The European Commission has presented an Action Plan for a structured response to address the risks and harness the opportunities of advanced artificial intelligence (AI) models for cybersecurity.
With new advanced AI models redefining cybersecurity, according to the Commission, AI can be misused to identify vulnerabilities, automate attacks and increase the scale and speed of cyber incidents at an unprecedented speed.
“The EU has strong foundations in place to adapt its response in the face of vulnerabilities that emerging tech brings with it”, said EC executive vice-president Henna Virkkunen: “We must harness and focus existing capabilities, networks and the legal framework to fortify the cybersecurity protecting our digital landscape.”
The Commission Action Plan will bring together Member States, industry and EU-level organisations to strengthen the cybersecurity of our digital landscape against the vulnerabilities posed by advanced AI.
Under the EU’s AI Act, advanced AI models must be evaluated, and mitigation measures carefully assessed, before the models are placed on the EU market.
To foster ‘homegrown’ expertise, the Commission will launch a dedicated call to establish an EU evaluation capacity, covering cybersecurity, expected to be operational in 2027. This new capacity will contribute to the regulatory function of the AI Office by strengthening third-party assessment of AI capabilities and risks globally.
With Europe also needing clear and transparent conditions for accessing the most advanced AI systems, the Commission says it will work with the EU Agency for Cybersecurity (ENISA) to define a European blueprint for structured access to advanced AI capabilities for cybersecurity. This guidance will support relevant European public and private organisations in gaining access to advanced AI models.
ENISA and the Commission’s Joint Research Centre will create a secure platform to test AI for cybersecurity, including using simulated environments. This will bring know-how on the safe use of AI to operators in critical sectors, such as finance, energy, health, transport and the public administration.
To protect its critical infrastructure against the vulnerabilities arising from the potential misuse of these technologies, the EU executive says organisations need to intensify cyber hygiene practices, risk management measures, and security by design principles.
Organisations should start using already available AI capabilities, including through open-source models, to identify and fix vulnerabilities faster, as well as to prevent and to respond to cyberattacks.
To assist organisations in this transition, ENISA will support and facilitate partnerships between public authorities, businesses and open-source communities in the cyber ecosystem. This will include guidance, recommendations and best practices as well as a campaign to secure Critical Open Source Software.
To stimulate the European market to scale up, the Commission is going to the ‘EU Grand Challenge on AI for cybersecurity’. This competition will bring together companies, researchers and organisations to develop AI solutions for cybersecurity.
The EU must continue investing in developing its own sovereign advanced AI capabilities, leveraging the infrastructure provided by the AI Factories and future Gigafactories. In this context, the upcoming European Tech equity capacity, announced in the Tech Sovereignty Package, could crowd in private investment to scale up homegrown AI capabilities.
