Artificial Intelligence for Cybersecurity applications
Horizon Europe · Grant topic
An independent quality check has put this review on hold. The structured terms below are kept as history and are not cleared; read the official documents.
Summary
A Polish company can use this call for R&D.
Funds development of resilient AI cybersecurity solutions for threat detection, adaptive defence, threat intelligence and faster system recovery.
- Who can apply
- Companies can lead: SME, large company, startup, research org, university.
- Amount
- €4M – €5M per projectTotal budget €24,800,000
- Deadline
- 15 Sept 2027 02:00 CESTin 326 days
- Status
- Forthcomingopens 2 Mar 2027
Machine-classified from the call text; check eligibility at the source.
Description
Expected Outcome:
Proposals are expected to contribute to one or more of the following:
• AI-driven solutions for real-time cyber threat detection;
• Advanced adaptive AI systems that evolve with dynamic cybersecurity challenges;
• Contribute to drastically reduce reaction time for the recovery of systems.
Scope:
Artificial Intelligence is increasingly utilised in cybersecurity for threat detection, incident response, and adaptive defence mechanisms. However, AI-driven systems themselves are susceptible to adversarial manipulation and bias. This topic aims to advance AI-based cybersecurity applications while ensuring that AI-driven solutions remain resilient, transparent, and compliant with regulatory frameworks such as the AI Act. In this context, the topic explores the role of all types of AI, including generative AI, in cybersecurity applications, including automated threat detection, adaptive cyber defence, and AI-driven cyber threat intelligence. Proposals should develop solutions for trustworthy AI in cybersecurity contexts including addressing adversarial AI risks, in compliance with the provisions of the AI Act. The topic is expected to:
• Develop AI-driven solutions and tools for real-time cyber threat detection. Investigating novel machine learning techniques to detect anomalies, malicious activity, and AI-powered cyber threats in real time, improving situational awareness and response times.
• Develop adaptive AI systems capable of evolving with dynamic cybersecurity challenges. Exploring AI techniques that continuously learn from new cyber threats, adapting to emerging attack patterns, while maintaining robustness and explainability.
• Support the future enhancements of Security Operation Centres/Cyber Hubs. Developing AI-enhanced SOC frameworks that integrate predictive analytics, automation, and threat intelligence to strengthen proactive defence measures.
Who can apply, in detail
- Applicant types
- SME, Large company, Startup, Research org, University
- Purpose
- Research and innovation
- R&D relevance
- 3 of 3
- Poland eligible
- Yes
- Country limit
- —
- Region
- Any
- Consortium
- Unclear
- Readiness level (TRL)
- —
- Topics
- AI cybersecurity
- Real-time threat detection
- Adaptive cyber defence
- Adversarial robustness
- Automated incident response
Machine-classified from the call text; check eligibility at the source. 23 Oct 2026
Conditions
Typed facts extracted from the source documents by Scindu's grant-data review. Each value keeps its own conditions. Unknown means unstated, not zero or unlimited.
- Applicant restriction
- Chinese public universities administered or supervised by the Ministry of Industry and Information Technology (MIIT) cannot participate in any action under this work programme. This is an all-action participant restriction, separate from country funding eligibility. This RIA falls outside the listed RIA destination exceptions, so China-established entities are generally ineligible in any capacity, subject only to justified case-by-case exceptions; this does not relax any more restrictive own-topic EU/Associated Country/control condition.
- Applicant restriction
- Participation is limited to Member State and Associated Country legal entities. Eligible-country entities directly or indirectly controlled by a non-eligible country or entity cannot participate. This applies in addition to the independent-beneficiary consortium minimum; no actual entity ownership was assessed.
- Application restriction
- Planned opening2March2027 and deadline15September2027 at17:00Brusselslocaltime. ECCC ExecutiveDirector may move opening up to one month earlier/later and delay deadline up to two months. Budget subject to2027appropriations; live submission flow untested.
- Application restriction
- Use Portal PartA, PartB and mandatory annexes. Coordinator mandate, declarations and applicant capacity/eligibility are required. The actual submission template controls the required documents.
- Eligible project scope
- Advance AI-based cybersecurity using all AI types including generativeAI for detection, incident response, adaptive defence and threat intelligence. Address adversarial manipulation and bias, transparency and resilience, and compliance with the AIAct. Expected outcomes include real-time threat detection, adaptive systems and substantially reduced recovery reaction time.
- Eligible project scope
- Develop tools and novelML for real-time anomaly/malicious-activity/AI-powered-threat detection and situational awareness; develop continuously learning adaptive systems for emerging attack patterns while preserving robustness/explainability; and enhance SOC/CyberHub frameworks with predictive analytics, automation and threat intelligence for proactive defence.
- Expected number of grants (planning estimate)Captured SEDIA planning estimate for exact topic HORIZON-CL3-2027-02-CS-ECCC-01
- 5 count
Expected funded-project/grant count in the exact provider topic budgetOverview. Indicative planning metadata, not guaranteed awards, maximum accepted projects, staffing or consortium size. It does not replace any differently expressed work-programme planning range.
- Other condition
- Research and Innovation Action implemented through the ECCC cybersecurity call. The Commission contribution agreement and call-wide EUR71.8million are separate from the topic allocation.
- Other condition
- Eligible contributions take lump-sum form. Detailed budgets use basic cost eligibility and the embedded RIA funding-rate methodology. Interim payments concern accepted completed packages, with conditional partial-package payments possible at final balance. No additional actual-payroll reimbursement rate follows. Actual budget and duration are fixed in the grant agreement.
- Other condition
- Activities may use classified background or produce EUCI/SEN results. Apply AnnexB security provisions and proposal security self-assessment, with grant-specific requirements determined from actual project content; this does not classify every project automatically.
- Other condition
- GeneralAnnexD full-proposal RIA criteria are Excellence, Impact and Implementation, each scored to5, individual threshold3 and total10. Passing thresholds enters budget-limited ranking; ECCC call or later conditions may further specify execution.
- Other condition
- Own-topic WP overview gives an indicative expected project-count range of5–6, separate from the captured provider planning scalar. It is not a hard award-count bound, guaranteed award number, beneficiary reach or staffing count.
- Partner requirement
- Three independent beneficiary legal entities in three different countries: at least one EU Member State entity and at least two others in different Member States or Associated Countries. Affiliates do not count towards this minimum. Topic-specific required actors are additional.
Amounts and costs
- Indicative budget
- €24,800,000
Topic budget as stated in the portal's budget table. Lump-sum and per-project limits are in the call conditions.
- Eligible cost
- Personnel, subcontracting and purchases can form eligible lump-sum budget estimates under the grant conditions. The general25% indirect flat rate excludes subcontracting, FSTP and unit/lump-sum amounts that already include indirect costs. No salary, contract, headcount, FTE or employment duration is prescribed by this topic.
- Funding intensity, maximum
- 100 percent of eligible amount in lump-sum methodology
RIA maximum applied within the lump-sum amount-setting method; not separately reimbursed actual salary or all project expenditure.
- Indirect cost flat rateGeneralAnnexG indirect costs for this Horizon action/grant methodology
- 25 percent of the named eligible-direct-cost base
Base: total eligible direct costs excluding subcontracting, financial support to third parties and any unit costs/lump sums already including indirect costs. Apply only within the relevant grant/budget methodology; for lump sums this contributes to amount-setting, not an extra actual-cost payment or wage rate.
- Expected project funding, up to
- €5,000,000
Expected indicative contribution; different amounts may be selected, so not a hard bound.
- Expected project funding, from
- €4,000,000
Expected indicative contribution; different amounts may be selected, so not a hard bound.
- Topic allocation
- €24,800,000
Total indicative topic allocation, not per-project cap or remaining balance.
Source documents
Call facts
- Opens
- 2 Mar 2027
- Deadline model
- Single-stage
- Programme
- Horizon Europe · 2021 - 2027
- Call
- HORIZON-CL3-2027-02-CS-ECCC · Indirectly Managed Action by the ECCC (2027)
- Types of action
- HORIZON Research and Innovation Actions
- Keywords
- AI Act
- AI-based cybersecurity applications
- AI-driven cyber threat intelligence
- AI-enhanced SOC frameworks
- Security Operation Centres/Cyber Hubs
- adaptive AI systems
- adaptive cyber defence
- automated threat detection
- generative AI
- trustworthy AI
- Source
- ec.europa.eu
- Checked
- 24 Oct 2026
- Portal updated
- 2 Mar 2026
- Review status
- Partial review
- Reviewed
- 23 Oct 2026
This is a summary of the source page, not the official text. Eligibility, conditions and the submission system are at the source.