Source: Affaritaliani

Europe’s regulatory framework on AI and cybersecurity coexists with uses of artificial intelligence in hybrid warfare—cyberattacks, disinformation, surveillance, drones and electronic warfare—that follow different legal tracks because the AI Act expressly does not apply to systems intended exclusively for military, defence or national security purposes. That exclusion, and the further provision that the Regulation must not prejudice Member States’ competencies in national security, produces a legal boundary between civilian market regulation and military applications. Giusella Finocchiaro, professor of Private Law and Law of the Internet and Artificial Intelligence at the University of Bologna and founder of a boutique law firm, provides the assessment and highlights that substantial EU instruments already address cybersecurity and digital harms, including the Cybersecurity Act, Cyber Resilience Act, Cyber Solidarity Act, NIS2, CER, the AI Act’s treatment of disinformation and the Italian AI law L. 23 September 2025, n. 132, which treats cybersecurity of AI systems as an essential precondition for rights protection.

Finocchiaro argues that regulating AI use in conflicts would require an international convention, but she notes that current political direction does not appear to be moving toward that solution. She underscores the growing tension between surveillance capabilities enabled by AI and existing personal-data protection frameworks built on individual self-determination, suggesting that model is less effective in the era of big data. The AI Act does, however, prohibit specific practices—remote real-time biometric identification in public spaces for law enforcement purposes, social scoring, predictive criminal profiling and facial scraping—that intersect with surveillance risks. The article also references President von der Leyen’s 2026 State of the Union comments linking AI and security and announcing new initiatives for defence and other high-value sectors.