HORIZON-CL3-2027-02-CS-ECCC: Cybersecurity Topics in Horizon Europe 2027

HORIZON-CL3-2027-02-CS-ECCC: Cybersecurity Topics in Horizon Europe 2027

The European Cybersecurity Competence Centre (ECCC) is responsible for implementing the Horizon Europe cybersecurity call for 2027, identifier HORIZON-CL3-2027-02-CS-ECCC. The European Commission’s 2026–2027 Civil Security for Society work programme identifies it as an indirectly managed call to be launched by the ECCC. The Commission’s work-programme index lists the current Cluster 3 documents as dated 29 September 2026; the linked PDF is the official source for this call’s planned terms. The call is announced but not open: the work programme schedules an opening on 2 March 2027 and a deadline on 15 September 2027. The ECCC Executive Director may move the opening by up to one month before or after the planned date and may delay the deadline by up to two months. These are planned dates, so applicants should check the Funding and Tenders Portal for the live call record and final submission conditions when it becomes available.

The preceding 2026 cybersecurity call, HORIZON-CL3-2026-02-CS-ECCC, has closed. Its separate call page records a 15 September 2026 deadline. The 2027 call is the announced successor opportunity, but it is not simply a date extension: its topics and priorities have changed. This page therefore describes the 2027 work-programme plan and should not be read as an invitation to submit now. Final call documentation, topic records, forms, and submission access will be authoritative once the ECCC and EU portal publish them.

Key details

The work programme gives expected EU contributions per project as planning guidance, not guaranteed awards. Its overview table lists EUR 4–5 million for the Secure Computing Continuum topic, while that topic’s detailed conditions estimate EUR 3–4 million. Treat both figures as indicative and verify the live portal record rather than building a budget around either figure alone. The overall call budget also depends on appropriations in the Union’s 2027 budget. Applicants should use the later call page and topic documents for binding dates, topic conditions, and the final budget.

The four announced topics

Artificial intelligence for cybersecurity applications

Topic HORIZON-CL3-2027-02-CS-ECCC-01 is a Research and Innovation Action (RIA) with an indicative budget of EUR 24.8 million. The work programme estimates that an EU contribution of EUR 4–5 million per project would address the expected outcomes appropriately, and anticipates five to six funded projects. It focuses on AI applied to cyber defence: real-time cyber-threat detection, adaptive systems that can respond to changing attack patterns, and improved Security Operations Centres or Cyber Hubs. Proposals are expected to address trustworthy AI in cybersecurity contexts, including adversarial AI risks and compliance with the AI Act. A credible concept should explain the operational setting, data and threat assumptions, how detection or response will be evaluated, and how people responsible for security operations will use the results.

Secure Computing Continuum

Topic HORIZON-CL3-2027-02-CS-ECCC-02, an Innovation Action (IA), has an indicative budget of EUR 24 million. The planned EU contribution is EUR 3–4 million per project, with five to six projects expected. Its scope spans connected IoT, edge, cloud, and data spaces. The programme points to securing data and computing across heterogeneous environments, integrating controls across domains, and protecting connected infrastructures against distributed threats. Expected directions include interoperable identity and access management, privacy-preserving data exchange, portable post-quantum cryptography acceleration through software and hardware co-design, and detection or response approaches that can operate across the continuum. Projects should connect a proposed capability to realistic multi-layer deployment and show how security, performance, and privacy will be assessed.

Secure post-quantum cryptography implementations, cryptanalysis, and digital trust

Topic HORIZON-CL3-2027-02-CS-ECCC-03 is an RIA with EUR 19 million indicated. The programme estimates EUR 3–4 million per project and four to five projects. The topic combines work on the security of post-quantum cryptography implementations with cryptanalysis and post-quantum digital trust. The expected work includes examining implementation weaknesses and attack surfaces, improving assurance and cryptanalysis methods, and building privacy-friendly quantum-resistant protocols for real-world digital identity and trust scenarios. A proposal should make clear which cryptographic components or trust functions it will address, what evidence will demonstrate security or assurance, and how the work relates to deployable systems and migration needs.

New primitives and protocols for future hybrid quantum-classical and quantum networks

Topic HORIZON-CL3-2027-02-CS-ECCC-04 is an RIA with EUR 4 million indicated. The planned EU contribution is around EUR 4 million, with one to two projects expected. It concerns new primitives and protocols beyond Quantum Key Distribution (QKD) for security and trust applications in future hybrid classical-quantum and quantum networks. The work programme calls for analysis against the strongest classical-only alternatives, scrutiny of formal assumptions and security proofs, and a roadmap for quantum cryptography and network functions. A proposal should identify the network function it will support, explain whether its primitive has a classical equivalent or enables a new quantum application, and show how it will assess applicability, performance, security, and realistic integration. This topic is distinct from general post-quantum migration, so applicants should ground their concept in quantum-network functions and the specific expected outcomes rather than treating it as another PQC implementation project.

Who may be eligible

The work programme specifies a security-related participation restriction for this ECCC call. Participation in the listed topics is limited to legal entities established in EU Member States or Horizon Europe Associated Countries. It further says that an entity established in an eligible country but directly or indirectly controlled by a non-eligible country or a non-eligible-country entity may not participate. This restriction reflects the protection of the Union’s strategic assets, interests, autonomy, and security.

That is not a complete eligibility decision for an applicant. Horizon Europe’s general conditions still apply, and each topic has a type of action and specific conditions. A prospective coordinator should check each partner’s legal establishment, ownership and control, role, and ability to meet the call’s financial and operational requirements. The work programme points to General Annex B for eligibility and General Annex G for grant-agreement setup; the final portal documents may add call-specific instructions. Do not assume that a partner is eligible solely because it is based in Europe, or that a consortium is compliant without reviewing the final rules.

The topics vary in action type. The AI-for-cybersecurity topic, post-quantum trust topic, and quantum-network topic are RIAs; the Secure Computing Continuum topic is an IA. Applicants should select the topic that matches the project’s expected outcomes and maturity rather than combining unrelated themes to fit the call’s total budget. Each topic has its own budget and expected project count, and proposals will be assessed against the topic text rather than the overall cybersecurity label.

Application steps once the call opens

The work programme announces the schedule and topic specifications, but it is not a submission portal and does not supply a complete application package. At the time of this update, the scheduled opening is still in the future, so applicants cannot yet submit to this call. When the ECCC launches it, use the European Commission’s Funding and Tenders Portal to locate the call and each topic record by identifier. Read the topic conditions, general annexes, proposal templates, admissibility rules, evaluation procedure, and submission instructions in that live record; those materials will govern the application.

Before the planned opening, a team can prepare without treating the submission system as available:

1. Choose a single topic and test fit. Map the project’s problem, target users, technical outputs, and expected impact to the selected topic’s text. Record which expected outcomes it addresses and which it does not.
2. Screen the consortium. Confirm each partner’s legal identity, establishment country, ownership/control, and role against the eligibility restrictions. Seek clarification through official national contact points or the portal if an ownership or country question is not clear.
3. Build the work plan and budget around the action. The programme identifies the action type and an indicative contribution range for each topic. These are useful planning figures, not a promise of funding or a substitute for the eventual grant rules. The programme indicates lump-sum arrangements for these topics; the final call documents govern how a proposal must construct and justify its budget.
4. Prepare technical evidence and governance. Define the threat model, baseline, validation environment, measurable results, responsible partners, security-sensitive information handling, and intended exploitation or uptake. Some work may involve classified background or produce security-sensitive results; consult the final security provisions before sharing material or assigning tasks.
5. Follow the portal package exactly. Once available, download the current templates and complete the required proposal forms and annexes. Submit through the portal before its displayed deadline and retain the submission receipt. Do not rely on a locally prepared checklist as a replacement for mandatory portal fields or documents.

The scheduled deadline is 17:00 Brussels local time. The programme permits the ECCC to shift the anticipated opening by up to one month and delay the deadline by up to two months. Check the portal close to launch and throughout the submission period, since the official live record supersedes these work-programme planning dates.

Planning and proposal quality

For the AI topic, teams should demonstrate more than a generic claim that machine learning improves security. Identify the environment where the system will operate, describe the relevant data and attack conditions, and define how detection quality, response time, robustness, and operator workload will be measured. Explain how AI Act requirements apply to the proposed use and how human oversight, security testing, and model updates fit into the design.

For the secure-computing topic, map the system across the IoT, edge, cloud, or data-space layers it actually uses. Make the interfaces and trust boundaries explicit. A proposal that includes cryptographic acceleration, privacy-preserving exchange, or automated defence should show how components interoperate and what deployment constraints will be tested. Industrial, public-sector, or infrastructure use cases can help establish operational relevance when partners have a defined role and can provide a suitable validation environment.

For post-quantum cryptography and digital trust, distinguish new scheme design, implementation analysis, cryptanalysis, and protocol integration. State the threat model and security assumptions, and show what evidence the project can produce within its proposed duration. For the quantum-network topic, establish why the proposed primitive or protocol is needed for a hybrid network function and what testbed or analytical method can validate it.

Across all topics, make the work plan traceable: each objective should lead to tasks, deliverables, measurable results, responsible partners, and a plausible path to use. Budget requests should be consistent with the proposed work and the lump-sum rules in the official documents. Address data, intellectual property, ethics, security, and dissemination as applicable to the final templates. Since some results may be security-sensitive, teams should decide early which information can be shared and what handling measures are needed.

Important distinction from the closed 2026 call

The previous HORIZON-CL3-2026-02-CS-ECCC call had three topics on software and hardware security, SecureAI, and advanced cryptography, with a EUR 56.2 million total budget and a 15 September 2026 deadline. It is closed. The announced 2027 call changes both scope and budget: AI for cybersecurity applications, secure computing across IoT/edge/cloud/data spaces, secure PQC implementations and digital trust, and primitives for hybrid quantum-classical networks. In particular, SecureAI as a named 2026 topic should not be confused with the 2027 topic on AI applications for cybersecurity. A team should base its concept on the 2027 topic text, not recycle a 2026 proposal unchanged.

The 2027 total is EUR 71.8 million, but that sum is indicative and divided across the four topics. It is not available to a single project. The expected number of funded projects and EU contribution per project are estimates in the work programme. Awards depend on evaluation results, the final call conditions, and available appropriations.

Official sources

• Horizon Europe 2026–2027 Civil Security for Society work programme, including the ECCC 2027 cybersecurity call
• ECCC page for the closed 2026 cybersecurity call
• European Commission Funding and Tenders Portal

The first source is the basis for the announced 2027 schedule, budgets, topics, restrictions, and work-programme expectations. The Commission’s Horizon Europe work-programme index lists the Cluster 3 document dated 29 September 2026. The later ECCC and portal call records should be checked for final live status, application templates, and any changes before a proposal is submitted.