{"id":12547,"date":"2026-08-27T21:30:00","date_gmt":"2026-08-27T20:30:00","guid":{"rendered":"https:\/\/lawwwing.com\/?p=12547"},"modified":"2026-07-23T14:16:39","modified_gmt":"2026-07-23T13:16:39","slug":"eu-action-plan-on-cybersecurity-and-artificial-intelligence","status":"publish","type":"post","link":"https:\/\/lawwwing.com\/en\/eu-action-plan-on-cybersecurity-and-artificial-intelligence\/","title":{"rendered":"The EU presents its Action Plan on Cybersecurity and Artificial Intelligence"},"content":{"rendered":"\n
<\/div>\n\n\n\n

On July 7, 2026, the European Commission published its new Communication on the Cybersecurity and Artificial Intelligence Action Plan<\/strong><\/a>, a strategic document that acknowledges that AI is no longer just another tool in cybersecurity, but has become the factor that is completely redefining the playing field, both for those defending systems and those attacking them.<\/p>\n\n\n\n

Although it does not directly introduce new legal obligations, it does set the direction for European policy for the coming years and anticipates regulatory and operational developments that organizations should start preparing for now.<\/p>\n\n\n\n

<\/div>\n\n\n\n

The Context: AI as a Double-Edged Sword<\/h2>\n\n\n\n
<\/div>\n\n\n\n

The European Commission starts from the premise that frontier AI models, the most advanced systems currently available or under development, already enable cybersecurity teams to detect and respond to threats faster and at greater scale. However, those same capabilities are also being used to automate cyberattacks, identify vulnerabilities more quickly, and carry out increasingly sophisticated offensive operations, including organized cybercrime.<\/p>\n\n\n\n

According to the Commission itself, the underlying challenge is that these frontier AI capabilities are developed predominantly outside the European Union, and access to them depends on the often non-transparent decisions of foreign providers. As a result, access to these technologies has become not only a matter of digital resilience but also of European technological sovereignty.<\/strong><\/p>\n\n\n\n

<\/div>\n\n\n\n

Three Strategic Pillars<\/h2>\n\n\n\n
<\/div>\n\n\n\n

For this reason, the Action Plan is built around three main objectives, which we will examine below.<\/p>\n\n\n\n

<\/div>\n\n\n\n

1. The Safe and Responsible Use of Advanced AI<\/h3>\n\n\n\n

The European Commission announces that, from 2 August 2026, it will fully exercise its supervisory and enforcement powers under the AI Act in relation to general-purpose AI models, including those that present systemic cybersecurity risks.<\/p>\n\n\n\n

The Communication also notes that most of the leading organizations carrying out independent evaluations of AI models before deployment are located outside the European Union. This is regarded as a strategic weakness because the AI Act itself recognizes the importance of independent third-party assessments of the systemic risks posed by general-purpose AI models before they are placed on the market.<\/p>\n\n\n\n

To address this challenge, the Action Plan sets out several key initiatives:<\/p>\n\n\n\n

    \n
  1. Establish a European AI evaluation capability by 2027, providing an independent \"European option\" for assessing AI models before they are released.<\/li>\n\n\n\n
  2. Develop a structured access \"Blueprint\"<\/strong>, in cooperation with ENISA (the European Union Agency for Cybersecurity), enabling European organizations\u2014including public authorities, critical infrastructure operators, and cybersecurity providers\u2014to securely access AI models with advanced cyber capabilities.<\/li>\n\n\n\n
  3. Create a secure testing platform<\/strong>, led by ENISA and the Joint Research Centre (JRC). This platform will use cyber ranges (simulated cyber environments) so that operators of critical infrastructure can test and experiment with AI systems without putting their real-world systems at risk.<\/li>\n<\/ol>\n\n\n\n
    <\/div>\n\n\n\n

    2. Strengthening the Resilience of the European Cybersecurity Ecosystem<\/h3>\n\n\n\n

    Artificial intelligence can significantly improve cybersecurity, but it can also be used to identify vulnerabilities and carry out faster, more sophisticated attacks. For this reason, the EU aims to strengthen its preparedness for these risks by promoting the use of AI-powered tools to detect and remediate vulnerabilities in the most critical systems. As part of this effort, ENISA will play a key role in adapting European cybersecurity to the AI era.<\/p>\n\n\n\n

    The Commission also calls for the urgent transposition of the NIS2 and DORA Directives, ensuring that AI-related risks are incorporated into supervisory frameworks. In addition, organizations are encouraged to implement basic cyber hygiene measures, adopt zero trust security architectures, and begin using available AI capabilities\u2014including open-source AI tools\u2014to identify vulnerabilities and prevent cyberattacks.<\/p>\n\n\n\n

    For its part, ENISA will publish guidance on protecting against AI-enabled threats and on the secure integration of AI tools into cybersecurity operations, with particular attention given to the needs of small and medium-sized enterprises (SMEs).<\/p>\n\n\n\n

    Because AI enables attackers to discover and exploit vulnerabilities much more quickly, the EU also intends to accelerate its response capabilities through several initiatives:<\/p>\n\n\n\n