API calls, seat licenses, partner channels — it isn’t the source of the political moat. That lives in the flagship names, the lighthouse customers Mensch puts on the slide to validate the company to the next investor and the next government. And that list, the one that does the political and fundraising work, is almost entirely the French political-industrial complex. No Volkswagen. No Siemens. No Maersk. No ING. No Telefónica. No European reference customer of consequence outside the French orbit. Mistral may sell tokens to Europe. It anchors its credibility to the French permanent state.
That’s the moat. Not sovereignty — the President’s contact list. Mistral built a product that the most important buyers were always going to choose, and those buyers are a circle who have lunch together.
The game: legislate the Rolodex before it expires
A contact list is a fragile asset. Macron is term-limited; 2027 is coming; a contact list does not survive a change of government. So the genius — and it is genius, in a cold way — of Mensch’s spring is that every policy move converts a perishable relationship into durable law. And the conversion is self-reinforcing: each rule that raises a rival’s cost buys time, and that time is spent deepening the very relationships the rule protects, which in turn supply the political capital to write the next rule. The relationship becomes the law that governs it.
Read the spring’s moves as one design, and they line up. The 1–1.5% levy on all AI providers’ European revenue raises rivals’ operating costs in Europe and falls hardest on high-revenue American companies. A public-procurement “European preference” would codify that European equity beats European hosting — turning the Rolodex itself into a rule. The foundation-model carve-out from the AI Act trims Mistral’s own compliance bill while leaving the application-layer obligations that mostly bite US deployers. The Digital Omnibus delay buys sixteen months before any of it starts charging rent. The “vassal state” rhetoric inoculates against the obvious objection — that the French state is overpaying for a domestically preferred model. And the warning to keep the army off Anthropic’s Claude Mythos defends the single highest-value contract on the list from a stronger rival. Six moves, one direction.
Sam Altman wants to be the CEO of an AI company. Arthur Mensch wants to be the CEO of an AI market — and the difference is that markets are made of rules, and rules can be written. While Altman lobbies against regulation, Mensch lobbies for the right regulation: the kind his competitors can satisfy only at a cost they can’t bear, and he doesn’t pay.
It’s the most sophisticated regulatory game in AI right now. Calling it hypocrisy misses how good it is.
And you’re the one paying for it
A strategy this elegant still sends someone an invoice. Several someones.
French taxpayers buy a domestic-preferred model so a French logo can sit on the contract. European consumers may soon pay a 1.5% levy that, as input taxes typically do, flows at least partly downstream into prices. The French army, if Mensch gets his way, runs on the home-team model rather than the strongest available tool, because the strongest is American. And every European who wants the AI Act’s high-risk protections has to wait until December 2027 for them, courtesy of a delay sold as a boost to competitiveness.
None of that is sovereignty. It’s a subsidy — routed through procurement and regulation instead of a line item, paid to one company, and narrated in the language of national dignity so that questioning it feels unpatriotic.
The bill comes due in breaches
And the steepest cost isn’t measured in euros. France is, right now, among the most cyberattacked countries in the world, and the diagnosed root cause is a “remediation gap” — institutions that keep finding vulnerabilities and keep failing to patch them in time. [27] The identity-document agency ANTS leaked up to 19 million passport and license records; [28] much of the spree was carried out by teenagers. [29] And the marquee name on Mistral’s own customer list, France Travail, is the largest data breach in French history — tens of millions of job-seekers exposed and a €5M regulator fine in January 2026. [30] Sovereignty delivered the French logo on the contract. It did not deliver security.
Which is what makes the Mythos warning go sour. A remediation gap is exactly what a frontier vulnerability-hunting model closes — and within days of the hearing, Bloomberg reported that Mistral is building its own such model for European banks shut out of Mythos. [31] So the warning isn’t “keep dangerous vulnerability-hunters out of France.” It’s “keep the American one out, while we build and sell ours.” There is a strong security case for not allowing any foreign model to crawl through the defense code. But weigh it honestly: a country hemorrhaging data because it can’t find its own holes fast enough is being counseled to refuse the best tool for finding them. Denying France the Mythos audits may be the larger sovereignty risk, and the sovereignty argument and the product roadmap turn out to be the same document.
The bet, and how we’ll know
Here’s the falsifiable part — the thing to actually watch, rather than the rhetoric to argue about.
If Mistral’s strategy is sound, the policy moat buys enough time for the product to close on the frontier and for the company to break out of the Macron orbit into real, arm’s-length European enterprise demand. So the test is simple: by the middle of 2027, does Mistral’s flagship customer list contain names that aren’t tied to the French state or Macron’s circle? A Volkswagen. A Siemens. A bank in Milan or Madrid that chose Mistral in a competitive bake-off and paid full freight.
If yes, Mensch will have pulled off one of the great industrial strategy plays of the decade — using the rulebook to buy time to build a real business.
If no — if in two years the list is still France Travail and friends — then the policy moat was never a bridge to a product. It was the product. And policy moats have a half-life measured in election cycles. A non-Macroniste Élysée could simply stop steering the contracts. Or Brussels could decide that France’s domestic procurement, routed so reliably to one favored national champion, is a selective advantage that runs into EU state-aid rules. That is a separate exposure from the “European preference” now being drafted at the EU level — which, awkwardly for the sovereignty story, is a French-led project Mistral wants. Either way, the moment the political weather changes, the whole structure reprices overnight.
Mensch says Europe has two years to avoid becoming America’s vassal. He may be right. But Europe should be careful not to mistake one clever founder’s moat for a continent’s sovereignty — and careful, too, about who exactly it’s being asked to be sovereign for.
Mensch, in German, means “man.” In Yiddish, it came to mean something better — a person of integrity, someone who does the right thing. Watching Monsieur Mensch this spring, the open question isn’t whether he’s brilliant. It’s the kind of mensch France thinks it’s buying.
Notes
[1] Assemblée nationale (official video) — Vulnérabilités systémiques dans le secteur du numérique: audition de M. Arthur Mensch (May 12, 2026; the near-empty room is visible on the official feed)
[2] Fortune — Anthropic says it’s testing “Mythos,” a powerful new AI model representing a “step change” in capabilities (the model’s full name per Anthropic’s April 7, 2026 system card is “Claude Mythos Preview”)
[3] The Decoder — Mistral CEO Arthur Mensch warns France against letting Anthropic’s Mythos scan military code bases (also the source for Mensch’s concession that Mistral’s or Chinese models could find the same vulnerabilities)
[4] Council of the EU — Artificial intelligence: Council and Parliament agree to simplify and streamline rules (official press release, May 7, 2026)
[5] Le JDD — Fiscalité, énergie, dépendance: le patron de Mistral AI alerte sur les faiblesses de l’Europe (May 15, 2026)
[6] Assemblée nationale (official video) — audition de M. Arthur Mensch, “vassal state” / two-year warning (same hearing, May 12, 2026)
[7] IT Pro — Mistral CEO calls for AI cultural levy (reporting Mensch’s Financial Times op-ed, March 20, 2026)
[8] Boursorama (AFP) — Taxe Zucman: le patron de Mistral demande “plus de justice fiscale” tout en préservant la compétitivité de la France
[9] Mistral AI / Hugging Face — Mistral-Medium-3.5 model card (official benchmarks: dense 128B parameters; 77.6% SWE-Bench Verified)
[10] TechSifted — Mistral Medium 3.5 review (independent comparison: 77.6% vs. Claude Sonnet 4.6’s 79.6% on SWE-Bench Verified; ~half the per-token price; open weights under modified MIT terms)
[11] Maddyness UK — Mistral AI on track to reach one billion euros in revenue by 2026 (Mensch at Davos; ~$400M ARR, €1bn a target for the year, not booked revenue)
[12] Reuters (via Yahoo Finance) — OpenAI CFO says annualized revenue crosses $20 billion in 2025 (ARR and “annualized run-rate” are adjacent but not identical metrics; the orders of magnitude make the comparison regardless)
[13] The Decoder — Mistral CEO Arthur Mensch warns France… (Mensch’s statement that US investors hold under 30% and founders retain strategic control)
[14] Sifted — Meta and DeepMind alumni raise €105m seed round to build OpenAI rival Mistral (founders’ LLaMA / DeepMind pedigree; École Polytechnique)
[15] TechCrunch — Alan’s founder role in Mistral’s origin story (Samuelian-Werve and Gorintin as connectors; Cédric O founding advisor)
[16] TechCrunch — France’s Mistral AI blows in with a $113M seed round at a $260M valuation (full investor roster incl. Bpifrance, Niel, Saadé, Schmidt)
[17] Caisse des Dépôts (official) — Souveraineté numérique: le groupe Caisse des Dépôts s’adjoint les services de Mistral AI (May 2026)
[18] TotalEnergies (official) — TotalEnergies to collaborate with Mistral AI to increase the application of AI in its multi-energy strategy
[19] Stellantis (official) — Stellantis and Mistral AI expand their collaboration to accelerate enterprise-wide AI adoption (Oct 2025)
[20] CMA CGM Group (official) — CMA CGM completes acquisition of Altice Media (BFM-TV, RMC; group also owns La Provence, La Tribune, Corse Matin)
[21] Puremédias / Ozap — “La Provence”: Rodolphe Saadé met à pied le directeur de la rédaction après une Une qui aurait déplu à l’actionnaire (March 2024; “political pressure” is the journalists’ union’s characterization)
[22] The Maritime Executive — CMA CGM Group: new custom-designed AI solutions from Mistral AI (€100M investment + five-year $110M contract, April 2025; figures as reported in mixed currencies)
[23] CMA CGM / PR Newswire (official) — CMA CGM embarks on a strategic partnership with Google to deploy AI across all shipping, logistics, and media activities (the separate $150M Google deal, 2024 — predating the Mistral deal)
[24] Angelo Lima (hearing analysis, cross-checked to the Assemblée nationale feed) — What Arthur Mensch told the French National Assembly (Mensch’s claim that 70% of Mistral revenue is non-French; secondary analysis of the official hearing)
[25] Cybernews — Experts warn France “operationally paralyzed” as cyberattacks mount in 2026 (single-source characterization; “among the most-attacked” softened from “second-most” pending an ANSSI/CNIL primary)
[26] Cybernews — ANTS hack: 19 million records exposed in French ID agency breach (April 2026)
[27] The Record — French police arrest suspected hacker behind dozens of data breaches (HexDex, 21, ~100 breaches incl. sports federations, Education Ministry, SIA)
[28] CNIL (official) — Data breach: France Travail fined €5 million (Jan 22, 2026)
[29] Bloomberg — European Banks Explore Mistral AI’s Alternative to Anthropic’s Mythos Model (May 13, 2026; Mistral developing its own vulnerability-detection model for European banks shut out of Mythos)