EU unveils action plan to vet advanced AI models for cybersecurity risk before release

The European Commission presented an Action Plan on Cybersecurity and Artificial Intelligence on July 7, aiming to coordinate EU governments, industry and EU bodies against AI-driven cyber threats while using AI to strengthen defenses.

The centerpiece is a push to build EU capacity to evaluate advanced AI models for cybersecurity risk before they reach the market, an effort the Commission expects to be operational by 2027. It signals that Europe wants a security check on frontier models as a gating step, not an afterthought.

The plan pairs that with a Commission-ENISA blueprint for structured access to advanced AI systems for cybersecurity purposes, a secure testing platform for organizations in critical sectors, and a planned “EU Grand Challenge on AI for cybersecurity” competition, the Commission said. ENISA is the EU Agency for Cybersecurity. The Commission also set out to mobilize private capital toward sovereign European AI models, according to the action plan documentation.

Henna Virkkunen, the EU’s Executive Vice-President for Tech Sovereignty, Security and Democracy, said AI “is transforming the very meaning of cyber security, and we must keep pace,” framing weaponized AI vulnerabilities as a threat to Europe’s infrastructure.

As presented, this is a plan of intent, not a regulation: most measures are proposals, funding is unspecified, and the pre-market evaluation capacity does not yet exist. Whether it changes how models are shipped in Europe depends on the 2027 build-out and on member states agreeing to fund it.