The European Commission has introduced an EU Action Plan aimed at addressing both the risks and opportunities created by advanced artificial intelligence models in cybersecurity. The initiative seeks to coordinate efforts among Member States, industry participants, and EU-level organizations to reinforce the security of Europe's digital environment. According to the Commission, advanced AI models are reshaping cybersecurity by offering new capabilities while also creating opportunities for misuse, including identifying vulnerabilities, automating attacks, and increasing the scale and speed of cyber incidents.

The Action Plan outlines several initiatives covering AI evaluation, controlled access, cybersecurity testing, and vulnerability management. Under the AI Act, advanced AI models must undergo evaluation, with mitigation measures assessed before they enter the EU market. To strengthen expertise within Europe, the Commission plans to launch a dedicated call to establish an AI evaluation capacity focused on cybersecurity that is expected to become operational in 2027. This capability will support the AI Office by expanding independent assessments of AI capabilities and associated risks at the global level.

The Commission also plans to work alongside the European Union Agency for Cybersecurity to establish a European blueprint for structured access to advanced AI capabilities used in cybersecurity. The guidance is intended to help eligible public and private organizations obtain access to advanced AI models under transparent conditions. In parallel, ENISA and the Commission's Joint Research Centre will create a secure testing platform using simulated environments, enabling organizations in sectors including finance, energy, health, transport, and public administration to evaluate AI for cybersecurity applications.

The Action Plan further encourages stronger cybersecurity practices by urging organizations to reinforce cyber hygiene, apply risk management measures, and adopt security-by-design principles. It also promotes the use of available AI capabilities, including open-source models, to identify vulnerabilities more quickly while improving cyberattack prevention and response. ENISA will support this effort through partnerships involving public authorities, businesses, and open-source communities, alongside guidance, recommendations, best practices, and a campaign focused on securing Critical Open Source Software.

The Commission also outlined measures to expand European AI capabilities through the planned EU Grand Challenge on AI for cybersecurity, bringing together companies, researchers, and organizations to develop cybersecurity solutions. The announcement highlights continued investment in sovereign AI capabilities supported by AI Factories, future Gigafactories, and the proposed European Tech equity capacity. The Action Plan builds upon the existing EU regulatory framework, including the AI Act, the General-Purpose AI Code of Practice, the Cyber Resilience Act, the NIS2 Directive, the Digital Operational Resilience Act, and the Cyber Solidarity Act.

📊 What This Means (Our Analysis)

The Action Plan brings multiple cybersecurity and artificial intelligence initiatives into a single coordinated framework instead of treating them as separate policy efforts. By combining evaluation, testing, access, security practices, and investment measures, the Commission is outlining a structured approach that supports both technological development and cybersecurity preparedness using mechanisms already connected to existing legislation.

The initiative also places equal emphasis on capability building and practical implementation. Its focus on evaluation infrastructure, testing environments, partnerships, and market development demonstrates an effort to strengthen Europe's long-term cybersecurity ecosystem while encouraging wider adoption of AI technologies under clearly defined governance and security expectations.

📌 Our Take: The success of advanced AI in cybersecurity will depend not only on innovation but also on the strength of the systems that evaluate, secure, and support its deployment.