Cybersecure tools, technologies and services relying on AI

Digital Europe (ECCC) call DIGITAL-ECCC funds development, validation and deployment of AI-based cybersecurity tools and services for Cyber Hubs, CSIRTs, competent authorities and NIS2 entities. Opening 1 September 2026, deadline 14 January 2027 17:00 Brussels time; topic budget €15,000,000 with indicative EU contribution €3,000,000 to €5,000,000 per project and a 50 percent funding rate (indicative 4 grants). Scope includes AI-driven threat and anomaly detection, CTI generation and secure sharing, automated incident response, malware and vulnerability analysis, self-healing and product security by design. Proposals must ensure GDPR and IPR compliance, align with the AI Act and CRA where relevant, demonstrate operational readiness for licensing to public cyber authorities, and follow the Funding & Tenders Portal application procedures.

What it funds

Scope and expected outcomes

Development, testing, validation and deployment of AI-based cybersecurity systems and services for national authorities and cyber actors (e.g. Cyber Hubs, CSIRTs, NCSCs, NIS SPOCs). Typical activities include AI-driven CTI creation and sharing, anomaly and threat detection, automated incident response and self-healing, vulnerability discovery and automated testing, privacy-preserving CTI exchange, secure-by-design AI tools and support for certification/standardisation of trustworthy AI.

Who can apply:Public bodies and national competent authorities, National and Cross-Border Cyber Hubs, CSIRTs, NCSCs, entities covered by NIS2, tool and service providers, SMEs and private organisations (applications may be single organisations or consortia, e.g. providers together with Cyber Hubs).

1. 1Call identifier: DIGITAL-ECCC
2. 2Programme: Digital Europe (Strengthening European Cybersecurity Technologies, Capacities and Preparedness)

Indicative funding and scale:indicative topic budget €15 000 000; individual grants expected in the range €3 000 000 to €5 000 000 (indicative number of grants: 4). Projects must comply with EU legal frameworks including the AI Act, GDPR and cybersecurity legislation. Applications via the EU Funding & Tenders Portal Funding & Tenders Portal. ¹

Key applicant considerations:proposals should demonstrate deployment readiness, cybersecure design and compliance with IPR/data protection; linkage with National Coordination Centres (NCCs)/Cyber Hubs is recommended; in justified cases access to EuroHPC resources may be requested.

Footnotes

1. 1Call document, topic description and budget overview are available on the Funding & Tenders Portal: Topic page.

Call and administrative facts

Call identifiers, dates and programme

Call title:Strengthening European Cybersecurity Technologies, Capacities and Preparedness. Topic identifier: DIGITAL-ECCC. Programme: Digital Europe Programme (DIGITAL). Type of action: DIGITAL JU Simple Grants. Type of Model Grant Agreement: DIGITAL Action Grant Budget-Based [DIGITAL-AG]. Opening date: 01 September 2026. Deadline (submission): 14 January 2027, 17:00 Brussels time. Submission procedure: single-stage via the EU Funding & Tenders Portal.

Primary objective and expected outcome:Support development, validation, certification and deployment of AI-powered cybersecurity systems to serve National and Cross‑Border Cyber Hubs, CSIRTs, NCSCs, NIS SPOCs and other competent authorities; enable automation and scaling of Cyber Threat Intelligence (CTI) processes; foster secure/trustworthy AI, compliance with EU legislation (AI Act, GDPR, IPR), and contribution to standardisation and certification of AI-driven cybersecurity technologies.

Scope and technical focus

Scope:Develop and deploy AI-based cybersecurity systems and tools addressing at least one of: continuous anomaly and pattern detection; novel CTI creation; real-time monitoring and automated response; malware behaviour analysis; vulnerability identification and management; cross-domain risk reduction at AI-IoT-smart grid and manufacturing chain intersections; incident recovery and self-healing; automated large-scale vulnerability scanning and penetration testing; business-sensitive access anomaly detection and data protection; anonymised CTI sharing; product security/cybersecurity-by-design in line with CRA requirements. Proposals must ensure cybersecure AI systems (including protections for learning-phase systems and supply chain security), compliance with AI Act, GDPR and IPR, robustness, performance, and trustworthiness. Links with HPC/EuroHPC stakeholders are encouraged where appropriate (access requests to EuroHPC may be granted in well-justified cases).

1. 1Targeted capabilities: CTI generation & sharing, automated CTI processing, detection & mitigation, incident response acceleration, self-healing/recovery, vulnerability scanning, IoT and critical-infrastructure crossover protection.
2. 2AI technologies covered: traditional ML, deep learning, machine-learning pipelines, generative AI (GenAI) use and mitigation approaches, explainable AI, trust and accountability tools, secure model training and deployment methods.
3. 3Regulatory & standards alignment: compliance with AI Act, GDPR, CRA product-security-by-default/ design, support for cybersecurity certification schemes and standardisation activities (ENISA references).

Who can apply and eligible applicant types

Eligible applicant types (examples and typical applicants expected):startups, SMEs, large enterprises, tool and service providers, universities, research institutes, non-profit organisations, public bodies, CSIRTs, NCSCs, National or Cross-Border Cyber Hubs, National Coordination Centres (NCCs) and other competent authorities under the NIS2 framework, public-private partnerships and consortia combining industry and Cyber Hubs. Tool and service providers are explicitly welcome to apply also in consortium with Cyber Hubs. Detailed eligible country and entity lists are provided in section 6 of the call document and the Participant Register; applicants must confirm eligibility in the call document.

Mentioned countries and networks:Explicitly referenced: EU Member States (27) plus Iceland and Norway (Network of NCCs includes one national centre from each of the 27 EU Member States plus Iceland and Norway). Broader eligibility follows Digital Europe/DEP call conditions (see call document section 6).

Funding, budget and expected grants

Topic-specific budget and indicative grant sizes (2026 budget year):The CyberAI topic allocation: €15,000,000 (total for topic cluster). Indicative contribution per selected project: €3,000,000 to €5,000,000. Indicative number of grants for this sub-topic: 4 (as listed in the call portal). Other related sub-topics in the call have separate budgets and grant sizes (AI4SME, COORDPREP, DUALUSE, EULEG, NCC, REGCABH) — see the portal budget overview for full breakdown.

Funding type and nature of support:Primary funding mechanism: Grant (budget-based action grant, Digital Action Grant Budget-Based model). Nature of support: direct financial support (grants). Non-monetary support: possible access to EuroHPC HPC resources in well-justified cases and networking with HPC stakeholders; licensing under favourable market conditions to public Cyber Hubs and CSIRTs is a deployment objective rather than guaranteed in-kind support.

Consortium requirement, geographic scope and project stage

Consortium requirement:Single‑stage submission; the call accepts proposals from single applicants and from consortia depending on the chosen sub-topic and your project design. The topic text explicitly welcomes tool and service providers to apply alone or in consortium with Cyber Hubs. Check call conditions (section 6) for specific sub-topic consortium or national participation constraints. Beneficiary geographic eligibility: EU / EEA associated participating countries as set in the call document and Digital Europe rules; the Network of NCCs includes EU27 plus Iceland and Norway and the call materials reference eligibility in those contexts. Project stage expected: development through validation, demonstration and deployment at operational conditions—projects should include development, testing and validation in relevant operational contexts and be ready for licensing/deployment to Cyber Hubs, CSIRTs and competent authorities.

1. 1Consortium modes allowed: single applicant or consortium (both permitted; consortia encouraged where access to Cyber Hubs, CSIRTs or NCCs is required).
2. 2Geographic eligibility: primarily EU Member States and Digital Europe eligible/associated countries; consult section 6 of the call document for the definitive eligible country list.
3. 3Expected project maturity: TRL oriented towards deployment — mature prototypes validated in realistic conditions, demonstration in operational environments, and path to licensing and certification.

Application process and templates

Application type:Open call, single-stage submission via the EU Funding & Tenders Portal. Applicants must use the Portal submission system and the DEP application form templates (Part A administrative data entered online and Part B narrative technical description uploaded as PDF). A set of mandatory administrative annexes (e.g. Ownership Control Declaration) and the DEP Model Grant Agreement apply. Submission sessions are opened for multiple sub-topic variants under the overall call identifier; check the submission entry for DIGITAL-JU-SIMPLE / DIGITAL-AG in the Portal.

Application form structure (summary and guidance):Application Form (DEP) is composed of Part A (administrative structured data entered in the Portal) and Part B (technical narrative PDF). Part B template (technical description) structure: Cover page and project summary; 1. Relevance (objectives, policy contribution, supply chain, financial obstacles); 2. Implementation (maturity, implementation plan, project management, financial management, risk management, capacity and consortium roles); 3. Impact (expected outcomes and deliverables, dissemination and communication, competitiveness, sustainability); 4. Work plan and work packages (detailed WP descriptions, deliverables, milestones, staff effort per WP, subcontracting, purchases and equipment, other cost categories, timetable); 5. Other (ethics, security); 6. Declarations. Annexes: detailed budget table/calculator where applicable, CVs, list of previous projects and other special annexes requested by the call. Page limits and layout: Part B page limit normally up to 70 pages unless call document provides otherwise; font/margins rules apply. Ownership Control Declaration and other administrative templates must be completed and uploaded as required. For full templates and mandatory forms use the Portal Submission System and the application form templates resource in the call documents Application Form templates and call documents. ¹

1. 1Part A: Online fields (administrative information, participants, budget summary, declarations).
2. 2Part B: PDF technical description following the template structure (project summary, relevance, implementation, impact, work plan, ethics/security).
3. 3Annexes: Ownership Control Declaration, DEP Model Grant Agreement (MGA) extracts (DEP MGA), detailed budget table/calculator if applicable, CVs and other supporting documents as required by the call.

Evaluation, award criteria and stages

Evaluation and award:Single-stage submission with evaluation and award criteria and thresholds described in the call document (section 9) and the Online Manual. The call uses the standard submission and evaluation processes of the Funding & Tenders Portal. Applicants must comply with admissibility conditions (proposal page limit and layout described in Part B template). Indicative evaluation timeline: see call document section 4 for grant agreement preparation timeline. No separate multi-stage selection is indicated for this topic (single-stage).

Number of application stages required:1 (single-stage submission). Applications are evaluated on the submitted full proposal; successful applicants move to grant preparation and signature phases per the DEP model grant procedures.

Co-funding, eligibility checks and legal/financial set-up

Co-funding requirement:The call document and the DEP Model Grant Agreement govern eligible costs, funding rates and co-funding rules. The call overview indicates budget-based grants with typical Digital Europe grant mechanics. Applicants must consult the call document and the DEP MGA for precise funding rates, possible co-funding or contribution expectations, and the rules on VAT, indirect costs, unit costs and eligible cost categories. Financial and operational capacity and exclusion checks apply (see call document section 7). Ownership and control restrictions may apply; all beneficiaries/affiliated entities must supply the Ownership Control Declaration as part of the submission package. The Portal also enforces Legal Entity Validation (LE validation) and LEAR appointment and may require financial capacity evidence for certain applicants.

Success rates and competitiveness

Indicative number of grants for this sub-topic:4 (CyberAI). The Portal does not publish a guaranteed success rate or the expected number of applicants; success rates therefore depend on the number and quality of eligible proposals submitted. Applicants should assume competition and prepare full, well-structured technical proposals aligned to the award criteria in the call document.

Key compliance and technical requirements

Mandatory compliance areas and technical expectations:- Cybersecurity and privacy by design (GDPR compliance where personal data is processed). - AI security and mitigation of AI misuse; secure training and deployment practices including supply chain security. - Alignment with AI Act obligations and support for certification/standardisation. - Robustness, performance and explainability/algorithmic accountability where appropriate. - Evidence of testing, validation and pilots in relevant operational contexts; demonstrators targeted for Cyber Hubs, CSIRTs and other competent authorities. - Where applicable, anonymisation or privacy-preserving methods for CTI sharing to avoid sensitive data exposure. - Consideration of CRA product-security-by-default/ design requirements where relevant.

1. 1Deliverables should include tested prototypes/demonstrators, CTI feeds/services, integration and handover plans for Cyber Hubs/CSIRTs, and contributions to standardisation/certification roadmaps.
2. 2Security and ethics self-assessment must be included in the application (Part A and Part B sections on ethics and security).
3. 3If subcontracting or procurement is foreseen, beneficiaries must follow best value-for-money purchasing practice and public procurement rules where applicable.

Practical support and contact points

Support resources:Contact National Cybersecurity Coordination Centres (NCC) in your country for guidance; applicants can also contact the ECCC Applicants Direct Contact Centre at applicants@eccc.europa.eu. Technical guidance, templates and the Funding & Tenders Portal Online Manual are available in the Portal. IT helpdesk support is provided by the Portal for submission-related technical issues.

Submission portal and start submission:Submit via the EU Funding & Tenders Portal. Select the appropriate action type (DIGITAL JU Simple Grants or DIGITAL Action Grant Budget-Based [DIGITAL-AG]) and the corresponding topic entry point. Once the submission session is opened, applicants must confirm the chosen Type of Model Grant Agreement and Type of Action in the Submission System before drafting and uploading Part B (DEP application PDF). EU Funding & Tenders Portal topic page.

Templates, annexes and mandatory documents

Mandatory call documents and templates referenced on the Portal:Call document, Application form templates (DEP), Standard application form (DEP) available in the Submission System, Ownership Control Declaration (document template), DEP Model Grant Agreement (DEP MGA), Digital Europe Cybersecurity Work Programme 2025-2027, DEP Regulation 2021/964, EU Financial Regulation 2024/2509, Rules for Legal Entity Validation and Financial Capacity Assessment, Annotated Model Grant Agreement, Funding & Tenders Portal Online Manual, Funding & Tenders Portal Terms and Conditions and Privacy Statement. Applicants must follow the page limits, font and margin rules described in the DEP application form. Supporting documents are normally provided as annexes; some supporting documents will be requested after evaluation (e.g. ownership/control evidence linked to the Ownership Control Declaration).

Call-specific documentation to review:Consult the call document and annexes on the Portal for full eligibility, admissibility, evaluation criteria, scoring thresholds, required deliverables and contractual provisions. See templates for the DEP application form and the Ownership Control Declaration. Call documents and application templates. ¹

Success factors and recommended proposal content

To maximise competitiveness applicants should:clearly demonstrate operational relevance to Cyber Hubs/CSIRTs/NCSCs and alignment with NIS2 authorities; provide evidence of validated AI models and realistic testing in operational environments; describe robust security measures for AI systems (training integrity, adversarial resilience, supply chain risk management); include GDPR-compliant data handling and anonymisation strategies for CTI sharing; present a credible deployment and licensing plan for Cyber Hubs and CSIRTs; provide a plan for certification/standardisation contributions; detail consortium roles, project management, risk mitigation and sustainability beyond the grant; include budget realism and procurement/subcontracting justification where required.

1. 1Operational pilots clearly involving Cyber Hubs/CSIRTs or plans for direct licensing and handover.
2. 2Detailed technical description of AI approaches, datasets, validation methodology, security testing and robustness assessment.
3. 3Compliance plan for AI Act, GDPR and relevant cybersecurity/product rules including CRA considerations.
4. 4Plan to contribute to EU standardisation and certification for AI-driven cybersecurity solutions.

Co-funding, grants administration and legal set-up

Legal and financial set-up follows the DEP Model Grant Agreement (DEP MGA). Admissibility, eligible countries, exclusion and financial and operational capacity checks are described in the Call document sections 6 and 7. Applicants should prepare the Ownership Control Declaration and ensure LEAR validation and Participant Register accuracy. The DEP MGA and call document describe detailed eligible cost rules, reporting and audit obligations, pre-financing and payment schedules, certificates on financial statements (CFS) thresholds and record-keeping obligations. Check call document section 10 and the DEP MGA for legal specifics and payment modalities.

Co-funding requirement and success rate summary

Co-funding:The call document details funding rates and whether co-funding is required for a given budget category and sub-topic. Digital Europe budget-based grants often fund a high share of eligible costs but applicants must check the specific funding rate and co-funding rules in the call document and DEP MGA. Success rates: not published — competitiveness depends on number and quality of proposals; the topic lists an indicative number of awards (4) for CyberAI, but the number of applicants is unknown.

Final summary

This Digital Europe (ECCC) call topic seeks high‑quality proposals to develop, validate and deploy AI-powered cybersecurity tools and services for use by European national and cross-border Cyber Hubs, CSIRTs, NCSCs and other competent authorities. Projects must address operational needs such as CTI generation and sharing, automated detection and response, vulnerability identification, malware analysis, self-healing and secure AI deployment. Funding is available as budget-based grants with indicative awards of €3–€5 millionper project under the CyberAI sub-topic (total topic budget €15 million). Single-stage proposals must be submitted via the Funding & Tenders Portal by 14 January 2027. Applicants must follow DEP application templates (Part A online and Part B PDF), include required declarations and supporting documents, demonstrate legal and financial capacity, and show compliance with EU regulatory frameworks including AI Act and GDPR. Close collaboration with Cyber Hubs, CSIRTs and NCCs is strongly recommended, and contributions to standardisation and certification of trustworthy AI for cybersecurity are expected.

Footnotes

1. 1Application form templates, call document and annexes, and the DEP Model Grant Agreement are available on the Funding & Tenders Portal topic page: ec.europa.eu

This Digital Europe topic funds AI based cybersecurity tools, technologies and services for cyber hubs, CSIRTs, competent authorities, NIS 2 entities and related stakeholders, with a strong focus on threat detection, vulnerability management, incident response, CTI processing and secure data sharing.[5]

Key call facts

What the funding is about

The call is designed to move AI enabled cybersecurity solutions from development into deployment, especially for operational users such as national authorities, cross border cyber hubs, CSIRTs and other actors involved in European cyber defence.[5] The expected solutions should improve detection of threats and vulnerabilities, automate parts of cyber operations, support incident recovery, and strengthen information sharing and cyber threat intelligence generation.[5]

Who can apply

The topic is open to tool and service providers, including consortia with Cyber Hubs, and it is also framed around national and competent authorities, National and Cross Border Cyber Hubs, CSIRTs, public bodies, NIS 2 entities and national coordination centres where applicable.[5]

Scope and eligible activity types

• Continuous detection of patterns and anomalies that may indicate emerging threats, including in ICT and operational technology environments.[5]
• Creation, analysis and processing of cyber threat intelligence, including secure sharing and anonymisation.[5]
• Real time monitoring, automated alerts and triggering of responses to improve incident response.[5]
• Malware analysis, vulnerability identification, automated vulnerability scanning and penetration testing.[5]
• Risk reduction in the crossover between AI, IoT, smart grids and manufacturing chains.[5]
• Recovery support through self healing capabilities.[5]
• Product security and cybersecurity by design or by default aligned with CRA requirements.[5]

Conditions and compliance expectations

Applicants must ensure compliance with intellectual property rights and the GDPR where relevant, and the proposed AI solutions must themselves be cybersecure.[5] The topic also stresses risk assessment, supply chain security, alignment with the AI Act, and the need for solutions that are robust, trustworthy and performant.[5]

Deployment, licensing and ecosystem requirements

Solutions developed under the topic are expected to be made available for licensing to National and Cross Border Cyber Hubs, CSIRTs, competent authorities and other relevant authorities under favourable market conditions.[5] The call also encourages links with high performance computing stakeholders, and justified access requests to EuroHPC infrastructure may be granted.[5]

Applicant takeaways

1. 1Build a clear operational use case for national or cross border cyber defence.[5]
2. 2Show how the AI solution is secure, trustworthy and compliant with EU law.[5]
3. 3Explain the path to deployment, licensing and use by public sector cyber actors.[5]
4. 4Demonstrate relevance to at least one of the listed cybersecurity functions in the scope.[5]
5. 5Prepare for a budget range centered on €3,000,000 to €5,000,000 per project and a 50 percent funding rate.[1][10]

The portal excerpt does not state a project duration, so applicants should check the call document and model grant agreement for any time limits, implementation period or reporting requirements.[5][10]