EU unveils AI Cybersecurity Action Plan

The European Commission has unveiled a new Action Plan on Cybersecurity and Artificial Intelligence, setting out how the European Union intends to strengthen cyber resilience as advanced AI models reshape both cyber defence and cyberattacks.

Rather than introducing another layer of regulation, the Action Plan focuses on putting legislation already in place into operation through new institutions, secure testing environments and closer collaboration between governments, industry, and researchers.

Europe Moves From Regulation to Implementation

The Action Plan builds on legislation already in force, including the AI Act, Cyber Resilience Act, NIS2 Directive, Digital Operational Resilience Act (DORA), and the Cyber Solidarity Act.

The Commission is establishing the structures needed to support secure AI deployment across Europe, rather than introducing additional legal obligations.

Among the first measures is a proposal to establish a dedicated European AI evaluation capability, expected to become operational during 2027. The capability will support the independent assessment of advanced AI models with the intention of strengthening the work of the EU AI Office.

The Commission will also work with the European Union Agency for Cybersecurity (ENISA) to develop a framework enabling authorised public and private organisations to access frontier AI models securely for cybersecurity purposes.

AI is Changing Cyber Operations

The Action Plan recognises that AI is influencing both defensive and offensive cyber capabilities.

Advanced models can help identify vulnerabilities, automate elements of incident response, and strengthen cyber defence. At the same time, they can also support vulnerability discovery, exploit generation and increasingly sophisticated attacks.

“AI is transforming the meaning of cybersecurity,” said Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy. “We must harness and focus existing capabilities, networks, and the legal framework to fortify the cybersecurity protecting our digital landscape.”

The Commission’s response focuses on ensuring organisations can use these technologies safely as operational adoption continues to expand.

Secure Testing Takes Centre Stage

A central element of the Action Plan is the creation of secure environments where AI systems can be evaluated before deployment.

ENISA and the Joint Research Centre will establish a dedicated testing platform supporting organisations across sectors including energy, healthcare, finance, transport, and public administration.

Alongside this work, the Commission is encouraging stronger cyber hygiene, wider adoption of security-by-design principles and greater use of AI, including open-source models, to identify and remediate vulnerabilities.

ENISA will also expand collaboration with governments, industry and the open-source community to strengthen the security of critical open-source software.

Turning Policy Into Practice

The Action Plan also introduces longer-term initiatives, including an EU Grand Challenge on AI for Cybersecurity and continued investment supporting AI Factories and related research programmes.

These initiatives contribute to Europe’s wider technology strategy, but the immediate priority is practical implementation.

The Action Plan focuses on building the capability needed to apply existing legislation rather than introducing further regulation.

Europe’s Cyber Strategy Enters a New Phase

The Action Plan suggests the European Union is entering a new stage of its cybersecurity strategy.

Much of the legislative framework is already in place, but attention is now turning towards the organisations, testing environments and technical capability needed to apply those rules in practice.

As AI becomes more widely deployed across cybersecurity, operational readiness may become just as important as the legislation governing its use.