Digital Europe cybersecurity calls, including AI security tools for SMEs and help complying with EU cyber law, close on 14 January 2027

Digital Europe cybersecurity calls, including AI security tools for SMEs and help complying with EU cyber law, close on 14 January 2027

1 September 2026: The European Commission's Digital Europe Programme opened a set of cybersecurity calls, labelled CYBER-11, on 1 September 2026. All of them close on 14 January 2027. Three are directly relevant to software and security companies: one to bring AI-powered security to small businesses, one for AI-based security tools, and one to help the European ecosystem meet the EU's growing body of cyber law.

The calls most relevant to software firms

• CYBER-11-AI4SME: strengthening the cybersecurity capacities of European SMEs with cybersecure AI-powered solutions. The Commission says the action promotes the uptake and dissemination of innovative AI-powered cybersecurity solutions to make SMEs more resilient.
• CYBER-11-CYBERAI: cybersecure tools, technologies and services relying on AI. It covers the development and deployment of AI-based systems for threat detection, vulnerability detection, threat mitigation, incident recovery, data analysis and data sharing, while also addressing the security and robustness of the AI itself.
• CYBER-11-EULEG: strengthening cybersecurity capacities in line with legislative requirements. It supports implementing the Cyber Resilience Act, the NIS2 Directive, GDPR, DORA, the Cybersecurity Act, specific requirements of the AI Act and other EU cybersecurity law.

The European Cybersecurity Competence Centre (ECCC), which runs the calls, gives the budgets on its call page: EUR 15 million for CYBER-11-CYBERAI, EUR 20 million for CYBER-11-AI4SME and EUR 20 million for CYBER-11-EULEG, within a call with a total budget of up to EUR 96 million. Every topic closes on 14 January 2027 at 17:00 CET (Brussels time).

The other CYBER-11 topics

The same round includes calls aimed at public bodies and infrastructure rather than individual vendors:

• enhancing the network of National Coordination Centres (CYBER-11-NCC), which support the cybersecurity community, SMEs included;
• coordinated preparedness testing under the Cyber Solidarity Act (CYBER-11-COORDPREP): penetration testing, threat assessment, vulnerability monitoring, exercises and training;
• regional cable hubs for the security of undersea cables (CYBER-11-REGCABH).

Security-services firms may find a role in these as subcontractors or consortium partners.

Why the compliance call matters now

The Cyber Resilience Act, NIS2, DORA and the AI Act all put obligations on software makers and their customers over 2026 and 2027. CYBER-11-EULEG is EU money for building the capacity to meet those rules. That makes it relevant both to vendors building compliance tooling and to service providers helping clients comply.

Not yet independently verified. The topic budgets and the closing time come from the European Cybersecurity Competence Centre’s call page; the eligible consortium make-up for each topic is in the call documents on the Funding & Tenders portal, which we have not yet read. We will update this when it can be confirmed, and remove this note.

What to do

• EU security vendors with AI-based detection or response products should read CYBER-11-CYBERAI and CYBER-11-AI4SME and start consortium talks now.
• Compliance-software and GRC firms should look at CYBER-11-EULEG.
• Contact your country's National Coordination Centre, which supports applicants.
• Check each call's documents on the Funding & Tenders portal for eligibility and consortium rules before planning.

Sources

• European Commission, Shaping Europe’s digital future: funding opportunities, CYBER-11 calls, 1 September 2026 to 14 January 2027 (read 30 September 2026) - 30 September 2026
• European Commission: Call for proposals, Strengthening cybersecurity capacities of European SMEs with cybersecure AI-powered solutions (CYBER-11-AI4SME) - 1 September 2026
• European Commission: Call for proposals, Strengthening EU cybersecurity capacities and capabilities in line with legislative requirements (CYBER-11-EULEG) - 1 September 2026
• ECCC: New ECCC call for proposals under the Digital Europe Programme is open for applications - 1 September 2026