European Commission Presents an EU Action Plan on Cybersecurity and AI
On 7 July 2026 the European Commission presented its Action Plan on Cybersecurity and Artificial Intelligence, COM(2026) 577 final, setting out how the EU intends to secure AI systems and use AI in cyber defence.
The EU keeps building out the rulebook around AI, and the newest piece connects two areas that increasingly overlap: cybersecurity and artificial intelligence. On 7 July 2026 the European Commission presented its Action Plan on Cybersecurity and Artificial Intelligence. It is a policy communication, not a binding regulation, but it signals where EU obligations, funding, and expectations are heading for anyone building AI in or for Europe.
What happened
The Commission published the Action Plan on Cybersecurity and Artificial Intelligence as COM(2026) 577 final on 7 July 2026, alongside press release IP/26/1544. The plan is organised around three pillars, including the safe and responsible use of AI. It sits at the intersection of two things the EU already regulates separately: AI systems (through the EU AI Act) and cybersecurity (through frameworks such as NIS2 and the Cyber Resilience Act).
As a Commission communication, this sets direction and coordinates action rather than creating new legal obligations by itself. The concrete rules that follow from it will arrive later, which is exactly why it is worth reading early.
Why it matters for builders
Two regulatory tracks that used to be handled by different teams are converging. If you build AI systems for the European market, the security of those systems, how they resist prompt injection, data exfiltration, and model abuse, is moving from best practice toward expectation, and eventually obligation. The plan is the early signal of that direction.
The practical response is to stop treating AI safety and cybersecurity as separate checklists. Threat-model your AI features the way you would any other attack surface, keep evidence of how you secure training and inference data, and watch how this plan turns into specific requirements. Pair it with the EU AI Act obligations taking effect in August 2026 and the AI regulatory compliance checklist to keep ahead of what lands next.
Sources
- European Commission, “EU Action Plan on Cybersecurity and Artificial Intelligence” (COM(2026) 577 final, 7 July 2026): https://digital-strategy.ec.europa.eu/en/library/eu-action-plan-cybersecurity-and-artificial-intelligence
- European Commission press release IP/26/1544: https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1544
Further reading
- EU AI Act: what takes effect on 2 August 2026 : the binding obligations already on the calendar.
- Global AI governance in 2026 : how the EU approach compares internationally.
- AI regulatory compliance checklist : how to turn these frameworks into concrete controls.