Privacy & Cybersecurity Law Blog

On July 7, 2026, the European Commission presented an Action Plan on Cybersecurity and Artificial Intelligence (the “Action Plan”) aimed at supporting the safe and responsible use of artificial intelligence (“AI”) while strengthening cyber resilience across the European Union. The Action Plan reflects the European Commission’s view that advanced AI models can improve vulnerability detection, incident response and infrastructure protection, but also can be misused to identify weaknesses, automate attacks and increase the speed and scale of cyber incidents.

The Action Plan builds on the EU’s existing legal framework for AI and cybersecurity, including the EU AI Act, the Cyber Resilience Act, the NIS2 Directive, the Digital Operational Resilience Act and the Cyber Solidarity Act. According to the European Commission, the Action Plan is designed to coordinate the efforts of EU Member States, EU bodies, industry, researchers and open-source communities in addressing cyber risks associated with advanced AI while supporting the use of AI tools for defensive cybersecurity purposes.

A central aspect of the Action Plan is the European Commission’s intention to strengthen the EU’s capacity to evaluate advanced AI models, including with respect to cybersecurity risks, before such models are placed on the EU market. To support that objective, the European Commission plans to establish an EU evaluation capacity expected to become operational in 2027. The European Commission will also work with the EU Agency for Cybersecurity (“ENISA”) to develop a European blueprint for structured access to advanced AI capabilities for cybersecurity purposes and create a secure testing platform to help organizations in critical sectors test and deploy AI tools in controlled environments.

The Action Plan also encourages organizations to reinforce cyber hygiene, risk management and security-by-design practices in light of the growing availability of AI-enabled cyber capabilities. The European Commission is also encouraging the use of existing AI tools, including open-source models where appropriate, to identify and remediate vulnerabilities more quickly and improve cyber defense. In support of that effort, ENISA is expected to issue guidance and best practices and to support cooperation among public authorities, industry, and open-source communities, including through a pilot initiative focused on critical open-source software.

Read the Action Plan press release with a link to the downloadable Action Plan.