Digital Europe: €96 million for cybersecurity, deadline 14 January 2027

On 1 September 2026, the European Cybersecurity Competence Centre (ECCC) opened call DIGITAL-ECCC-2027-DEPLOY-CYBER-11 under the Digital Europe Programme, with an estimated budget of 96 million euro split across seven topics. The most interesting topic for Romanian companies is AI4SME: 20 million euro for developing and adopting AI-based cybersecurity solutions for SMEs, with a funding rate of 75% for SMEs. Proposals must be submitted online by 14 January 2027, 17:00 (Brussels time).

In brief

• Programme: Digital Europe (Digital Europe Programme), call DIGITAL-ECCC-2027-DEPLOY-CYBER-11
• Authority: European Cybersecurity Competence Centre (ECCC)
• Beneficiaries: public or private legal entities from EU Member States and from Norway, Iceland and Liechtenstein; the target group differs from one topic to another
• Total budget: €96 million, of which €20 million for the AI4SME topic (SMEs) and €20 million for the EULEG topic (compliance with NIS2, the Cyber Resilience Act, GDPR, DORA and the AI Act)
• Intensity: 50% for simple grants (exception: REGCABH, 70%); for AI4SME (support actions for SMEs) 50%, and 75% for SMEs
• Submission period: 1 September 2026 – 14 January 2027, 17:00 CET
• Status: open; results are indicatively expected in April 2027, and contract signing in October 2027

What the call funds, by topic

The call document splits the budget as follows:

• CYBERAI – AI-based cybersecurity tools for national authorities, Cyber Hubs, CSIRTs and NIS2 entities: €15 million, simple grant with 50% funding;
• AI4SME – AI cybersecurity solutions for SMEs: €20 million, support action for SMEs, 50% funding and 75% for SMEs;
• COORDPREP – coordinated preparedness testing in sectors of high criticality (energy, transport, public administration) and other preparedness actions: €15 million;
• REGCABH – regional hubs for submarine cable security: €5 million, consortium with public authorities from at least two Member States;
• NCC – strengthening the network of national coordination centres: €11 million, simple grant with 50% funding;
• EULEG – support for applying EU legislation (Cyber Resilience Act, NIS2, GDPR, DORA, Cybersecurity Act, AI Act): €20 million, simple grant with 50% funding;
• DUALUSE – dual-use technologies, civil and military: €10 million.

The ECCC states that the availability of the budget still depends on the final adoption of the amendment to the 2025–2027 work programme, and that the call may be modified if the programme changes substantially.

What does the AI4SME topic mean for SMEs?

One essential point: AI4SME is not a voucher with which an SME buys security solutions. The topic funds projects that develop, adapt, validate and implement AI-based cybersecurity products, tools and services for European SMEs. The call document describes, as a model, a SaaS-type toolkit for SMEs with functions such as:

• assessing and managing an SME's cyber risks, with recommendations for reducing risk;
• an interface with tools that scan the digital infrastructure;
• alerts about relevant vulnerabilities and threats;
• connecting the SME to a Cyber Hub for incident reporting and recovery support;
• an incident reporting interface, with AI assistants that explain what you need to do.

The project must include at least one of the activities above, or the adoption of AI cybersecurity tools in organisations that do not yet use them. The target groups listed include SMEs, start-ups, academia and research, the public sector, NIS2 entities and providers of AI-assisted functionalities.

Who can apply and what restrictions are there?

Public or private legal entities established in EU Member States or in Norway, Iceland and Liechtenstein can apply. Natural persons are not eligible, except for those carrying out independent activities without a separate legal personality. For AI4SME, EULEG and CYBERAI there is no minimum consortium requirement, so a single company can apply. The NCC topic does not require a consortium either, but it is aimed exclusively at national coordination centres recognised by the Commission.

All topics are subject to the security restrictions set out in Article 12(5) of the Digital Europe Regulation. In practice:

• participants may not be controlled, directly or indirectly, from an ineligible country, and each entity (except public bodies validated as such) submits a declaration on ownership and control;
• activities, including subcontracted ones, must take place in eligible countries;
• the financial capacity check does not apply to public bodies or to applicants requesting no more than €60,000.

How and by when do you apply?

The application is submitted exclusively electronically, through the submission system of the European Commission's Funding & Tenders portal. The deadline is 14 January 2027, 17:00 CET, i.e. 18:00 in Romania. The file comprises part A (administrative data and the budget, completed online) and part B (the technical description, of at most 70 pages). Participants must register beforehand in the Participant Register. Each proposal addresses a single topic. Evaluation is scheduled for February–March 2027.

Proposals also undergo an ethics assessment. For AI systems, this checks human oversight, fairness, transparency and social impact, while the robustness of the solution is analysed by the experts in the technical evaluation.

What this means for your business

Our recommendation, as consultants: the AI4SME topic suits Romanian software and cybersecurity companies that already have a product or prototype they can turn into a service for SMEs. At 75% funding, you cover the remaining 25% from your own resources, so plan your cash flow from the start. An ordinary SME that simply wants to protect its network is not the typical beneficiary of this call. It could join a project as a pilot user, if a provider includes it in the consortium.

Town halls, county councils and institutions falling under NIS2 should follow the EULEG and CYBERAI topics, where the public sector and NIS2 entities are explicitly mentioned. Funding there is only 50%, so co-financing must be provided for in the budget.

Common pitfalls: companies with shareholders from outside the EU or EEA (check the control chain before investing time in the application), vague performance indicators (the call requires a detailed KPI table and an annual report on the indicators) and postponing registration on the portal until the last week. Less than four months remain until the deadline, enough for a solid proposal if you start now. For an initial assessment of your company's eligibility, you can use the eligibility check.

Frequently asked questions

Can an SME in Romania receive money from this call to buy an antivirus or a firewall?

Not directly. The AI4SME topic funds projects that develop, adapt and implement AI-based cybersecurity solutions for SMEs, not the purchase of licences by an arbitrary company. An SME can take part as a beneficiary if it carries out such a project, or can join a consortium as a pilot user.

How much does EU funding cover under the AI4SME topic?

The topic is a support action for SMEs. The funding rate is 75% for SMEs and 50% for other participants. The call document estimates an EU contribution of between 3 and 5 million euro per project, but also accepts other amounts if well justified. The total budget of the topic is 20 million euro.

Can town halls and public institutions apply?

Yes, the call is open to public and private legal entities from the EU and the EEA. For the public sector, the most suitable topics are EULEG (applying NIS2, the Cyber Resilience Act and other EU acts) and CYBERAI. Both are simple grants, with 50% funding.

Do I have to form an international consortium?

No, for AI4SME, EULEG, CYBERAI, COORDPREP and DUALUSE there is no minimum consortium requirement, so a single applicant can also submit. The NCC topic does not require a consortium either, but it is reserved for national coordination centres, and other entities can take part only alongside them. The exception is the REGCABH topic, which requires at least two independent beneficiaries from two eligible states, including public authorities.

When will the results be known?

According to the indicative timetable in the call document, evaluation takes place in February–March 2027, results are communicated in April 2027, and grant agreements are signed in October 2027.

Official sources

• ECCC – launch announcement for call DIGITAL-ECCC-2027-DEPLOY-CYBER-11
• ECCC – call document DIGITAL-ECCC-2027-DEPLOY-CYBER-11, version 1.0 of 1 September 2026
• European Commission Funding & Tenders Portal – submission of proposals

Information checked on 27 September 2026. Conditions may be amended by the managing authority — check the guide in force before submitting.