Brussels turns the AI Act's cyber requirements into a market for evaluations and structured access

verifiedLegalRegulation

Thursday, July 9, 2026

Confidence

High · — regulator primary source with multi-outlet corroboration; funding figures and evaluation-capacity timeline unattached

Evidence

EU Commission primary + factsheet + MLex analysis

The European Commission presented its Action Plan on Cybersecurity and Artificial Intelligence on 7 July, operationalizing the AI Act's pre-market model-evaluation requirement rather than proposing new legislation.

The details

MLex reports the plan will not be accompanied by new legislation; it enforces what is already on the books.
Under the AI Act, advanced AI models must be evaluated and their risks assessed before being placed on the EU market, and the Commission will help establish an EU evaluation capacity to strengthen third-party assessment, supporting the AI Office.
The Commission will work with ENISA to define a European blueprint for structured access to advanced AI capabilities, and ENISA and the Joint Research Centre will create a secure platform to test AI for cybersecurity — bringing know-how on safe AI use to operators in critical sectors.
The AI Act's general-purpose provisions start to be enforced on 2 August 2026.

What it means

The Commission has quietly created a procurement market. AI Weekly's read is the sharpest: the AI Office is about to become a real customer for evaluations, red-team simulations, and structured access tooling — a market that did not exist a year ago. For legal ops at any US frontier lab selling into Europe, that means the "structured access" blueprint is the document that determines whether you sell on your terms or on ENISA's. For CISOs at EU-market enterprises, the practical binding action is 2 August: the Code of Practice becomes enforceable, and the plan's testing platform is the venue where a critical-sector deployment will eventually have to prove out. The "no new legislation" line is not a de-escalation — it means enforcement is the story now.

MLex reports the plan will not be accompanied by new legislation; it enforces what is already on the books.
Under the AI Act, advanced AI models must be evaluated and their risks assessed before being placed on the EU market, and the Commission will help establish an EU evaluation capacity to strengthen third-party assessment, supporting the AI Office.
The Commission will work with ENISA to define a European blueprint for structured access to advanced AI capabilities, and ENISA and the Joint Research Centre will create a secure platform to test AI for cybersecurity — bringing know-how on safe AI use to operators in critical sectors.
The AI Act's general-purpose provisions start to be enforced on 2 August 2026.

Sources

Brussels turns the AI Act's cyber requirements into a market for evaluations and structured access

Turn a Raw Expense Report Batch into an AI-Fraud Risk Memo

Gemini API Managed Agents

One daily brief. Every story gets a hype verdict.