Artificial intelligence is rapidly transforming the cybersecurity landscape. AI can help detect vulnerabilities, prevent cyberattacks and strengthen the protection of critical infrastructure. At the same time, it can also be exploited by malicious actors to automate attacks, identify weaknesses and carry out cyber operations at unprecedented speed and scale.

Building on the EU's existing legal framework on AI and cybersecurity, the Action Plan sets out a coordinated approach to help Member States, businesses and public authorities benefit from the opportunities offered by AI while addressing the new risks it creates. It focuses on 3 complementary objectives:

1. Promoting the safe and responsible use of advanced AI
2. Reinforcing the EU's cybersecurity and resilience
3. Scaling up Europe's AI capabilities for cybersecurity

To promote the safe use of advanced AI, the Commission will strengthen Europe's capacity to evaluate AI models before they are placed on the EU market, in line with the AI Act. It will also work with the European Union Agency for Cybersecurity (ENISA) to develop a European Blueprint for secure access to advanced AI systems for cybersecurity purposes and establish a secure testing platform to help organisations in critical sectors, such as energy, transport, health, finance and public administration, safely test and deploy AI solutions.

The Action Plan also reinforces the EU's cybersecurity by promoting the implementation of existing EU cybersecurity legislation, including the NIS2 Directive and the Cyber Resilience Act. It encourages organisations to use AI, including open-source models where appropriate, to detect and address vulnerabilities more quickly and improve their ability to prevent and respond to cyberattacks.

To strengthen Europe's technological leadership, the Commission will launch an EU Grand Challenge on AI for cybersecurity, bringing together companies, researchers and other stakeholders to develop innovative AI-powered cybersecurity solutions. The EU will also continue investing in sovereign AI capabilities, building on initiatives such as AI Factories and future Gigafactories, while encouraging private investment to help scale up European AI technologies.

The Action Plan complements the EU's existing legal framework for AI and cybersecurity, including the AI Act, the Cyber Resilience Act, the NIS2 Directive, the Digital Operational Resilience Act (DORA) and the Cyber Solidarity Act. By bringing together EU institutions, Member States, industry, researchers, open-source communities and international partners, it aims to ensure that Europe can harness the benefits of AI while remaining resilient against emerging cybersecurity threats.

You can download the Action Plan below.