Google has launched Gemini 3.8 Flash, along with a cybersecurity version that is restricted to governmental use.

      Google has unveiled Gemini 3.8 Flash and Gemini 3.8 Flash Cyber, its third Flash update in six weeks, with the Cyber version limited to trusted testers and government entities. According to the EU AI Act, every general-purpose model released in the market must comply with documentation, copyright, and training data requirements, and any model presenting systemic risk must be reported to the Commission within two weeks.

      Gemini 3.8 Flash is Google's latest release, marking the company's third Flash model in a span of six weeks, as reported by Ars Technica.

      There are two versions available: a general model, referred to by Google as a workhorse, and Flash Cyber, which is specifically designed to identify and address software vulnerabilities. Flash Cyber supersedes version 3.5.

      The Pro line has remained unchanged since early 2026, and according to TNW, the budget model is currently two versions ahead of the flagship model.

      The pricing for these models is promotional until the end of the year, set at $0.75 per million input tokens and $3.75 for output, compared to $1.50 and $7.50 post-promotion. Competitors have been lowering token prices to keep cautious businesses interested.

      In Europe, each product release necessitates compliance measures. Article 53 mandates that technical documentation, a copyright policy, and a public summary of training data must accompany every general-purpose model marketed.

      Google willingly accepted these obligations when it joined the general-purpose AI Code of Practice on 30 July 2025, shortly after Meta chose not to participate.

      The systemic risk tier requires timely reporting. Models trained on more than 10 to the 25th floating-point operations must be reported to the Commission within two weeks as per Article 52. This reporting window is shorter than the interval between these releases, as Gemini 3.7 Flash was launched just three weeks prior to this one.

      It is not publicly known whether any of the models exceed this threshold, as Google has not disclosed this information, and the evaluation is based on training compute rather than benchmark results. Flash models are intentionally smaller than the Pro line.

      The Cyber variant raises additional considerations. Flash Cyber is restricted to trusted testers and government access, with no details provided by Google regarding which governments will be involved.

      Additionally, Google's own statistics suggest that Flash is lagging behind Claude Opus in agentic computer applications, a year after TNW reported on the computer utility added in version 3.5.

      The security claims presented are internally derived, including a reported 2.6x increase in patch accuracy for the Chrome team, and the discovery of a critical vulnerability in two hours, both assessed by Google.

      This cadence of releases brings its own European compliance responsibilities, especially since the product line was not accessible in Europe at its launch.