A new EU action plan pushes cybersecurity and artificial intelligence beyond rulemaking, putting model evaluation, vulnerability handling, open source, and skills at the center of practical defense.