Loading…
Strategic Analysis
A winning proposal under this Digital Europe SME Support Action must pivot from theoretical AI/cyber research to practical, operational deployment of high-TRL tools tailored to resource-constrained SMEs. The core winning angle lies in bridging existing EU R&I results into an intuitive, low-overhead automated toolkit that seamlessly interfaces with national/European Cyber Hubs while strictly adhering to the EU AI Act.
TRL 6 → 8
Based on programme defaults
Uptake/adoption of AI-powered cybersecurity tools in organisations where this has not yet taken place.
Development of user-friendly sets of tools (e.g. toolkit) based on AI to automate main cybersecurity processes in SMEs. Such a toolkit could provide automated functions such as: A function that supports the assessment and management of an SME’s cybersecurity risks. This function should perform a risk assessment, provide recommendations for risk mitigation, and identify options.
An interface to existing tools that support the analysis and assessment of the extent of an SME’s cyber risk based on information gathered from digital infrastructure scanning and data provided by authorised users.
A function that issues alerts on relevant vulnerabilities and threats based on the information collected by the risk management function.
A function that connects SMEs to a Cyber Hub to report an incident and assist with recovery if possible.
SME user interface for incident reporting associated with the cyber toolkit. Users can report an incident, get instructions on how to react and obtain information on how to obtain support for the response, with the use of AI assistants.
Support the adoption of market-ready innovative AI-powered cybersecurity solutions, including solutions developed in the framework of EU-supported research and innovation projects.
Provide and deploy up to date AI-powered tools and services to organisations (in particular SMEs) to prepare, protect and respond to cybersecurity threats.
Integrate AI technologies into cybersecurity processes to improve the security of ICT solutions, including providing innovative approaches to training employees to use AI solutions for cybersecurity.
Deployment of cybersecure tools and technologies relying on trustworthy AI; AI driven cybersecurity tools; Integration of tools to protect and secure AI solutions.
No expected impacts identified for this destination.
Regulation (EU) 2024/1689 (Artificial Intelligence Act)
highRegulation (EU) 2024/1689 establishes a comprehensive, risk-based harmonised legal framework for the development, placing on the market, and use of Artificial Intelligence systems across the EU. It imposes strict safety, transparency, risk management, and cybersecurity requirements on high-risk AI systems while prohibiting applications posing unacceptable risks.
Evaluators expect proposals developing AI-powered cybersecurity solutions to explicitly classify their AI tools within the AI Act's risk tiers and demonstrate compliance with mandatory obligations, including robust risk assessment, high-quality data governance, explainability, human oversight, and resilience against adversarial attacks. Proposals must detail how target SMEs can deploy these solutions without facing disproportionate regulatory or technical compliance burdens.
Interoperable EU Risk Management Framework (ENISA, 2023)
highDeveloped by the European Union Agency for Cybersecurity (ENISA), the Interoperable EU Risk Management Framework provides harmonised methodologies and guidelines to standardise cybersecurity risk assessment and management across Member States and sectors. It aims to bridge disparate national and organizational risk frameworks to enable seamless threat intelligence sharing and collective cyber resilience.
Evaluators expect proposals to integrate and operationalise ENISA's risk management principles within their security architectures, demonstrating how the proposed AI solutions assess, monitor, and mitigate cyber risks consistently with standard European taxonomies. The proposal should clearly show how this framework is made usable, affordable, and practical for SME environments that lack complex in-house cybersecurity teams.
">
described in section 5 of the call document.
Proposal page limits and layout: described in Part B of the Application Form available in the Submission System.
described in section 6 of the call document.
described in section 6 of the call document.
described in section 7 of the call document.
described section 8 of the call document and the Online Manual.
described in section 9 of the call document.
described in section 4 of the call document.
described in section 10 of the call document.
Application form templates
Standard application form (DEP) — the application form specific to this call is available in the Submission System
Model Grant Agreements (MGA)
Digital Europe Cybersecurity Work Programme 2025-2027
EU Financial Regulation 2024/2509
Rules for Legal Entity Validation, LEAR Appointment and Financial Capacity Assessment
EU Grants AGA — Annotated Model Grant Agreement
Funding & Tenders Portal Online Manual
Evaluators will prioritize demonstrated adoption and usability for non-technical SME staff over novel algorithmic complexity. They will scrutinize the consortium's market deployment strategy, concrete validation pathways with authentic SME end-users, seamless integration with external Cyber Hubs for incident handling, and compliance with the Interoperable EU Risk Management Framework and Trustworthy AI guidelines.
Everything the call asks for, seen from the call's point of view. Each line shows what answers it, and which partner carries it.
This matrix lists everything the call asks for: outcomes, impacts, scope, the requirements buried in the call text, and policy alignment. Sign up free and GrantForge tracks each line against the concept you build.
| Requirement | Covered by | Carried | Status |
|---|---|---|---|
| Scope activities | |||
| SC1Uptake/adoption of AI-powered cybersecurity tools in organisations where this has not yet taken place. | · | · | Sign up to track |
| SC2Development of user-friendly sets of tools (e.g. toolkit) based on AI to automate main cybersecurity processes in SMEs. Such a toolkit could provide automated functions such as: A function that supports the assessment and management of an SME’s cybersecurity risks. This function should perform a risk assessment, provide recommendations for risk mitigation, and identify options. | · | · | Sign up to track |
| SC3An interface to existing tools that support the analysis and assessment of the extent of an SME’s cyber risk based on information gathered from digital infrastructure scanning and data provided by authorised users. | · | · | Sign up to track |
| SC4A function that issues alerts on relevant vulnerabilities and threats based on the information collected by the risk management function. | · | · | Sign up to track |
| SC5A function that connects SMEs to a Cyber Hub to report an incident and assist with recovery if possible. | · | · | Sign up to track |
| SC6SME user interface for incident reporting associated with the cyber toolkit. Users can report an incident, get instructions on how to react and obtain information on how to obtain support for the response, with the use of AI assistants. | · | · | Sign up to track |
| Expected outcomes | |||
| EO1Support the adoption of market-ready innovative AI-powered cybersecurity solutions, including solutions developed in the framework of EU-supported research and innovation projects. | · | · | Sign up to track |
| EO2Provide and deploy up to date AI-powered tools and services to organisations (in particular SMEs) to prepare, protect and respond to cybersecurity threats. | · | · | Sign up to track |
| EO3Integrate AI technologies into cybersecurity processes to improve the security of ICT solutions, including providing innovative approaches to training employees to use AI solutions for cybersecurity. | · | · | Sign up to track |
| EO4Deployment of cybersecure tools and technologies relying on trustworthy AI; AI driven cybersecurity tools; Integration of tools to protect and secure AI solutions. | · | · | Sign up to track |
| Other requirements | |||
| REQ1Interfacing and incident reporting to Cyber HubsSolutions are expected to incorporate functions that connect SMEs to a Cyber Hub to report incidents and assist with recovery. | · | · | Sign up to track |
| REQ2Personal data protection in cyber risk toolsToolkits and tools provided to SMEs must improve cyber hygiene and mitigate potential threats while strictly protecting personal data. | · | · | Sign up to track |
| REQ3Trustworthy AI features and human oversight complianceDeployed AI systems must incorporate trustworthiness features, specifically robustness against cyberattacks and human oversight as emphasised for high-risk AI systems. | · | · | Sign up to track |
| REQ4Synergies with Horizon Europe and EU-funded R&I resultsProjects should support the market uptake and dissemination of solutions, possibly using results stemming from Horizon Europe projects or EU-supported R&I. | · | · | Sign up to track |
| REQ5Meaningful involvement and validation with SME end-usersProposals must incorporate concrete validation pathways and usability testing tailored to authentic SME end-users and non-technical staff. | · | · | Sign up to track |
| Expected impacts | |||
| No expected impacts in this call. | |||
| Underlying policies | |||
| POL1regulation (eu) 2024/1689 (artificial intelligence act)Regulation (EU) 2024/1689 establishes a comprehensive, risk-based harmonised legal framework for the development, placing on the market, and use of Artificial Intelligence systems across the EU. It imposes strict safety, transparency, risk management, and cybersecurity requirements on high-risk AI systems while prohibiting applications posing unacceptable risks. | · | · | Sign up to track |
| POL2interoperable eu risk management framework (enisa, 2023)Developed by the European Union Agency for Cybersecurity (ENISA), the Interoperable EU Risk Management Framework provides harmonised methodologies and guidelines to standardise cybersecurity risk assessment and management across Member States and sectors. It aims to bridge disparate national and organizational risk frameworks to enable seamless threat intelligence sharing and collective cyber resilience. | · | · | Sign up to track |
The binding rules of this call. Items marked auto are verified by GrantForge from the call and the template. The others are yours to confirm.
4 key insights you must internalise before writing. Each is grounded in the call text and tells you what evaluators will actually look for. Share these with your consortium before drafting.
Evaluators will explicitly penalize theoretical AI research, prioritizing instead the demonstrated adoption and usability for non-technical SME staff. Proposals must focus on the operational deployment of high-TRL (TRL 6-8) tools and must include authentic SME end-users in the consortium to provide concrete validation pathways.
Source: Evaluation_pre_award
A winning proposal cannot deliver a standalone software silo; it must feature seamless integration with external Cyber Hubs for incident reporting and handling. Evaluators will heavily scrutinize the technical and operational mechanisms proposed to connect SMEs directly to these national or European hubs for recovery assistance.
Source: Scope / Evaluation_pre_award
Proposals must explicitly classify their AI tools within the EU AI Act's risk tiers and operationalize the Interoperable EU Risk Management Framework (ENISA, 2023). Evaluators expect a clear demonstration of how these regulatory and risk frameworks are translated into practical, low-overhead solutions that do not impose disproportionate compliance burdens on SMEs.
Source: Underlying policies
The call explicitly targets the market uptake of solutions stemming from Horizon Europe projects or similar EU-supported research. Consortia must strategically integrate partners who bring existing, mature AI-powered cybersecurity assets to the table, rather than proposing to develop new core algorithms from scratch.
Source: Scope / Expected Outcomes
Nothing to show for this call yet.