THE EU PREPARES FOR THE NEXT GENERATION OF AI-DRIVEN CYBER THREATS

AI is rapidly changing the cybersecurity landscape, not only by giving defenders more powerful tools to detect vulnerabilities and respond to incidents, but also by enabling attackers to automate reconnaissance, develop more sophisticated attacks and operate at a speed that traditional security measures struggle to match. Recognising that this technological shift requires more than incremental policy updates, the European Commission presented a new Action Plan on Cybersecurity and Artificial Intelligence in July 2026, setting out a coordinated strategy to ensure that the EU can harness the benefits of advanced AI while reducing the risks associated with its misuse.

Rather than proposing new legislation, the Action Plan builds on the EU’s existing regulatory framework, including the AI Act, the Cyber Resilience Act, the NIS2 Directive and the Cyber Solidarity Act, while introducing practical measures aimed at strengthening Europe’s cybersecurity capabilities. Among the most significant initiatives are:

• the creation of an EU capacity to independently evaluate advanced AI models before they reach the European market;
• the development of a common European blueprint for secure access to frontier AI systems for cybersecurity purposes in cooperation with the EU Agency for Cybersecurity;
• the establishment of a secure testing platform where organisations operating critical infrastructure will be able to assess AI systems in controlled environments before deploying them in operational settings.

The plan also reflects a broader industrial ambition. Alongside measures to improve cyber resilience, the Commission intends to expand Europe’s own AI capabilities through initiatives such as AI Factories, future AI Gigafactories and the launch of an EU Grand Challenge on AI for Cybersecurity, designed to bring together researchers, public authorities and industry to develop European AI solutions for cyber defence. Taken together, these initiatives show that the Commission increasingly sees cybersecurity and AI as inseparable policy areas, where technological competitiveness, regulatory oversight and operational resilience must evolve together if Europe is to remain secure in an increasingly AI-driven threat landscape.

Author(s): Francesca Foliti, Agency for the Promotion of the European Research