The European Commission has unveiled a new action plan aimed at establishing a coordinated response to the growing cybersecurity risks posed by advanced artificial intelligence while harnessing the opportunities offered by these emerging technologies.
Announced in Brussels, the initiative reflects the Commission’s assessment that advanced AI models are fundamentally reshaping the cybersecurity landscape. While these technologies offer significant defensive capabilities, they can also be exploited to identify software vulnerabilities, automate cyberattacks and increase the speed, scale and sophistication of malicious operations.
The action plan builds on the European Union’s existing regulatory framework, particularly the AI Act, and includes measures to strengthen the evaluation of advanced AI models before they are introduced to the market. It also outlines plans to establish a dedicated European capability for assessing AI-related cybersecurity risks by 2027.
As part of the initiative, the Commission will work closely with the European Union Agency for Cybersecurity (ENISA) to develop a harmonised European mechanism governing access to advanced AI systems. The two sides also plan to establish a secure testing platform that will enable AI technologies to be evaluated in simulated environments supporting critical sectors, including energy, finance, transport and healthcare.
The plan further promotes the adoption of “security by design” principles and encourages the use of artificial intelligence, including open-source models, to identify vulnerabilities and improve the speed and effectiveness of cyber incident detection and response. It also seeks to strengthen collaboration between public and private sector organisations, alongside open-source software communities, to enhance Europe’s cybersecurity resilience.
In addition, the Commission intends to launch the European Grand Challenge for AI in Cybersecurity, an initiative designed to accelerate the development of advanced European cybersecurity solutions while reinforcing the continent’s technological sovereignty.
The action plan accompanies the phased implementation of several European cybersecurity regulations and directives aimed at strengthening the protection of critical infrastructure and the financial sector against increasingly sophisticated digital threats.
