Hello Cyber Builders đź––
I don’t usually react to news, but this one needs a Cyber Builders post.
On July 7, the European Commission published its Action Plan on Cybersecurity and Artificial Intelligence. For once, Brussels moved fast. Mythos stormed the public conversation a few months ago, and here is an official EU response with named actions and dates.
I read all 15 pages so you don’t have to. Here’s what the plan says, where I agree, and where Europe needs to push further. I’m tracking Europe 2031 and Opération Promethée, but if the reaction stays limited, nothing changes.
One reminder before we start: your security program cannot wait for any of this. I already gave you the list of what your company should be doing this quarter — read the Mythos-ready program here.
Let’s get started.
The Action Plan is built on three pillars, plus an international cooperation track.
Pillar 1 — Making frontier AI safe, accessible and deployable for European cybersecurity. This is the heart of the plan. Three key actions:
-
An EU evaluation capacity for AI models, with cybersecurity mandatory in scope, to be established in 2027. Independent, third-party, pre-release evaluation of frontier models — done in Europe, feeding the AI Office’s enforcement work under the AI Act (which kicks in fully on August 2, 2026).
-
A European Blueprint for structured access to advanced AI cyber capabilities (Q4 2026). In plain words: a framework defining how frontier AI providers grant access to European CERTs, critical infrastructure operators, cyber vendors, and researchers — including contingency measures if a provider or a foreign government withdraws access.
-
A secure testing platform run by ENISA and the JRC (Q4 2026), so critical infrastructure operators can test frontier AI on realistic cyber use cases — vulnerability scanning, remediation, incident response — without exposing real systems.
Pillar 2 — Prepare the EU’s cyber ecosystem for AI. Focus on fundamentals. Implement NIS2 and DORA now. Speed up patching. Upgrade vulnerability management and the EU Vulnerability Database for AI-level discovery. The plan includes a Critical Open Source Resilience Campaign (Q4 2026) to connect sponsors with maintainers, supported by ENISA’s catalog of AI-powered patching. 98% of codebases use open source, and critical infrastructure averages 80% high-risk vulnerabilities.
Pillar 3 — Scale European AI for cyber. The EU Grand Challenge on AI-assisted remediation (Q4 2026) is smart: discovery moves faster than remediation, which helps attackers. Access to AI Factories’ compute, training modules from the Cybersecurity Skills Academy. The plan admits building sovereign frontier AI needs hundreds of billions, not just public funds.
That’s the plan. Now let’s see what we can do.
This plan is good news. The Commission, ENISA, and governments are moving faster than ever. Mythos hit in spring; a plan with actions and deadlines landed in July. That speed is new and positive.
The diagnosis is lucid too. The Commission writes, in an official communication, that frontier capabilities are “mainly developed outside of the EU” and that “their availability is often determined by non-transparent, foreign-led processes.” It even plans for the scenario where access to a frontier model is switched off by a provider or a third-country authority.
Remember what I wrote on LinkedIn when Anthropic complied with the US government halt within 48 hours: when you rent instead of own, the landlord changes the terms. Brussels has now put that exact risk into policy language. Good.
Willingness isn’t enough. Institutions move fast on paper. Now they need to move fast on capital and mobilize the hundreds of billions needed. Do it now, not after more consultations.
Here is where I want Europe to go further.
The Blueprint in Pillar 1 is a framework for asking. It details how foreign providers grant access to European organizations and what happens if they withdraw it.
That’s cautious, but it’s still a tenant negotiating with a landlord.
Europe’s cybersecurity strategy cannot be limited to regulating technologies developed elsewhere. Regulation is necessary. But regulation without technological leadership creates dependency, not sovereignty.
The international landscape has fundamentally changed. Technology is no longer exchanged through purely cooperative partnerships — it has become an instrument of geopolitical power. Access to AI models, semiconductors, cloud infrastructure and critical cyber capabilities increasingly reflects negotiations between competing blocs, not open collaboration.
Don’t ask for access to foreign capabilities. Build capabilities that create balanced partnerships.
Europe has real leverage: a huge tech market, top research, strong engineering, deep industry, and low-carbon energy. That’s negotiating power. Use it.
Future partnerships must be reciprocal. If global tech providers want access to Europe, they should help strengthen European capabilities: tech transfer, research, investment, manufacturing, talent, centers of excellence. Partnerships should build European strength, not dependency.
Independent, pre-release evaluation comes first. That’s exactly right and deserves more focus.
Strategic autonomy begins with understanding.
Any technology capable of finding thousands of exploitable flaws in the systems we all depend on should not be governed solely by its creators’ internal judgment. Bruce Schneier made that argument after Mythos, and he was right. Today, almost all serious third-party evaluation capacity sits outside the EU. If evaluation is how democracies get visibility into frontier risk, Europe currently has no eyes of its own.
Don’t stop at frontier models. Europe should benchmark AI, cyber products, cloud platforms, and hardware against European use cases — measuring security, resilience, transparency, performance, and suitability. Without this, Europe can’t make informed choices or guide investment.
One institute in Europe is moving faster than any other. It’s the AI Security Institute in the UK. Yes, after Brexit, the UK is not within the scope of the EU Commission. But I feel they are showing the way and demonstrating why the evaluation of frontier AI capacities is material.
Evaluation is strategic, not just compliance. It tells you what to buy, build, or avoid. Europe has top offensive security talent — we can lead here. 2027 is late, but the direction is right.
Policy alone won’t deliver cybersecurity leadership. Europe needs more startups that can become global leaders, and an ecosystem that helps them succeed.
Large European enterprises must step up: be design partners, early customers, and deployment environments for innovation. No more pilots that die in procurement. Real contracts, real deployments, real feedback.
Public procurement, venture capital, and industrial programs must align to accelerate companies that can compete globally, not subsidize fragmented national champions.
I’m more optimistic than the plan. Europe is behind at frontier scale, but cybersecurity needs specialized models: fine-tuned, smaller, cheaper models for detection, triage, log analysis, malware reverse engineering, patching, identity checks. Models you can run on sovereign compute, on-prem, or air-gapped for defense.
The plan gives us the ingredients: AI Factories focused on cyber, access to sensitive datasets, a Grand Challenge on AI-assisted remediation, strong open source models. Specializing open models for cyber is a race Europe can win on talent and data, not raw compute. Cyber builders should bet here. I am.
Incremental investments aren’t enough. The plan commits €200M for AI-cyber R&D and €100M for defense tech startups. It says frontier AI needs hundreds of billions, but offers millions and a consultation. That gap is the story.
Europe should launch a €100B frontier AI program in 2026 to start: sovereign foundation models, AI infrastructure, cybersecurity tech, advanced computing. Not grants — equity, with public anchor capital bringing in private risk capital, as the Tech Sovereignty Package suggests. The design is right; scale and urgency are missing.
If you think I am crazy, think twice. Read Europe 2031 — a rigorous five-year scenario written by European researchers that shows exactly where the current trajectory leads: economic and political irrelevance, values we cannot defend, welfare systems we can no longer fund. Read Opération Promethée — a detailed three-year plan for a French-led frontier AI lab, sized at roughly $700 billion over three years, 12 gigawatts of compute by 2029, deliberately framed as this generation’s Pierrelatte moment. Serious people have done the math. €100 billion is not the crazy number. It is the entry ticket.
And the money exists. As the Europe Banking Federation analysis puts it: “Confronted with massive financing needs, Europe can no longer defer the deepening of its capital markets.”
“Europe generates abundant savings, which should be an asset for the financing of its economy. Household financial savings amount to €35,533 billion, fueled by one of the world’s highest savings rates (13.3%). However, these savings are poorly allocated.
Europe exports its savings through the acquisition of foreign debt securities and imports the equity funding necessary for the development of its companies. As a result, the rest of the world captures the value created by European companies.”
Europe Banking Federation “DEVELOPING EUROPEAN CAPITAL MARKETS TO FINANCE THE FUTURE”
Europe has €35 trillion in household savings but sends it abroad to finance foreign debt while importing equity. We’re financing everyone’s future except our own.
Europe already has the other ingredients: world-class scientific talent, leading industrial companies, advanced semiconductor research, deep cybersecurity expertise — and, critically, abundant low-carbon electricity.
Energy is a decisive advantage in the AI era. Other regions face electricity constraints for data centers, but Europe can expand nuclear, solar, and wind capacity (reliable, low-carbon generation) to support AI infrastructure at scale.
But the strategic objective is not to export electricity.
Europe should sell intelligence, not electrons. Export tokens, models, cyber capabilities, and AI-powered products instead of energy. That shift creates more value and turns a natural advantage into technological sovereignty.
The Commission admits the cost of not building grows every year as the AI gap widens. Act accordingly. Every quarter of consultation compounds the gap.
Let’s bring this back to you.
The Commission, ENISA, and governments are reacting faster than ever. That deserves recognition. The Action Plan gets the diagnosis right, puts independent evaluation first, and admits — in writing — that sovereign frontier AI needs hundreds of billions.
The next test is simple: mobilize that capital now, not after the gap becomes irreversible. Europe 2031 shows what happens if we don’t. Promethée shows what it costs if we do. Neither is comfortable reading. Both are more realistic than the status quo.
My real message: don’t wait for public funding.
-
Builders: build more. The specialized cyber model opportunity is real, customers are here, and you don’t need permission to ship.
-
Enterprises: buy European where the product is better, and become the design partners that turn startups into champions.
-
All of us: put our money to work. Europe’s €35 trillion in savings is leverage, but it’s in the wrong assets. Invest in companies. Back European equity, funds, and builders. Use your money to build the EU economy, not someone else’s frontier.
Digital Sovereignty is not something Brussels grants you. It is something builders, customers, and investors create — one company at a time.
I am willing to help — whether you are a policymaker working on these actions, a founder building in this space, or a CISO retooling your program. Happy to have a chat.
What are you doing in your company to get ready? Tell me in the comments.
Laurent đź’š
