A sparse policy item can still matter: in the EU, artificial intelligence is being treated less like a buzzword and more like a cybersecurity problem with regulatory consequences.