EU cyber plan aims to reduce reliance on foreign AI systems

The European Commission has unveiled a new Action Plan on Cybersecurity and Artificial Intelligence, designed to strengthen Europe’s cyber resilience while reducing its dependence on foreign AI providers.

The strategy sets out nine measures aimed at making frontier AI models safer and more accessible for trusted cybersecurity organisations, preparing Europe’s cyber ecosystem for AI-driven threats and expanding the development of European AI capabilities.

The move comes amid growing concerns that access to advanced AI models is concentrated among a small number of providers outside Europe. Recent restrictions on access to some frontier AI systems have highlighted how geopolitical tensions could affect Europe’s ability to use advanced AI for cybersecurity research and defence.

Among the proposed measures are expanding access to frontier AI models for vetted cybersecurity researchers, strengthening Europe’s AI model evaluation capabilities, improving vulnerability discovery and coordinated disclosure, and encouraging organisations to adopt AI – including open-source models where appropriate – to improve threat detection and incident response.

The Commission also wants closer cooperation between governments, industry and research organisations to prepare for AI-enabled cyber threats.

The plan builds on existing legislation, including the NIS2 Directive, the Cyber Resilience Act and the AI Act, rather than introducing new regulatory requirements. Instead, it aims to coordinate investment, research and operational cooperation as AI becomes increasingly central to both cyber defence and offensive operations.

For security leaders, the announcement signals that AI resilience is becoming a strategic issue as much as a technical one. While organisations continue to adopt AI-powered security tools, the Commission is making clear that Europe’s long-term cyber resilience will also depend on access to trusted AI infrastructure and reducing dependence on a handful of overseas providers.