Action Plan on Cybersecurity and Artificial Intelligence

Summary

A Commission communication on the risks and opportunities of advanced AI for cybersecurity: AI can help detect vulnerabilities and prevent attacks, but it can be misused to automate attacks and find weaknesses at unprecedented speed and scale. To promote the safe use of advanced AI, the Commission will strengthen EU capacity to evaluate AI models before they are placed on the market, in line with the AI Act, with third-party assessment of capabilities and risks that supports the AI Office; define with ENISA a European blueprint for structured access to advanced AI for cybersecurity; and create with ENISA and the JRC a secure platform to test AI for critical sectors.

Safety topics

Status notes

Adopted at Strasbourg on 7 July 2026 and sent to the Council on 8 July 2026 (Council document 11711/26). The plan has three objectives: promoting the safe and responsible use of advanced AI, reinforcing the EU's cybersecurity and resilience, and scaling up Europe's AI capabilities for cybersecurity; the communication sets them out as three pillars, followed by work with like-minded partners. It promotes the implementation of the NIS2 Directive and the Cyber Resilience Act, encourages organisations to use AI, including open-source models, to find and fix vulnerabilities, and has ENISA provide guidance and a campaign to secure critical open source software. The Commission will launch an EU Grand Challenge on AI for cybersecurity. Its nine key actions include the EU evaluation capacity for AI models (2027), the access Blueprint and the testing platform (Q4 2026), ENISA guidance on protection against AI-powered threats (from Q3 2026), a pilot Critical Open Source Resilience Campaign (Q4 2026), the Grand Challenge (Q4 2026) and training modules for cybersecurity professionals (Q4 2026). The Blueprint will not introduce new obligations for providers, the evaluation capacity will not be a conformity assessment body, and the testing platform is for testing AI for cyber resilience, not for evaluating general-purpose AI models for compliance with the AI Act. The Commission will set up a working group with ENISA, the European Defence Agency and the Member States on the security risks of frontier AI in defence and dual-use critical systems. Internationally, it will work in the G7 and the UN, with the Network of Advanced AI Measurement, Evaluation and Science, and with NATO, and it will regularly assess the plan's implementation. The plan builds on the AI Act, the Cyber Resilience Act, the NIS2 Directive, the Digital Operational Resilience Act and the Cyber Solidarity Act.

Sources

Open the official source https://digital-strategy.ec.europa.eu/en/library/eu-action-plan-cybersecurity-and-artificial-intelligence

Secondary source: https://data.consilium.europa.eu/doc/document/ST-11711-2026-INIT/en/pdf

Local copy

Verification

History

1. 2026-10-17notes: Adopted 7 July 2026 in Strasbourg. Included because its main focus is risks from → Adopted at Strasbourg on 7 July 2026 and sent to the Council on 8 July 2026 (Cou — the reasons for including the plan and for excluding two other Commission strategies are the register's scope decisions (pipeline/scope-decisions.md), not facts about the instrument, and are removed; 'Strasbourg' now comes from the communication's title page ('Strasbourg, 7.7.2026'); objectives and other actions added from the stored pages; transmission to the Council, the pillars, the dated key actions, what the Blueprint, the evaluation capacity and the testing platform are not, the defence working group and the international work added from the communication's text2026-10-17-recheck-europe-1 · Claude Code (claude-opus-5-5)
2. 2026-10-17safety_topics: ["general-purpose / frontier AI", "evaluation & testing", "critical infrastructu → ["general-purpose / frontier AI", "evaluation & testing", "critical infrastructu — 'international cooperation' added (section 5 of the communication: the G7, the UN, the Network of Advanced AI Measurement, Evaluation and Science, NATO); 'national security & military' kept: the communication, now stored, names 'implications for European and national security' and a working group with the European Defence Agency on frontier AI in defence (pass 1 had dropped it on the strength of the web pages alone)2026-10-17-recheck-europe-1 · Claude Code (claude-opus-5-5)
3. 2026-10-17summary: A Commission Communication on the risks advanced AI poses for cybersecurity, suc → A Commission communication on the risks and opportunities of advanced AI for cyb — rewritten from the stored pages: the risk framing, pre-market evaluation in line with the AI Act and its third-party evaluation capacity, the access blueprint 'for cybersecurity' (version 1 said 'for cyber defence') and the testing platform for critical sectors2026-10-17-recheck-europe-1 · Claude Code (claude-opus-5-5)
4. 2026-10-17secondary_url: https://commission.europa.eu/news-and-media/news/new-eu-plan-address-risks-and-o → https://data.consilium.europa.eu/doc/document/ST-11711-2026-INIT/en/pdf — the Council register copy of COM(2026) 577 final (document 11711/26, cover note of 9 July 2026), the communication's full text on an official host, stored in this run; the news article is not the text, and the action plan's download link on the library page is under ec.europa.eu/newsroom/dae/, which robots.txt disallows2026-10-17-recheck-europe-1 · Claude Code (claude-opus-5-5)
5. 2026-10-17date_last_updated: 2026-07-10 → – — 10 July 2026 is the library page's 'Last update', a web page edit, not a new version of the communication2026-10-17-recheck-europe-1 · Claude Code (claude-opus-5-5)

Related records

EU AI Act European Union · Partially in force

European AI Office Decision European Union · In force

Citation

European Commission. Action Plan on Cybersecurity and Artificial Intelligence [COM(2026) 577 final]. 2026-07-07. https://digital-strategy.ec.europa.eu/en/library/eu-action-plan-cybersecurity-and-artificial-intelligence. Status: Published (non-binding, current); verified 2026-10-17 (level A). Local copy archive/EU-17/2026-10-17/official.html retrieved 2026-10-17 18:18:42 UTC, SHA-256 fe6f63a71642104e7f916a1145d2e97c576abc382bcafb52682963c593d186f2. Every AI Policy Ever, version 1.18 (snapshot 2026-10-18), record EU-17.

Improve this record

Know of an amendment, a status change or an error? Report news or an error on GitHub; the form opens with this record filled in.