We’re Building an EU Consortium for AI-Powered SME Cybersecurity — and Looking for Partners
The Nisura Team ·
Nisura is assembling a consortium to apply for a Digital Europe Programme call that funds AI-powered cybersecurity tools for Europe's small and mid-sized companies — and we are looking for partners to build it with us. This is a proposal in preparation, not a funded project: no grant has been awarded, and the consortium is being formed now, ahead of the January 2027 deadline. If your organisation works in EU cybersecurity, applied AI, or reaches SMEs, we would like to talk.
The call
DIGITAL-ECCC-2027-DEPLOY-CYBER-11-AI4SME — "Strengthening cybersecurity capacities of European SMEs with cybersecure AI-powered solutions" — is run under the Digital Europe Programme and the European Cybersecurity Competence Centre (ECCC). It funds the deployment of trustworthy, AI-powered tooling that helps SMEs assess their risk, handle incidents and report them to the right authority. The headline terms:
- Submission deadline: 14 January 2027; projects run 36 months.
- EU contribution €3–5M per project, from a €20M call budget.
- It is an SME Support Action: the funding rate is 75% for SMEs and 50% for non-SMEs (research institutes, public bodies, larger firms).
What Nisura brings as coordinator
Nisura — a product of OnDuty AI Solutions GmbH, Vienna — is an EU-hosted platform, in production today, that passively scans an SME's external attack surface and turns what it finds into expected financial loss in euros, mapped to NIS2, GDPR and DORA. It is sold directly and through managed service providers, and it already runs free public tools (a NIS2 scope checker, a CRQ simulator, a domain scanner and an EU ransomware tracker) plus around 40 guidance articles for SMEs.
That gives the consortium a working deployment to build on from day one — which is what a deploy action is meant to have.
Where the project brings in AI
Today's scoring engine is statistical (EPSS, FAIR, Monte Carlo). The project adds genuine, verifiable AI around it — the transparent euro quantification stays as the explainable basis, so there is no "AI-washing":
- AI assistants on an EU-hosted language model — guided incident reporting (NIS2 Art. 23, GDPR Art. 33, DORA and the CRA) and remediation guidance grounded only on the SME's own scan results and cited advisories. A human always confirms before anything is sent.
- A calibrated incident-prediction model — trained and validated on real exposure and incident data.
- Cross-scan attack-pattern detection (anonymised, opt-in) for early warning of emerging patterns.
All of it trustworthy-AI by design: human oversight, an audit trail of every AI decision, prompt-injection and data-poisoning testing, and EU-only providers.
The partners we are looking for
- A Cyber Hub, CSIRT or SME cyber helpline that receives incident reports from the toolkit and defines the national reporting templates.
- An applied-ML research institute to build and validate the prediction and pattern-detection models and their AI Act conformity.
- An AI red-team / security-assurance partner to advise on secure implementation and adversarially test the AI.
- SME-access partners — a chamber, association, EDIH or MSP that recruits and supports the pilot SMEs, ideally across several member states.
Who can join, and by when
Every participant must be established in and controlled from an EU/EEA eligible country, with all project work performed there (the Art. 12(5) security restriction). We are validating the toolkit with SMEs in at least three member states, so partners outside Austria are especially welcome.
We need letters of intent and portal registration by mid-November 2026 to keep comfortably ahead of the submission deadline.
Express your interest
If you recognise your organisation in one of the roles above, write to contact@nisura.eu and we will send the full partner brief. If you reach SMEs or run a cyber programme in a way this does not quite describe, tell us anyway — see also our partner programme. We would rather hear from one partner too many than miss the right one.
Frequently asked questions
What is the AI4SME call?
DIGITAL-ECCC-2027-DEPLOY-CYBER-11-AI4SME — “Strengthening cybersecurity capacities of European SMEs with cybersecure AI-powered solutions” — is a Digital Europe Programme call run with the European Cybersecurity Competence Centre (ECCC). It funds the deployment of trustworthy, AI-powered tools that help SMEs assess cyber risk, handle incidents and report them. The deadline is 14 January 2027, projects run 36 months, and the EU contribution is €3–5M per project from a €20M budget.
Is this an EU-funded project already?
No. This is a proposal in preparation. No grant has been awarded and no funding decision has been made. Nisura intends to apply as coordinator by the 14 January 2027 deadline, and the consortium is being assembled now. Nothing here should be read as a confirmed or funded EU project.
What kind of partners is Nisura looking for?
Four roles: a Cyber Hub, CSIRT or SME cyber helpline to receive incident reports and define national reporting templates; an applied-ML research institute to build and validate the prediction and attack-pattern models; an AI red-team / security-assurance partner to adversarially test the AI and advise on secure implementation; and SME-access partners (a chamber, association, EDIH or MSP) to recruit and support the pilot SMEs.
Who is eligible to join the consortium?
Because this is a cybersecurity deploy action, every participant must be established in and controlled from an EU/EEA eligible country, with all project work performed there (the Article 12(5) security restriction of the Digital Europe Programme). The project validates with SMEs in at least three member states, so partners outside Austria are especially welcome.
How do I express interest, and what is the deadline for partners?
Write to contact@nisura.eu and we will send the full partner brief. To stay comfortably ahead of the 14 January 2027 submission, we need letters of intent and EU Funding & Tenders portal (PIC) registration from partners by mid-November 2026.