Strengthening cybersecurity capacities of European SMEs with cybersecure AI-powered solutions

Call DIGITAL-ECCC under the Digital Europe Programme is open from 01 September 2026 to 14 January 2027 with an indicative budget of €20,000,000 and an expected five grants. The action funds adoption, deployment and market uptake of market-ready AI-powered cybersecurity solutions for European SMEs to improve cyber risk management, resilience, detection, response and recovery while reinforcing AI trustworthiness. Indicative EU contribution per project is €3,000,000 to €5,000,000, funding rates are typically 50% of eligible costs (75% for SMEs) and projects are expected to run for about 3 years. Eligible applicants are legal entities established in EU/EEA countries able to deliver SME support actions and applications must be submitted electronically via the Funding & Tenders Portal following the call document rules.

Call: Strengthening European Cybersecurity Technologies, Capacities and Preparedness (DIGITAL-ECCC-2027-DEPLOY-CYBER-11-AI4SME)

One-line summary

Funds projects to develop, validate and deploy AI-powered, cybersecure SaaS toolkits and services that increase cyber risk management, threat detection, incident response, prediction and cyber hygiene specifically for European SMEs.

Who can apply:Consortia led by eligible legal entities in Programme countries; topic targets SME support actions (Digital JU SME Support Actions) and typically expects participation from technology providers, SMEs, research or national cybersecurity bodies. Check call documents for full eligibility and country lists.

1. 1Scope: develop or adapt AI-driven cybersecurity software/hardware, validate solutions and deploy a user-friendly SaaS toolkit for SMEs (risk assessment, alerts, incident reporting, Cyber Hub integration, prediction and AI security features).
2. 2Activities must include uptake/adoption in organisations that have not used AI-powered cybersecurity tools and/or development of SME-tailored AI toolkits.
3. 3Compliance: solutions should rely on trustworthy AI principles and consider cybersecurity of AI (robustness, human oversight) and data protection.

Apply via the EU Funding & Tenders Portal; proposals must cover development/adaptation, validation and deployment to SMEs, and conform to submission, eligibility and evaluation rules set out in the call documents.

Recommended partners and support:engage National Cybersecurity Coordination Centres (NCCs) for guidance and consider reusing results from Horizon Europe or other EU projects to accelerate uptake. See the call page for templates, MGA and work programme references.

Risk management approach:toolkits should follow interoperable EU risk management guidance (ENISA) when designing SME risk assessment features Interoperable EU Risk Management Framework ¹

Footnotes

1. 1ENISA Interoperable EU Risk Management Framework (2023). Use this as a reference when designing SME risk management functionality.

Call overview

Call identifier:DIGITAL-ECCC. Programme: Digital Europe Programme (DIGITAL). Call title: Strengthening European Cybersecurity Technologies, Capacities and Preparedness. Topic: Strengthening cybersecurity capacities of European SMEs with cybersecure AI-powered solutions. Type of action: DIGITAL-JU-SME DIGITAL JU SME Support Actions. Type of Model Grant Agreement: DIGITAL Action Grant Budget-Based (DIGITAL-AG). Submission: single-stage through the EU Funding & Tenders Portal. Opening date: 01 September 2026. Deadline (final): 14 January 2027, 17:00 Brussels time.

Deadline and timeline:Deadline: 14 January 2027. Submission window opened 01 September 2026. Single-stage submission; evaluation and grant agreement timelines follow the procedures described in the call document and Online Manual.

Purpose, scope and expected outcomes

Overall objective:support market uptake and dissemination of market-ready AI-powered cybersecurity solutions for European SMEs, potentially using results from Horizon Europe or similar projects, and to improve knowledge and auditing of cybersecurity preparedness. Expected outcome: adoption and deployment of up-to-date AI-driven cyber tools and services to help organisations, particularly SMEs, prepare for, detect, respond to and recover from cybersecurity threats; integration of AI into cybersecurity processes; training and human oversight aspects to ensure trustworthy AI and cybersecure AI solutions.

Scope and required activities:projects should develop, adapt and validate software/hardware AI-powered products, tools and services for European SMEs. The action foresees a SaaS cyber toolkit tailored to SME needs to automate core cybersecurity processes (risk management, threat detection, incident response, notification and data protection) and to provide cyber-incident prediction and response functions. Proposals must include development/adaptation and validation of solutions and deliver at least one of the specified activities below.

1. 1Uptake/adoption of AI-powered cybersecurity tools in organisations where adoption has not yet taken place.
2. 2Development of user-friendly AI-based toolkits to automate cybersecurity processes for SMEs.
3. 3Implementation of a risk assessment function that performs risk assessment, provides mitigation recommendations and identifies mitigation options.
4. 4Interface to existing tools to analyse and assess SME cyber risk from digital infrastructure scans and authorised user-supplied data.
5. 5Alerting function issuing vulnerability and threat notifications based on collected risk information.
6. 6Connection function to a Cyber Hub enabling incident reporting and assistance for recovery where possible.
7. 7SME user interface for incident reporting with AI assistants providing reaction instructions and support guidance.

Key technical expectations:trustworthy AI techniques (robustness, human oversight), AI-driven threat detection and prediction, integration with existing SME IT infrastructure via secure interfaces, interoperability with EU risk management frameworks and standards, protection of personal data and adherence to EU AI Act obligations for high-risk systems where applicable.

Reference material and standards:Proposers should align risk management functions with the Interoperable EU Risk Management Framework (ENISA, 2023) ¹. Proposals must also follow the Digital Europe Cybersecurity Work Programme 2025-2027, DEP Regulation 2021/964, and EU Financial Regulation 2024/2509 as relevant.

Budget and expected grants

Topic budget year:2026. Total contribution for this AI4SME topic: €20,000,000. Indicative number of grants: 5. Indicative contribution per grant: €3,000,000 to €5,000,000. Projects should use the budget-based DIGITAL Action Grant model (DEP MGA). See Annexes and call document for detailed budget conditions.

Eligibility, applicants and consortium requirements

Eligible applicant types:SMEs (targeted), but other legal entities can participate as beneficiaries. Typical eligible applicant types include startups, SMEs, large enterprises, universities, research institutes, non-profits, public bodies, NGOs and national coordination centres. The topic is issued under DIGITAL-JU-SME SME Support Actions, therefore consortia led by or strongly involving SMEs are expected; the call document sets specific eligibility and participation rules (see section 6 of the call document).

Consortium requirement:Submission model: single-stage. The call allows SME Support Actions; the application can be submitted by a single legal entity where allowed by the call conditions or as a consortium. The Funding & Tenders Portal submission wizard distinguishes DEP SME Support Actions; check the call-specific eligibility rules in section 6 of the call document to confirm single-beneficiary or consortium requirements.

Geographic eligibility (beneficiary scope):Primary geographic scope: EU Member States, with participation rules described in section 6 of the call document. The Network of National Cybersecurity Coordination Centres (NCC) spans the 27 EU Member States plus Iceland and Norway; NCCs are recommended contact points for applicants. Participation of legal entities established in eligible non-EU countries or third countries may follow specific call rules; consult the call document.

Target sectors and technologies

Target sector:cybersecurity with focus on SMEs across sectors. Cross-cutting technologies: artificial intelligence and machine learning (including predictive algorithms), SaaS delivery models, secure software and hardware integration, threat detection and response automation, secure interfaces to existing tools and Cyber Hubs, privacy-preserving data processing, trustworthy AI measures (robustness, human oversight), interoperability with EU risk management standards.

1. 1AI-powered cybersecurity tools and services (anomaly detection, predictive incident models, alerting engines).
2. 2SaaS toolkits for SMEs (risk assessment, incident reporting UI, integration adapters).
3. 3Secure connectors to existing scanning and monitoring tools and Cyber Hub platforms.
4. 4Training modules and AI-based assistants for SME staff to use cybersecurity AI tools safely.

Project maturity and expected stage

Project stage:development, validation and demonstration of market-ready or near-market AI-powered cybersecurity solutions. The call expects market uptake and deployment activities (TRL typically high: validation, demonstration, pre-commercial deployment and early commercialization). Proposals should include adaptation or development work plus validation/field-testing with SMEs.

Funding type and nature of support

Funding type:grant (budget-based action under the Digital Europe Programme). Nature of support: monetary funding to beneficiaries (budget-based contributions covering eligible costs). The Grant form is budget-based with specified budget categories (personnel, subcontracting, purchase costs, other cost categories, indirect costs). Non-monetary support: expected access to networks (NCCs, Cyber Hubs), technical support via ECCC channels, dissemination and coordination activities, but the primary mechanism is financial grants.

Co-funding requirement:Co-funding: the call follows standard Digital Europe grant rules. The funding rate and potential co-funding percentages are set in the call document and in the grant agreement templates. Applicants must demonstrate financial and operational capacity. Specific co-financing requirements (if any) and eligibility of costs are specified in the call document and DEP MGA; consult section 6 and Annex 2 for cost rules.

Application process and forms

Application type:open call via EU Funding & Tenders Portal. Submission is electronic only; applicants must be registered and submit through the Portal. Single-stage evaluation. Admissibility and eligibility criteria include page limits, layout rules (Part B PDF with annexes), and completeness of Part A (administrative forms filled via Portal). The Application Form (DEP) comprises Part A (administrative data filled online) and Part B (technical narrative uploaded as PDF). Page limits typically 70 pages for Part B unless otherwise specified.

Application templates and structure:Applicants must use the Standard application form (DEP) available in the Submission System. Part A fields (structured data) are filled in the Portal. Part B must follow the DEP Part B template: cover page, project summary, sections on relevance, implementation, impact, work plan and work packages, ethics and security, declarations and annexes. The template includes detailed work package structure (WP1 management, WP2 technical WPs), deliverables, milestones, staff effort tables, budget tables and annex lists. CVs, detailed budget tables, ownership control declarations and other mandatory annexes must be attached as indicated in the call document and Portal templates.

1. 1Part A (administrative information) completed in Portal Submission System.
2. 2Part B (technical description) prepared in the DEP Part B template and uploaded as PDF within page limits.
3. 3Annexes: ownership control declaration, detailed budget table (if applicable), MGA DEP documents, and any call-specified annexes.
4. 4Mandatory compliance declarations: declaration of honour, ethics self-assessment where required, security self-assessment where required.
5. 5If financial statements or certificates are required at award or final payment, prepare qualified auditor certificates per DEP MGA rules.

Evaluation, award criteria and success probabilities

Evaluation and award:the submission and evaluation process is described in section 8 and 9 of the call document and in the Online Manual. Award criteria, scoring and thresholds are established in the call document. Evaluation is single-stage, and proposals are assessed against relevance to topic scope, quality of implementation, impact and cost-effectiveness. Applicants should consult section 9 of the call document for scoring breakdown and thresholds.

Application stages and likely steps:Application stages: 1. Prepare registration and consortium details in Portal. 2. Complete Part A and draft Part B using DEP template. 3. Upload Part B and annexes, submit via Portal before deadline. 4. Administrative admissibility checks. 5. Expert evaluation against award criteria. 6. Possible clarification requests. 7. Grant award decision and signature of Grant Agreement (DEP MGA) for successful proposals.

Budget structure and allowable costs (high level)

Budget categories follow the DEP MGA:A Personnel costs (employees, natural persons under direct contract, seconded persons, SME owners/natural person beneficiaries), B Subcontracting, C Purchase costs (C.1 travel and subsistence, C.2 equipment, C.3 other goods/works/services), D Other cost categories (D.1 financial support to third parties, D.2 internally invoiced goods and services), E Indirect costs (flat-rate 7% of eligible direct costs as per DEP MGA). Applicants must follow the financial and eligibility rules in Articles 6-7 of the DEP MGA and use Annex 2 and Annex 2a where appropriate.

Selection & admissibility checks, legal and financial setup

Admissibility:compliance with page limits, submission by deadline, correct template and required annexes. Eligibility: described in section 6 of the call document (entities established in eligible countries, legal status and ownership/control restrictions). Financial and operational capacity checks and exclusion grounds are described in section 7 of the call document. The DEP MGA defines reporting, audit, record-keeping and certificate requirements (CFS thresholds) as per EU Financial Regulation 2024/2509.

Support, contact points and partner search

Support:applicants are recommended to contact their National Cybersecurity Coordination Centres (NCCs) for guidance. The Network of NCCs includes one centre for each of the 27 EU Member States plus Iceland and Norway. The ECCC Applicants Direct Contact Centre email is applicants@eccc.europa.eu. Technical help for Portal matters is available from the IT Helpdesk and the Portal Online Manual.

1. 1Partner search: the Funding & Tenders Portal allows partner search announcements for topics; LEARs and account administrators can publish partner requests.
2. 2Portal guidance: Funding & Tenders Portal Online Manual and FAQ pages provide step-by-step guidance.
3. 3National contact: consult your NCC for national-level assistance and potential co-design with local SMEs.

Detailed answers to the categorization questions

Below are detailed, structured answers to the specific categorization questions requested.

Eligible Applicant Types:Eligible applicant types: SMEs (priority and primary target), startups, research organisations (universities, research institutes), large enterprises (where relevant as technology providers or partners), non-profit organisations, public bodies, national cybersecurity centres and NCCs, NGOs, public-private partnerships and consortia including mixed membership. Natural persons may participate only where the call permits (see DEP rules). The call is under DIGITAL-JU-SME SME Support Actions so applicants should include SMEs in leading or substantial roles.

Funding Type:Primary funding mechanism: Grant (budget-based action under the Digital Europe Programme). The grant is budget-based and reimburses eligible costs according to DEP MGA rules. Forms of funding permitted include actual costs, unit costs/average personnel costs (subject to usual cost accounting practices), flat rates and potential lump sums if allowed by call (check Annex 2 and Annex 2a).

Consortium Requirement:Requirement: single-stage submission; the call accepts SME Support Actions and may allow single legal entity submissions or consortia depending on the topic-specific eligibility. Consult section 6 of the call document. In practice, consortia are common to combine SME involvement, technology providers, research validation partners and NCC links.

Beneficiary Scope (Geographic Eligibility):Geographic eligibility: primarily EU Member States. The NCC network includes the 27 EU Member States plus Iceland and Norway; consult section 6 of the call document for full list of eligible countries and any third-country participation rules. Non-EU entities may participate under specific rules if permitted in the call conditions.

Target Sector:Target sector(s): cybersecurity (primary) with strong cross-cutting focus on artificial intelligence, ICT security, software services (SaaS), SME digital transformation, data protection and privacy technologies, training and capacity building. Applicable industries include all SME-reliant sectors where digital operations occur.

Mentioned Countries:Explicitly mentioned: EU Member States (all), Iceland and Norway (NCC network). No single Member State is singled out; the topic targets EU-wide SME uptake. Refer to call document section 6 for the precise list of eligible countries.

Project Stage:Expected maturity: development, adaptation and validation of market-ready technologies; demonstration and deployment phases. Emphasis on solutions that are market-ready or near-market (demonstration and early commercialization / scale-up in SME contexts).

Funding Amount:Indicative funding range: €3,000,000 to €5,000,000 per grant for this AI4SME topic. Total topic budget: €20,000,000 (indicative number of grants: 5).

Application Type:Method of application: Open call via the Funding & Tenders Portal, single-stage. Applicants must prepare Part A in the Portal and Part B as PDF using the DEP template and upload prior to the deadline.

Nature of Support:Beneficiaries will receive monetary support (grants) to cover eligible costs. Non-monetary support includes access to ECCC networks, NCC assistance, visibility and dissemination channels, and guidance materials. The core modality is monetary (budget-based grant).

Application Stages:Number of selection stages: 1 (single-stage submission). The internal process after submission includes admissibility checks and expert evaluation, possible clarifications and award decision; but from applicant perspective submission is single-stage.

Success Rates:Success rates: not published for this topic. Indicative: with an expected 5 grants and a competitive EU-wide call, success rates commonly range from low single digits to teens percent depending on number and quality of submissions. Applicants should assume competitive selection and craft strong proposals aligned with award criteria.

Co-funding Requirement:Co-funding: Applicants must demonstrate financial and operational capacity. The call follows DEP MGA funding rates and eligible cost rules. Where co-financing is implied, details are specified in the call document and in Annex 2; applicants should budget for uncovered costs if necessary. In-kind contributions are permissible but are not eligible as costs unless explicitly allowed and documented as per DEP MGA.

Application form templates and structure (guidance for applicants)

Use the Standard application form (DEP). The Application Form structure:Part A (online administrative data) and Part B (technical description, PDF). Part B recommended structure and required content (prepare exactly in this order as per DEP template):

1. 1Cover page (project title, acronym, coordinator contact).
2. 2Project summary (same as Part A abstract).
3. 31. Relevance: objectives, contribution to policy and strategies, digital technology supply chain, financial obstacles.
4. 42. Implementation: maturity, implementation plan, project management, quality assurance, risk management, capacity to carry out the work, consortium cooperation and roles.
5. 53. Impact: expected outcomes and deliverables, dissemination and communication plan, competitiveness and societal benefits, environmental sustainability where applicable.
6. 64. Work plan: detailed Work Packages (WP1 management, WP2 technical WPs, etc.), tasks, deliverables, milestones, staff effort tables, procurement/subcontracting tables, purchases and equipment details, timing/timetable.
7. 75. Other: ethics and security self-assessments where relevant.
8. 86. Declarations: double funding, other required confirmations.
9. 9Annexes: detailed budget table (if required), CVs, ownership control declaration, list of previous projects, any mandatory call-specific annexes.

Important template constraints and formalities:Part B page limit typically 70 pages unless the call document states otherwise. Minimum font size Arial 9, A4 page size, margins at least 15 mm. Supporting documents go in annexes and do not count towards page limit unless stated otherwise. The DEP template is tagged; do not delete tags.

Mandatory and recommended attachments

1. 1Ownership control declaration (mandatory for beneficiaries and affiliated entities when requested).
2. 2DEP MGA model documents and call-specific annexes available in the Portal (read and use them as required).
3. 3Detailed budget table/calculator if applicable to the grant type (see Part B annex requirements).
4. 4CVs of key personnel (Annex 2 where required).
5. 5List of previous projects (Annex 4 if required by the call document).
6. 6Ethics self-assessment and security self-assessment if the proposal triggers relevant items in Part A.

Evaluation scoring, thresholds and quality indicators (summary)

Award criteria and scoring are described in section 9 of the call document; applicants should address: relevance to topic and Digital Europe objectives, quality and soundness of implementation (work plan, team, resources), expected impact (SME uptake, deployment scale, sustainability), and cost-effectiveness. Include measurable KPIs for SME uptake, number of SMEs reached, tools deployed, incidents reduced, improved detection rates, time to incident response, and training reach. Ensure alignment to EU cybersecurity and AI trustworthiness requirements and standards.

How this opportunity should be explained (concluding summary)

This call finances the development, adaptation, validation and deployment of AI-powered cybersecurity solutions tailored for European SMEs. It aims to bridge the capability gap where SMEs lack resources and expertise to assess cyber risk, implement protective measures and respond effectively. Funded projects will create or adapt AI-driven SaaS toolkits that automate risk assessment, threat detection, alerting, incident reporting and response, and that connect SMEs to Cyber Hub resources for incident recovery. Projects must demonstrate trustworthy AI practices (robustness, human oversight), data protection, interoperability with EU risk management frameworks and practical validation with SME end-users to ensure rapid uptake across the single market. The call provides substantial grants (typically €3-€5Meach) under the Digital Europe Programme to accelerate market uptake, resilience and a culture of technology-enabled cybersecurity across EU SMEs.

Footnotes

1. 1Interoperable EU Risk Management Framework, ENISA, 2023, available at: enisa.europa.eu
1. 1Interoperable EU Risk Management Framework, ENISA, 2023, available at: enisa.europa.eu

This Digital Europe Programme topic, DIGITAL-ECCC, is an open single-stage call under the Strengthening European Cybersecurity Technologies, Capacities and Preparedness work programme. It opened on 1 September 2026 and closes on 14 January 2027 at 17:00 Brussels time, with an indicative budget of €20,000,000 and an expected 5 grants. [15][13]

What the funding is about

The call supports the adoption, deployment and market uptake of market-ready innovative AI-powered cybersecurity solutions for European SMEs, including solutions coming from EU-supported research and innovation projects. It is designed to improve cyber risk management, cyber resilience, cyber hygiene and the ability to prepare for, detect, respond to and recover from cyber threats, while also strengthening the security and trustworthiness of AI systems themselves. [15][13]

• AI-driven cybersecurity tools and services for SMEs, including SaaS-based solutions. [15]
• User-friendly risk management tools that can assess risks, recommend mitigations and identify options. [15]
• Threat detection and vulnerability alerting functions based on collected risk data. [15]
• Incident reporting and response support, including links to Cyber Hubs or recovery support. [15]
• Training approaches that help employees use AI solutions for cybersecurity. [15]

Who can apply

The call is intended for entities able to deliver SME support actions in cybersecurity, and the published call material points applicants to the eligibility rules in section 6 and the financial and operational capacity rules in section 7 of the call document. Published call summaries indicate that applicants and affiliated entities should be legal entities established in eligible EU or EEA countries, including Norway, Iceland and Liechtenstein. [15][1]

Funding and financial terms

Key scope and implementation requirements

Proposals should cover development or adaptation of the software or hardware and validation of the solution. The topic expects activities such as uptake of AI-powered cybersecurity tools where they are not yet used, or the creation of an SME-focused toolkit that automates core cybersecurity processes. [15]

• A cybersecurity risk assessment and management function that gives mitigation recommendations and options. [15]
• An interface to existing tools that assesses cyber risk using digital infrastructure scanning and data from authorised users. [15]
• A function that alerts users to relevant vulnerabilities and threats. [15]
• A function that connects SMEs to a Cyber Hub for incident reporting and support. [15]
• An SME incident-reporting interface with AI assistants that guide response and support access. [15]

Submission and support

Applications must be submitted electronically through the Funding and Tenders Portal. The official call page also recommends first contacting the National Cybersecurity Coordination Centre in the applicant's country, where available, or the ECCC Applicants Direct Contact Centre at applicants@eccc.europa.eu for guidance. [15]