The European Commission has presented an action plan to supplement existing EU rules on AI and cybersecurity.
The plan targets three goals:
- promoting safe and responsible use of advanced AI
- boosting the EU’s cyber resilience, and
- scaling up European AI capabilities for cyber defense
To support safe deployment of advanced AI models, the Commission will strengthen Europe’s capacity to evaluate models before they reach the EU market, in line with the AI Act of 2024.
The new plan builds a EU-level evaluation capacity to support the AI Office in judging model capabilities and risks.
It will also work with ENISA, the EU’s cybersecurity agency, to build a secure framework for accessing advanced AI systems for cyber defense purposes. Starting in the third quarter of 2026, ENISA is set to issue guidance on defending against AI-enabled threats and integrating AI safely into cybersecurity operations.
The Commission is also encouraging organizations to use AI, including suitable open-source models, to spot and fix vulnerabilities faster.
A pilot open-source resilience campaign is planned for the fourth quarter, aimed at mapping critical software components and speeding up fixes with AI tools. By the end of 2026, the Commission plans to launch an EU-wide competition on AI-assisted vulnerability remediation.
The initiative responds to AI’s double-edged role in security: the same advanced models that speed up threat detection and incident response can also be used by bad actors to automate attacks and exploit weaknesses at unprecedented speed and scale.
