What happened
On 12 November 2026 (confirmed via the ENISA publication page 'Publication date: 12 Nov 2026'), ENISA, with support from CERT-EU, published a joint advisory presenting an experiment to assess the potential of frontier AI models to support security reviews of open-source software maintained by EU institutions, bodies, offices and agencies (Union entities). It explores how AI models can assist in identifying potential security issues and supporting the security assessment process, under key action 4 of the EU action plan.
Why it matters
The EU cybersecurity agency is setting out how frontier/agentic AI can be used safely, repeatedly and responsibly in real-world security code review, and where its limits are. This is double-edged guidance relevant both to defenders adopting AI-based code review and to the assurance of that use, coming from an authoritative EU body.
Action needed
Review the advisory's findings if your organisation uses or is considering AI-assisted code review for sensitive codebases; incorporate its guidance on validating AI-generated security findings and maintaining human oversight.