EU cybersecurity plan raises expectations for AI vendors

The European Commission’s EU Action Plan on Cybersecurity and Artificial Intelligence is shifting from policy design to implementation, setting a roadmap for stronger defenses against AI-powered threats and more secure AI systems. The plan builds on the AI Act, Cyber Resilience Act, NIS2 Directive, Digital Operational Resilience Act and Cyber Solidarity Act to create a coordinated framework for evaluating advanced models and improving cyber resilience.

Planned measures include expanded capacity to assess advanced AI models before they reach the European market, work with ENISA on secure access to advanced AI systems for cybersecurity, and a secure testing platform for sectors including healthcare, finance, energy, transport and public administration. The Commission also plans an EU Grand Challenge on AI for Cybersecurity to bring companies, researchers and public institutions together on new security tools.

Enterprises and global vendors serving European customers may face higher expectations for cybersecurity governance, continuous risk assessment and secure development practices. Companies in regulated sectors may need to prepare for stricter evaluation requirements as AI model assessment capabilities are expected to become operational by 2027. IBM’s Cost of a Data Breach Report 2025 found that extensive use of AI and automation in cybersecurity reduced average breach costs by USD 2.2 million compared with organizations that had not adopted those technologies.