Not a new law. An implementation plan. The EU is describing what it will do, not what it's banning - that's a different animal.
Fact
The facts: On 7 July 2026, the European Commission presented its Action Plan on Cybersecurity and Artificial Intelligence with five actions: a European blueprint (the Commission and ENISA) for structured access to advanced AI capabilities for cybersecurity; building EU capacity to evaluate AI models before they reach the market, supporting the regulatory function of the AI Office (the EU body overseeing enforcement) under the AI Act; a secure testing platform (ENISA together with the Joint Research Centre, the EU's scientific institute); and an EU Grand Challenge for AI in cybersecurity. The plan builds on the AI Act, the Cyber Resilience Act (the EU's product security law), NIS2, DORA, and the Cyber Solidarity Act (the EU's law for collective cyber defense). Primary source: digital-strategy.ec.europa.eu.
Executive Vice-President Henna Virkkunen put it briefly: AI is changing what cybersecurity means, and we have to keep pace.
Under the surface sits a real machine: evaluating a model before market needs a test environment, people, a methodology, and - the hardest part - actually understanding what you're looking at. The EU admits as much indirectly, by building the platform together with the Joint Research Centre. So there's no ready tool yet; there's an institution that's about to build one.
If you're building something on top of someone else's model, you start carrying documentation - where it came from, how it was evaluated, what it does. Today that looks unnecessary. In two years it'll be the first question from every serious client. It's cheaper to keep it from the start.
In practice: if you're building on top of someone else's model, you start carrying documentation - where it came from, how it was evaluated, what it does. Not because someone will audit you tomorrow, but because in two years this will be the first question from every serious client. It's cheaper to keep it from the start.
Sources
European Commission - EU Action Plan on Cybersecurity and AIEuropean Commission - New EU plan on advanced AI and cybersecurityThe visual is generated code-art, no third-party images.