On 7 July 2026, the European Commission published an Action Plan on cybersecurity and artificial intelligence (the “Action Plan”). The Action Plan sets out a structured response to address the risks and harness the opportunities of advanced artificial intelligence (“AI”) models for cybersecurity.
The Action Plan complements the EU’s existing legal framework for AI and cybersecurity, including the EU AI Act, the Cyber Resilience Act, the NIS 2 Directive (“NIS 2”), the Digital Operational Resilience Act (“DORA”) and the Cyber Solidarity Act. It aims to bring together Member States, industry and EU institutions, bodies and agencies to strengthen the cybersecurity of the EU’s digital landscape against the threats posed by the rapid development of frontier AI models.
Background
The Action Plan notes that frontier AI models (ie, the most advanced AI models available or under development) have led to increasing opportunities and risks in the cybersecurity space. While the EU has already taken significant action in order to lay the legal and operational foundations to address the impact of frontier AI on cybersecurity, the Action Plan states that further action remains necessary.
Politically, the publication of this Action Plan also shares common motivations with the recently proposed EU Technology Sovereignty Package (previously discussed here). In recent months, concerns have increased surrounding the rise in the development of frontier AI models, particularly as this space is currently dominated by third countries including the USA and China. The US government’s introduction of export controls affecting advanced AI models serves as a further reminder of the importance of scaling up European AI capabilities.
Executive Vice-President for Tech Sovereignty, Security and Democracy, Henna Virkkunen, noted that “AI is transforming the meaning of cybersecurity. And we must keep pace. The EU has strong foundations in place to adapt its response in the face of vulnerabilities that emerging tech brings with it. We must harness and focus existing capabilities, networks and the legal framework to fortify the cybersecurity protecting our digital landscape.”
What is included in the Action Plan
The Action Plan is structured around three key objectives or pillars, with nine key actions spanning 2026 and 2027. These three pillars and the key actions under each pillar include:
1. Making frontier AI safe, accessible, and deployable for European cybersecurity
- Key Action 1 – The Commission will support the establishment of an EU evaluation capacity for AI models that must include cybersecurity (2027).
- Key Action 2 – The Commission in coordination with ENISA will define a European Blueprint for structured access to advanced AI capabilities for cybersecurity purposes to ensure that European organisations can access such capabilities safely and timely (Q4 2026).
- Key Action 3 – ENISA and the Joint Research Centre of the European Commission (“JRC”) will develop a secure testing platform for AI with advanced cyber capabilities for cybersecurity use cases to boost timely and secure deployment of AI in cybersecurity (Q4 2026).
2. Preparing the EU’s cyber ecosystem for the age of AI
- Key Action 4 – ENISA in cooperation with relevant Union entities will issue guidance, recommendations, advisories and best practices on the protection against AI-powered threats and for the secure integration of AI in cybersecurity operations (as of Q3 2026).
- Key Action 5 – The Commission, Member States, ENISA and industry will cooperate in view of making existing vulnerability management practices and tools fit for the AI Age (as of Q3 2026).
- Key Action 6 – ENISA, in cooperation with the Commission, Member States, open source communities, Union entities and industry, will launch a first pilot of a Critical Open Source Resilience Campaign to accelerate patching including by leveraging AI (Q4 2026).
3. Scaling European AI capabilities for cybersecurity
- Key Action 7 – The Commission, with support of the European Cybersecurity Competence Centre, and in cooperation with ENISA, will launch an EU Grand Challenge to help scale European AI-powered cybersecurity solutions (Q4 2026).
- Key Action 8 – The Commission, jointly with Member States, will aim to make available access to AI Factories’ compute capacity to test, train and deploy available advanced and frontier AI models for cyber resilience on sovereign compute.
- Key Action 9: The Commission will work with Member States and industry (under the Cybersecurity Skills Academy) to develop training modules for cybersecurity professionals on the use of AI for cybersecurity (Q4 2026).
In addition to these core pillars, the Action Plan also stresses the need for international cooperation in reinforcing cybersecurity capabilities. The European Commission intends to actively engage with the G7 Digital & Tech and Cybersecurity Working Groups, as well as with deep bilateral exchanges and engagements with NATO to reinforce the concrete actions summarised below.
Pillar 1: enabling safe and secure AI for cybersecurity
Frontier AI poses a real risk to cyber infrastructure in the EU. From 2 August 2026, the Commission will begin enforcing the EU AI Act, with particular focus on AI systems and general purpose AI models that may pose cybersecurity risks. In Ireland, the government are adopting a distributed model of AI oversight, with enforcement of the EU AI Act resting with the AI Office of Ireland (as acting as the central co-ordinating authority) and a number of sectoral authorities (previously discussed here). However, the EU AI Act alone is not sufficient to address all systemic risks related to cybersecurity posed by AI. Therefore, the Action Plan proposes to build on the legal framework provided by the EU AI Act, to enhance EU pre-release AI evaluation capacities, facilitate access to advanced AI capabilities in the EU, and coordinate testing efforts so that frontier AI can be used safely for cybersecurity in the EU.
Currently, the majority of entities performing third-party evaluations of AI models prior to their deployment are located outside of the EU. In order to strengthen Europe’s ability to assess advanced AI models, the Commission will support the establishment of a dedicated AI evaluation capability for cybersecurity in 2027, which will be supplemented by the proposal of criteria for third-party evaluators of general purpose AI. These measures will inform the EU’s understanding of potential systemic risks not only in the area of cybersecurity, but also in biotech and other areas.
Following any pre-deployment assessments, organisations are frequently limiting access to their AI systems through staged releases, with little transparency as to how these limitations are designed. The Commission and the EU Agency for Cybersecurity (“ENISA”) will develop a framework to support European public and private organisations in accessing advanced AI capabilities for cybersecurity purposes as a guidance document detailing how providers of AI can grant access. The guidance document / blueprint, expected to be published in Q4 2026, will include criteria that should be considered, however it will not introduce new obligations for providers beyond those already included in regulation. The blueprint should include contingency measures in case of restricted or withdrawn access to AI with advanced cyber capabilities. The Commission intends to explore joint procurement with Member States where timely access to frontier AI is needed.
ENISA and the JRC will create a secure testing platform to help critical sectors, which may include finance, energy, healthcare, transport and public administration, evaluate and adopt AI-enabled security solutions in Q4 2026. This testing platform will allow for the testing of advanced AI cyber capabilities in critical infrastructure’s systems without exposing real infrastructure to risk. The usage of these testing platforms will be focused on strengthening cyber resilience, it will not be aimed at evaluating general purpose AI models for compliance with the AI Act.
Pillar 2: strengthening cyber resilience for the age of AI
As advanced AI cyber capabilities become increasingly accessible and widely deployed, the Action Plan states that the EU must be ready both to address their possible misuse against its economy and society, and to use them safely for cyber resilience.
The Action Plan notes that the EU’s cyber regulatory framework, including NIS 2 and DORA, provides a strong baseline for the preparedness of critical infrastructures against all types of cybersecurity risks, including those related to AI. In addition, as reflected in the Cyber Resilience Act, which will become fully applicable on 11 December 2027, secure-by-design development practices, systematic vulnerability management, timely patching and secure coding practices – including approaches that eliminate entire classes of vulnerabilities, such as memory-safe software development – remain essential.
To support these efforts, the Action Plan states that ENISA (in cooperation with relevant EU entities) will issue guidance, recommendations, advisories and best practices, to help organisations remain protected against AI-powered threats and to foster secure integration of AI tools in cybersecurity operations. From Q3 2026, ENISA will collaborate with public authorities and industry to make existing vulnerability management practices and tools across the EU fit for purpose in the context of AI.
A Critical Open Source Resilience Campaign will be piloted in Q4 2026, following a mapping of critical open source components by ENISA, the Commission, Member States and open source communities, to accelerate vulnerability remediation and patching, including through the use of AI. This builds on the existing EU Open Source Strategy, published earlier this year.
Pillar 3: scaling European AI capabilities for cybersecurity
In line with the general push for tech and data sovereignty in the EU, the Action Plan stresses the need for sovereign AI capabilities for sensitive use cases. The Action Plan states that the EU must now enable European providers, including disruptive innovators, to develop, deploy and scale such advanced AI systems in Europe. To support the development of advanced AI enabled cybersecurity technologies, the EU is investing €200 million through the Horizon Europe and Digital Europe programmes, alongside new projects focused on AI-driven cyber monitoring, detection, response and recovery capabilities. Additionally, before the end of 2026, the Commission will enable investments by the EIC Fund into cyber and AI tech companies as part of a €100 million investment into strategic defence tech startups and scale ups.
The Action Plan recognises that the full development of sovereign frontier AI capabilities will cost hundreds of billions of euros, which cannot be entirely covered through public funds. The Commission proposes to rely on private investment to make up any shortfall, drawing specific attention to the consultations with Member States, the EIB Group, and other key stakeholders on the proposal of setting up a new European equity capacity for investments in advanced technology and infrastructure, which were part of the EU Technology Sovereignty Package.
This funding will assist in the development of sovereign general purpose frontier AI capabilities. As part of this development, existing AI factories and future gigafactories will be leveraged. The proposed Cloud and AI Development Act intends to further prioritise such projects.
In order to complement this investment, the Commission will launch the EU Grand Challenge on AI assisted vulnerability remediation to encourage innovation and the development of advanced AI security solutions in Q4 of this year. At the same time, through the Cybersecurity Skills Academy, new training modules will be developed for cybersecurity professionals regarding AI, and ENISA will update the European Cybersecurity Skills Framework to integrate AI-related competencies.
Comments
The Action Plan highlights the need for a coordinated and comprehensive approach to enhancing the EU’s ability to identify and address cybersecurity vulnerabilities, while strengthening the security of its digital landscape. In this way, it has a heavy focus on risk management, considering the ways in which newer AI models can exploit vulnerabilities in existing cybersecurity systems. These risks are tangible, and a major consideration across sectors internationally.
Some of the timelines proposed in the Action Plan may be ambitious, particularly given the levels of financial investment that will be required to implement the three pillars discussed above. It will also require Member States to complete the transposition and implementation of NIS 2 in order to ensure the full effect of the proposed cybersecurity developments. In Ireland, NIS 2 has yet to be transposed having missed the transposition deadline of the 17 October 2024, though the General Scheme for the Cybersecurity Bill was published in 2024 (as previously discussed here). On 8 July 2026, the European Commission announced that it had referred Ireland, among other countries, to the Court of Justice of the European Union for failing to transpose NIS 2 into national law.
While the Action Plan does not impose positive obligations on organisations, many of the proposed key actions outlined above will have a direct impact on EU organisations. Additionally, it is stressed that organisations should adjust their risk management measures to protect against AI-powered cyberattacks, consistently apply basic cyber hygiene measures and start to use already available AI capabilities to detect vulnerabilities and improve detection and prevention of cyberattacks. Overall, an effort should be made to assess cybersecurity measures at this juncture. Furthermore, organisations should be taking steps to prepare for compliance with their new obligations under NIS 2, the Cyber Resilience Act and the EU AI Act, along with related Irish legislation, once implemented.
The Action Plan represents a timely next step by the Commission in translating the EU’s existing regulatory framework into concrete action in the cybersecurity space. ENISA is set to play a key role in delivering on the contents of the Action Plan together with other EU institutions and agencies. Europe will not want to be left behind as frontier AI continues to develop. The Action Plan recognises the need to first strengthen the EU’s ability to test these AI models in a secure and controlled manner, and improve EU cyber defences, before releasing these models across the EU’s critical sectors. The Commission will regularly assess the implementation of the Action Plan over the coming years.
Contact us
If you have any questions on anything contained in this article, or on AI and cybersecurity regulation generally, please contact any member of our Technology and Innovation Group or your usual Matheson contact.
