On Tuesday (7 July), the European Commission revealed its answer to the rapidly developing AI models that threaten the cybersecurity of government and essential services infrastructure. The Action Plan on Cybersecurity and Artificial Intelligence outlines nine key actions aimed at strengthening the EU’s ability to harness AI for defence while protecting against its increasing use as a tool for cyberattacks.
The logic is straightforward. AI can be a huge asset for cybersecurity, spotting threats and patching vulnerabilities faster than humans can. But the same power can be turned into a weapon, and the Commission is blunt about this, warning that AI is becoming a defining feature of the threat landscape, making attacks more automated and sophisticated. The plan tries to capture the upside while limiting the downside.
There’s a political layer to this too. The most powerful AI models are mostly built outside the EU, largely in the US, which leaves European hospitals, energy grids and government agencies somewhat dependent on foreign companies’ decisions about who gets access to advanced tools, and when. The Commission treats that dependency as a real risk to Europe’s digital resilience and technological sovereignty, not just a cybersecurity footnote.
Rather than new legislation, the plan builds on existing rules like the AI Act and NIS2, and lays out nine actions grouped around three goals: making frontier AI models safe and accessible for European use, preparing Europe’s cyber defences for an AI-powered threat landscape, and growing Europe’s own AI-cybersecurity industry and skills.
The plan also nods to international cooperation with the G7, NATO and the UK, and admits that building real European capacity in this space will cost hundreds of billions of euros, more than public budgets can cover alone, tying it to the Commission’s broader push for a new EU investment vehicle.
Although it is a Communication – not binding by nature – it creates a direction already set out in last month’s Tech Sovereignty Package: the EU must secure capabilities across the entire value chain of the new economy, from materials, machinery and chips design, to cloud capacity, AI models and application.
