EU Launches AI Cybersecurity Action Plan as ESRB Raises Systemic Risk to "Severe"

The European Commission presented its Action Plan on Cybersecurity and Artificial Intelligence on July 7, 2026, on the same day MEPs quizzed the Commission in plenary on AI and cybersecurity risks. The plan includes a blueprint for structured EU access to advanced AI capabilities for cybersecurity, guidance on AI-powered threat defense, and mandates for the AI Office to work with specialized evaluators to assess advanced models before they reach the EU market. The ESRB simultaneously raised its assessment of systemic cyber risk to "severe" from "elevated," citing frontier AI models as a paradigm shift in the threat landscape — and the ECB issued a letter to 110 major banks requiring action plans by October 31. For law firm CISOs and innovation leaders, the plan signals that AI governance in the EU is converging with cybersecurity governance: AI procurement decisions at law firms serving EU-regulated sector clients — banking, insurance, financial services — now sit directly in the scope of supervisory attention.