Digital Europe cybersecurity calls, including AI security tools for SMEs and help complying with EU cyber law, close on 14 January 2027

Digital Europe cybersecurity calls, including AI security tools for SMEs and help complying with EU cyber law, close on 14 January 2027

1 September 2026 — The European Commission's Digital Europe Programme opened a set of cybersecurity calls, labelled CYBER-11, on 1 September 2026. All of them close on 14 January 2027. Three are directly relevant to software and security companies: one to bring AI-powered security to small businesses, one for AI-based security tools, and one to help the European ecosystem meet the EU's growing body of cyber law.

The calls most relevant to software firms

• CYBER-11-AI4SME: strengthening the cybersecurity capacities of European SMEs with cybersecure AI-powered solutions. The Commission says the action promotes the uptake and dissemination of innovative AI-powered cybersecurity solutions to make SMEs more resilient.
• CYBER-11-CYBERAI: cybersecure tools, technologies and services relying on AI. It covers the development and deployment of AI-based systems for threat detection, vulnerability detection, threat mitigation, incident recovery, data analysis and data sharing, while also addressing the security and robustness of the AI itself.
• CYBER-11-EULEG: strengthening cybersecurity capacities in line with legislative requirements. It supports implementing the Cyber Resilience Act, the NIS2 Directive, GDPR, DORA, the Cybersecurity Act, specific requirements of the AI Act and other EU cybersecurity law.

The other CYBER-11 topics

The same round includes calls aimed at public bodies and infrastructure rather than individual vendors:

• enhancing the network of National Coordination Centres (CYBER-11-NCC), which support the cybersecurity community, SMEs included;
• coordinated preparedness testing under the Cyber Solidarity Act (CYBER-11-COORDPREP): penetration testing, threat assessment, vulnerability monitoring, exercises and training;
• regional cable hubs for the security of undersea cables (CYBER-11-REGCABH).

Security-services firms may find a role in these as subcontractors or consortium partners.

Why the compliance call matters now

The Cyber Resilience Act, NIS2, DORA and the AI Act all put obligations on software makers and their customers over 2026 and 2027. CYBER-11-EULEG is EU money for building the capacity to meet those rules. That makes it relevant both to vendors building compliance tooling and to service providers helping clients comply.

Not yet independently verified. The Commission’s funding list gives the closing date but not the time of day, the budget per topic or the eligible consortium make-up; these are in each call’s documents on the Funding & Tenders portal, which we have not yet read. The publisher has not stated it yet; we will update the dates here as we hear from the publisher. We will update this when it can be confirmed, and remove this note.

What to do

• EU security vendors with AI-based detection or response products should read CYBER-11-CYBERAI and CYBER-11-AI4SME and start consortium talks now.
• Compliance-software and GRC firms should look at CYBER-11-EULEG.
• Contact your country's National Coordination Centre, which supports applicants.
• Check each call's documents on the Funding & Tenders portal for the exact deadline time, budget and eligibility before planning.

Sources

• European Commission, Shaping Europe’s digital future: funding opportunities, CYBER-11 calls, 1 September 2026 to 14 January 2027 (read 30 September 2026) — 30 September 2026
• European Commission: Call for proposals, Strengthening cybersecurity capacities of European SMEs with cybersecure AI-powered solutions (CYBER-11-AI4SME) — 1 September 2026
• European Commission: Call for proposals, Strengthening EU cybersecurity capacities and capabilities in line with legislative requirements (CYBER-11-EULEG) — 1 September 2026