What happened
This week ENISA released the 2026 edition of its biennial 'State of Cybersecurity in the Union' report (Art.18(3) NIS2), introducing a 'strategic compass' and five policy direction sets. The report's threat assessment foregrounds AI: it states AI acts as a multiplier of offensive and defensive capabilities, that AI models' evolution is accelerating vulnerability discovery and exploitation, that AI can amplify the exposure gap between critical sectors, and that organizations must cope with 'the speed and scale of AI-enabled threats.' It reports the EU Cybersecurity Index average at 71.53 points and NIS2/CRA/Cyber Solidarity Act implementation status. Publication date is late in the reporting window (news indexed Nov 10); the report is primarily an EU-wide cybersecurity state-of-the-union but contains substantive AI threat-landscape guidance.
Why it matters
It is ENISA's authoritative, EU-level threat assessment and policy guidance informing NIS2-regulated critical-infrastructure operators and Member States. The AI content is a theme within a broader report rather than an AI-specific standard, but it signals how the EU's flagship cybersecurity assessment frames AI-enabled threats and will feed ENISA's subsequent AI work and EU policy.
Action needed
Review the report's AI threat-landscape and 'speed and scale of AI-enabled threats' framing for alignment of EU-market AI risk registers and NIS2 critical-infrastructure preparation. Monitor for follow-on ENISA AI-specific guidance.