EU Commission launches plan to counter AI-driven cybersecurity threats – INSIGHT EU MONITORING
EU Commission launches plan to counter AI-driven cybersecurity threats – INSIGHT EU MONITORING
Publish Date: 2026-07-07 15:37:00
Source Domain: ieu-monitoring.com
Using an unordered list, summarize the following article with between 4 and 8 key points.
Strasbourg, 7 July 2026
The European Commission has presented an Action Plan for a structured response to address the risks and harness the opportunities of advanced artificial intelligence (AI) models for cybersecurity.
New advanced AI models are redefining cybersecurity. AI can be misused to identify vulnerabilities, automate attacks and increase the scale and speed of cyber incidents at an unprecedented speed.
Building on the EU’s unique legal framework for AI and cybersecurity, the Action Plan will bring together Member States, industry and EU-level organisations to strengthen the cybersecurity of our digital landscape against the vulnerabilities posed by advanced AI.
Evaluating AI models
Effective security requires a thorough understanding of how new technologies can be used, misused and exploited. Under the AI Act, advanced AI models must be evaluated, and mitigation measures carefully assessed, before the models are placed on the EU market.
To foster homegrown expertise, the Commission will launch a dedicated call to establish an EU evaluation capacity, covering cybersecurity, expected to be operational in 2027. This new capacity will contribute to the regulatory function of the AI Office by strengthening third-party assessment of AI capabilities and risks globally.
Accessing advanced AI models
Europe also needs clear and transparent conditions for accessing the most advanced AI systems.
The Commission will work with the EU Agency for Cybersecurity (ENISA) to define a European blueprint for structured access to advanced AI capabilities for cybersecurity. This guidance will support relevant European public and private organisations in gaining access to advanced AI models.
Testing AI for cybersecurity
ENISA and the Commission’s Joint Research Centre will create a secure platform to test AI for cybersecurity, including using simulated environments. This will bring know-how on the safe use of AI to operators in critical sectors, such as finance, energy, health, transport and the public administration.
Reinforcing the EU’s cybersecurity and fixing vulnerabilities
The EU must protect its critical infrastructure against the vulnerabilities arising from the potential misuse of these technologies.
As foreseen by the EU’s cybersecurity rules, organisations should intensify cyber hygiene practices, risk management measures, and security by design principles.
Organisations should start using already available AI capabilities, including through open-source models, to identify and fix vulnerabilities faster, as well as to prevent and to respond to cyberattacks.
To assist organisations in this transition, ENISA will support and facilitate partnerships between public authorities, businesses and open-source communities in the cyber ecosystem. This will include guidance, recommendations and best practices as well as a campaign to secure Critical Open Source Software.
Scaling European AI capabilities for cyber
To stimulate the European market to scale up, the Commission will launch the EU Grand Challenge on AI for cybersecurity. This competition will bring together companies, researchers and organisations to develop AI solutions for cybersecurity.
The EU must continue investing in developing its own sovereign advanced AI capabilities, leveraging the infrastructure provided by the AI Factories and future Gigafactories. In this context, the upcoming European Tech equity capacity, announced in the Tech Sovereignty Package, could crowd in private investment to scale up homegrown AI capabilities.
Background
The EU has a legal framework fit to address cybersecurity in the age of emerging tech, like AI. The AI Act requires to assess and mitigate risks from AI models while the General-Purpose AI Code of Practice further specifies these requirements and facilitates compliance by advanced model providers. These provisions will start to be enforced on 2 August 2026.
The Cyber Resilience Act, to be applicable by end of 2027, mandates security by design for hardware and software products. In addition, the Network and Information systems, or NIS2, Directive aims to boost the security of critical sectors such as transport and energy, together with Digital Operational Resilience Act (DORA) for the financial sector. The Cyber Solidarity Act strengthens capacities in the EU to detect, prepare for and respond to significant and large-scale cybersecurity threats and attacks.
For more information
Quote
AI is transforming the meaning of cybersecurity. And we must keep pace. The EU has strong foundations in place to adapt its response in the face of vulnerabilities that emerging tech brings with it. We must harness and focus existing capabilities, networks and the legal framework to fortify the cybersecurity protecting our digital landscape.
Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy
Source – EU Commission
Remarks by Executive Vice-President Virkkunen on the Action plan on Cybersecurity and Artificial Intelligence
Strasbourg, 7 July 2026
“Check against delivery”
Advanced AI models create many possibilities. They can help us to prepare and protect but they can also be used against us.
Advanced AI can create cyber exploits in just minutes or hours, for a fraction of the cost of human experts. While a major vulnerability can cost over 1 million EUR on the grey market, AI only needs data center compute power. Once weaponised, these flaws can endanger our infrastructure and society, which is built upon digital systems.
The Commission’s response has been immediate. We engaged with the entire AI and cybersecurity ecosystem: with Member States, with AI providers, with industry, and with our international partners.
We are not starting from scratch. The EU already has robust legal and policy foundations to address these challenges. We are now turning them into action, capability, and resilience, along three priorities.
First, AI models with high cyber capabilities must be safe. And Europeans must have access to use them.
Through the AI Act, the EU has the world’s strongest framework to protect us from the potential risks of advanced AI. The Commission’s AI Office is already working with AI companies to implement these rules.
Under the AI Act, advanced AI models must be evaluated, and mitigation measures carefully assessed, before the models are placed on the EU market.
In less than a month, the AI Office will have enforcement powers. Testing models before they are released is key to reducing risk. To build expertise, the EU will launch a call to boost its AI evaluation capacity—especially in cybersecurity—aiming to be operational by 2027.
The EU Agency for Cybersecurity, ENISA, will play an important role in operationalising this Action Plan, as well as some Member States.
Together with ENISA, we will develop a European Blueprint for structured access to advanced AI models, with focus on cybersecurity.
The Blueprint will support both AI providers and European organisations, including companies, on how to identify those who get access and on which terms. It will also serve as a basis for cooperation and alignment with international partners.
But access is not enough. We must also strengthen our know-how on how to deploy these technologies for our cybersecurity, by testing their cyber capabilities.
This is why the Commission will set up a secure platform to test AI for cybersecurity already by the end of 2026.
The platform will allow us to assess how models can be used safely for cybersecurity operations in critical sectors such as finance, energy, health, transport or public administration.
Second, we must also be able to protect ourselves against malicious attacks stemming from the misuse of such models.
Our immediate priority is clear: identify and fix the most critical vulnerabilities faster. The first step is the full and effective implementation of our cybersecurity legislation: the NIS2 Directive, DORA, and the Cyber Resilience Act.
This applies to all member states – I want to take the opportunity to highlight the urgency of implementing especially the NIS2 directive.
But we also need targeted action where exposure is the highest for our critical infrastructure. We will therefore launch a Critical Open Source Resilience Campaign, to support maintainers in fixing the most critical vulnerabilities in key open-source projects.
AI is not only a risk: it is also a strategic enabler of cyber resilience. Existing AI tools can already help with vulnerability management, threat detection, and incident response. We must support their safe and secure uptake across critical sectors, SMEs and public authorities. And we must do so fast.
Third, we must build Europe’s own AI-powered cyber capabilities.
We cannot rely only on non-European solutions for capabilities that are critical for our security.
Building up our own AI frontier models is costly, but in today’s world, the cost of not building them will be even higher.
Frontier AI requires very large-scale investment, far beyond what public funding alone can provide. We need to mobilise private capital, and especially equity. The new European tech equity capacity announced in the Tech Sovereignty Package can be a game changer here.
Europe has what it takes to compete. We have the talent. We have a solid cybersecurity and AI ecosystem. We have AI Factories and, in the future, AI Gigafactories that can be part of a sovereign European infrastructure for AI and cybersecurity.
Source – EU Commission
Post navigation
