The EU's New AI Cybersecurity Action Plan — What It Means If You're Already Doing FDA or MDR Work

On 7 July 2026, the European Commission published its Action Plan on Cybersecurity and Artificial Intelligence — and if you’ve been treating the EU AI Act and your cybersecurity obligations as two separate compliance tracks, this is the moment that stops being a safe assumption.

What’s actually in it

Strip away the framing and there are three concrete commitments worth tracking:

1. An EU capacity to evaluate AI models before they reach the market. This is the Commission building out the third-party assessment infrastructure the AI Act already requires on paper, in direct support of the AI Office’s enforcement function. Target: operational by 2027.
2. A European Blueprint, built with ENISA, for secure access to advanced AI systems. This will set out how organisations — including yours, if you’re deploying AI in a regulated product — get structured, secure access to frontier AI capabilities for cybersecurity purposes.
3. A secure testing platform for critical sectors — energy, transport, health, finance, and public administration — so organisations in those sectors can test AI systems in a controlled environment before deploying them operationally.

As the Commission’s Executive Vice-President Henna Virkkunen put it: “AI is transforming the meaning of cybersecurity. And we must keep pace.”

Why this matters if you’re doing FDA or MDR cybersecurity work

If your product sits in health, and it uses AI in any meaningful capacity, you’re about to be looking at two regulatory lenses that increasingly overlap instead of run in parallel.

The FDA’s premarket cybersecurity guidance and EU MDR technical documentation already ask you to demonstrate a defensible security posture. What the Action Plan signals is that the EU AI Act’s own pre-market evaluation machinery — model evaluation, structured access rules, sector-specific testing — is being built out on a similar timeline, and health is explicitly named as one of the critical sectors in scope for the testing platform.

Practically, that means:

• If your SaMD or diagnostic tool has an AI component that could be classified as an “advanced AI model” under the Act, you’ll want to start tracking the EU AI Office’s threshold guidance (expected H2 2026) — that guidance, not the Action Plan itself, is what will set actual compliance timelines.
• Your cybersecurity documentation for FDA and MDR submissions is a reasonable starting point for AI Act evidence too, but it isn’t automatically sufficient — the two frameworks ask related but not identical questions.
• The ENISA Blueprint (due Q4 2026, per current reporting) is worth watching closely if you’re planning to build AI-assisted diagnostic or monitoring capability into a device roadmap — it’ll shape how “secure access to advanced AI” gets defined in practice, which will likely feed into how notified bodies and the FDA both expect you to describe your AI supply chain.

The takeaway

Nothing in the Action Plan creates new binding obligations today — it’s a coordinated programme, not a regulation. But it’s a clear signal of direction: AI oversight and cybersecurity oversight are being built as one connected system in the EU, not two. For anyone already navigating FDA premarket cybersecurity and EU MDR in parallel, that convergence is worth planning for now rather than reacting to later.

If you want to talk through what this means for your specific product roadmap, book a call — happy to walk through where your existing documentation already covers you and where the gaps are likely to show up.

— Alex