Reviewing the Impacts of National AI Readiness Assessments: Lessons from Mongolia

In February 2025, the GCSCC travelled to Mongolia for the first pilot of the National Artificial Intelligence (AI) Cybersecurity Readiness Metric, a new assessment tool to enable nations to benchmark their existing readiness and provide an evidence base for future AI cybersecurity decision making. It was conducted at the occasion of a ‘CMM Back Brief’ that convened over 200 stakeholders from government, industry, and academia to present the findings of the country’s first cybersecurity capacity review in October 2024.

The trial involved the GCSCC research team facilitating structured discussions with key stakeholders across a range of interdisciplinary and cross-sectoral thematic areas. These discussions informed a report summarising the current state of national AI cybersecurity readiness. This report also included recommended interventions to advance readiness and was submitted to the Mongolian government to guide future AI cybersecurity decision making. 

Early feedback from Mongolian stakeholders and international partners suggests that the Metric trial and report have since then generated meaningful impact, particularly in shaping national conversations around AI adoption and its cybersecurity implications. The following insights into the impact of these activities are informed by testimonials from relevant stakeholders collected over a 12 month period. 

Shaping National AI Strategy and Policy Direction

The AI Readiness Metric trial has contributed to a notable shift in how Mongolian stakeholders in the private and public sector approach AI. Discussions have gradually shifted from simply introducing AI, towards more strategic considerations around the appropriate form of AI adoption, for instance, issues such as precautions when using open AI services, whether countries or organisations should develop their own AI systems, and the risks of relying on external services are now being discussed in more concrete terms.

At the policy level, this growing focus is reflected in the government’s decision to declare 2026 as the “Year of Big Data and AI.” In parallel, a national AI strategy is currently under development, with indications that it will integrate cybersecurity and national security considerations.

Stakeholders report that the trial has helped elevate AI as a policy priority and provided an initial framework for considering both opportunities and risks in a more structured way.

Increasing Awareness of AI-Driven Cybersecurity Risks and Advantages

The AI Metric trial has also contributed to increased awareness of the cybersecurity implications of AI adoption. Across Mongolia’s cybersecurity community, and particularly among incident response teams, there is growing recognition that AI is not only an efficiency tool, but as a critical factor in maintaining competitiveness in the cyber domain.

Practitioners have highlighted the accelerating use of AI in automating cyberattacks, reinforcing the view that defensive capabilities must evolve accordingly: “If attackers use AI, defenders must also use AI to keep up.”

Driving Cross-Sector Engagement and Capacity Building

The AI Metric trial has helped to catalyse engagement across government, private sector, and academia. This includes government efforts to drive nationwide AI adoption, increased private sector investment in AI infrastructure, and the introduction of specialised AI training and capacity-building programmes delivered through a newly established AI Academy.

One of the most significant impacts has been the increased dialogue between government and industry. AI has emerged as a focal point for cooperation in the technology field and has contributed to an increasing interest in human‑resource development.

Supporting Cooperation and Trust Building for Future Success

Beyond domestic impacts, the AI Metric trial has played an important role in strengthening intergovernmental relationships. As initiative funders, the UK and Japan have particularly deepened their engagement in Mongolia through this work.Government representatives noted that the activities have helped establish a baseline for engagement on cybersecurity and built further trust with local stakeholders.

Overall, though tangible impact will only evolve over time, the National AI Cybersecurity Readiness Metric trial has begun to generate early impacts across policy, practice, and partnership. From shaping national AI strategy and raising awareness of emerging cyber risks from AI adoption, to strengthening cross-sector collaboration, the trial has lain the foundations for more secure and strategic AI adoption in Mongolia.