Summary
The European Commission on July 7 unveiled a comprehensive “Action Plan on Cybersecurity and Artificial Intelligence” to address both the risks and opportunities of advanced AI in cybersecurity. The plan outlines three primary objectives: promoting the safe and responsible use of advanced AI, reinforcing the EU’s cybersecurity resilience, and scaling Europe’s AI capabilities for defensive cyber operations.
Key initiatives include strengthening Europe’s capacity to evaluate AI models before they enter the EU market (aligned with the AI Act), developing a “European Blueprint” for secure access to advanced AI for cybersecurity through ENISA, and establishing a secure testing platform in partnership with ENISA and the Commission’s Joint Research Centre. The plan also launches an “EU Grand Challenge on AI for cybersecurity” to foster innovative defensive tools.
The Action Plan builds on the EU’s existing legal frameworks — the AI Act, Cyber Resilience Act, NIS2 Directive, DORA, and Cyber Solidarity Act. Notably, concerns over potential restrictions on access to powerful AI models like Anthropic’s Mythos contributed to the urgency, highlighting the EU’s desire to develop internal evaluation and access capabilities independent of foreign providers.
Source
European Commission · EU Digital Strategy
Commentary
The EU’s move to build sovereign AI testing and evaluation capabilities for cybersecurity is a direct response to the realization that depending entirely on foreign AI labs creates strategic vulnerability. The explicit mention of Anthropic’s Mythos as a catalyst is telling — when a U.S. export restriction can cut off your access to frontier AI models, you need a Plan B.
The “EU Grand Challenge on AI for cybersecurity” could genuinely accelerate European defensive AI innovation if it’s backed by meaningful funding and reduced bureaucratic friction. Combined with the UK’s Cyber Shield announcement on the same day, this represents a clear trend: Western governments are no longer treating AI-powered cyber defense as optional. The race is now about execution speed.