The European Commission presented its initial proposal for the European Union’s 2028-2034 Multiannual Financial Framework (MFF). If approved, the long-term budget would authorise nearly EUR 2 trillion in spending over seven years, the equivalent of 1.26% of the Union’s predicted Gross National Income (GNI) in that period. Of this total, EUR 1.8 trillion would be allocated to MFF programmes, while the remaining EUR 168 billion will be used to repay debts from the Union’s NextGenerationEU Covid-19 recovery package.
The proposal includes funding for a broad range of cybersecurity, AI and other digital initiatives all centered around overarching themes of competition, regulatory simplification, research and innovation and defence. Notably, the proposed MFF supports the implementation of the ProtectEU internal security strategy, the establishment of a new European Competition Fund (ECF), the expansion of the Horizon Europe research and innovation programme and the enhancement of the Union Civil Protection Mechanism (UCPM+). Aligned with the Commission’s broader simplification goals for its current five-year mandate (2024-2029), the proposal also has a more streamlined framework than previous MFFs with fewer, more integrated programmes.
Following the release, the Commission will now enter into 18 to 24 months of negotiations with the European Parliament, which must approve the MFF by a simple majority, and with the national governments of all 27 Member States, which must unanimously approve it through the Council of the European Union. While this means the MFF is likely to change substantially before final adoption, the current proposal offers useful insights into the Union’s broader strategic direction for the coming decade. The sections below outline specific details of the proposed 2028-2034 MFF – including its provisions for cybersecurity, AI and digital policy – and highlight how it differs from the current 2021-2027 MFF.
A brief overview of the EU budget process
At its core, the EU budget is designed to complement the national budgets of Member States. By pooling resources at the EU level, it amplifies individual efforts, enabling Member States to achieve more collectively than they could at the local, regional, or national level. In practical terms, the EU budget is primarily used for investment and focuses on funding projects related to economic development, environmental protection, education, research and innovation, external border management, international development and human rights.
The MFF establishes the overarching structure for the EU budget by setting maximum spending levels, or “ceilings,” for various categories of spending called “headings.” As mandated by Article 312 of the Treaty on the Functioning of the European Union (TFEU), the MFF must cover a period of at least five years, though it typically spans seven. The specific structure of the MFF varies considerably between iterations, as headings and programmes are updated to reflect the changing priorities of the Union and the evolution of its institutions.
The Union also develops an “annual budget” each year, setting specific spending for programmes up to the MFF’s ceilings. Individual programmes and initiatives release “work programmes” – annual or multiannual – that provide an even more detailed breakdown of funding streams. (See our blog analysing the 2025-2027 Digital Europe Programme Work Programme here.)
Commission goals for the 2028-2034 MFF
In addition to making the new MFF more flexible and streamlined, the Commission has integrated recommendations from several recent high-profile reports addressing the Union’s, economic competitiveness, research and innovation capacity and defence, preparedness and resilience:
- Letta Report - Drafted by former Italian Prime Minister Enrico Letta, the Much more than a market – Speed, Security, Solidarity report advocates for the creation of a “fifth freedom” within the Single Market – centered on research, innovation, and education – to enhance competitiveness. The report also emphasizes reducing regulatory burdens, particularly for small and medium-sized enterprises, and deepening internal market integration, among other priorities.
- Niinistö Report - Drafted by former Finnish President Sauli Niinistö, the Safer Together: Strengthening Europe’s Civilian and Military Preparedness and Readiness outlines a comprehensive strategy to improve Europe’s resilience in the face of evolving security threats. It highlights the need to strengthen both civilian and military capabilities across the EU.
- Draghi Report - Drafted by former European Central Bank President Mario Draghi, The future of European competitiveness report proposes a strategy to close the EU’s innovation gap with the United States and China; center competitiveness in decarbonisation initiatives; and increase security while reducing external dependencies. The report offers sectoral policy recommendations for energy, digitalisation, high-capacity computing, AI and semiconductors as well as horizontal policies aimed at closing the skills gap, sustaining investment and simplifying regulations.
Cyber, AI and digital funding in the 2028-2034 MFF
Each of the four headings in the proposed 2028-2034 MFF allocate funding for key priorities on cyber, AI and other digital policy priorities:
Heading 1. Economic, social and territorial cohesion, agriculture, rural and maritime prosperity and security
This heading proposes a total of more than EUR 1 trillion over seven years, of which EUR 865 billion would support the creation of a European Fund for economic, social and territorial cohesion, agriculture and rural, fisheries and maritime, prosperity and security. Member States will use this fund to implement new National and Regional Partnership Plans (“NRP Plans”) in which they propose strategies for how to achieve common objectives.
According to the Commission, NRP Plans will include measures related to “internal security,” with EUR 6.8 billion of the Fund specifically allocated for this purpose. These measures will address the key challenges identified in the ProtectEU Strategy, such as combatting organised crime, violent extremism, cybercrime, child sexual abuse and exploitation and hybrid threats. They will also include efforts to enhance the resilience of critical infrastructure; manage security-related incidents, risks, and crises; and improve information sharing between EU institutions, third countries, international organisations and private entities.
The Commission has already proposed NRP Plan allocations for each Member State. Under the current proposal, Poland would receive the largest share of EUR 123.3 billion over seven years. That’s significantly more than the next largest beneficiary, France, which would receive EUR 90.1 billion. However, Member States would not be automatically entitled to these funds. Instead, access would depend on their willingness to uphold the rule of law and support civil society. If a Member State fails to meet these conditions, the EU could suspend payments, and the national government would become responsible for covering all payments related to its NRP Plan. The Commission is likely proposing this condition in order to address democratic backsliding in countries such as Poland and Hungary in recent years.
Heading 2. Competitiveness, prosperity and security
This heading proposes a total of EUR 589.5 billion over seven years, of which EUR 450.508 billion would support the creation of a European Competitiveness Fund (ECF) as recommended by the Draghi and Letta reports. The Commission proposes carrying out work under the ECF through four “policy windows:” Clean Transition and Industrial Decarbonisation (EUR 67.416 billion); Digital Leadership (EUR 54.793 billion); Health, Biotech, Agriculture and Bioeconomy (EUR 22.583 billion); and Resilience and Security, Defence industry and Space (EUR 130,704 billion). Of these policy windows, two are particularly important for cyber, AI, and digital policy:
- Digital Leadership - Article 39 of the proposed regulation on establishing the ECF states that funding in this policy window will support AI research, development and deployment; technological sovereignty; the digital start-up, SME and emerging industry ecosystem; deployment of advanced digital infrastructure at scale (e.g., high-performance computing, telco-cloud-edge, AI factories, testing facilities, semiconductors, quantum computing, cybersecurity hubs and submarine and terrestrial fibre); and “development, deployment and procurement of advanced cybersecurity capacities, infrastructures, technologies and capabilities.”
- Resilience and Security, Defence industry and Space - Article 42 of the proposed ECF regulation states funding will support programmes that reinforce strategic autonomy, economic security and resilience in the raw materials supply chain. Meanwhile, Article 67 advocates for technological sovereignty in the space industrial ecosystem, including for dual use capabilities.
In addition to the policy windows, the ECF would also include EUR 175 billion for Horizon Europe, the European Union’s flagship research and innovation funding programme. The programme supports a wide range of initiatives, including research projects, career development programmes, fellowships, infrastructure investments, and market-creation initiatives. Key long-term objectives – called “moonshots” – for the programme include advancing next-generation AI and ensuring EU data sovereignty.
Aside from the ECF, this heading would also provide EUR 10.6 billion for the Union Civil Protection Mechanism (UCPM+) – which foresees the creation of the EU Crisis Coordination Hub to manage incident response for a variety of emergencies, including hybrid and cyber-attacks – as well as EUR 9.8 billion to fund decentralised agencies, including the European Union Agency for Cybersecurity (ENISA).
Heading 3. Global Europe
This heading proposes a total of EUR 200.309 billion over seven years for programmes under Global Europe. This includes several programmes to combat cyber threats, strengthen cybersecurity and cyber defence capabilities, develop digital economies and facilitate AI deployment around the world. The heading also proposes EUR 3.369 billion over seven years, for Common Foreign and Security Policy (CFSP), some of which will fund initiatives like the EU Cyber Diplomacy Toolbox.
Heading 4. Administration
This heading proposes a total of EUR 117.877 billion over seven years to fund the operation of EU institutions themselves. In the context of cyber, AI and digital policy, this includes funding for key bodies such as the Commission’s Directorate-General for Communications Networks, Content and Technology (DG CONNECT), the European Parliament – including its Industry, Research and Energy (ITRE) and Internal Market and Consumer Protection (IMCO) committees – as well as the European External Action Service (EEAS) and other relevant institutions.
Special Instruments
In addition to the four core headings, the proposed 2028-2034 MFF also includes “special instruments,” separate reserves of funding that enable additional spending beyond the ceilings set under each heading. This funding would include EUR 15.7 billion over seven years for the Flexibility Instrument, which can be used to respond to unexpected crises, including cyber threats as well as threats posed by AI and emerging technologies. It also would include EUR 88.8 billion over seven years for the Ukraine Reserve, some of which could presumably fund cyber defence and dual-use technology initiatives.
These special instruments will work alongside the Single Margin Instrument (SMI), which functions under the MFF’s ceiling by pooling unused margins from each heading into a shared reserve. This common pool – which would total EUR 21.898 billion over seven years – could also fund cybersecurity, AI or digital priorities, particularly in response to urgent needs or emerging crises.
How does the proposed 2028-2034 MFF compare to the 2021-2027 MFF?
The proposed 2028-2034 MFF includes several significant changes compared to the 2021-2027 MFF that are relevant to cyber, AI and digital policy, for example:
The proposed MFF consolidates digital programmes. To simplify the MFF, the Commission reduced the number of headings from seven in the 2021-2027 iteration to four in the 2028-2034 iteration. The funding for key digital priorities included in the 2021-2027 MFF’s Single Market, Innovation and Digital heading is split between Headings 1 and 2 of the 2028-2034 MFF. This consolidation, and the Commission’s creation of the ECF, eliminated 14 different programmes – including Horizon Europe, the Digital Europe Programme and the Connecting Europe Facility (CEF) Digital – in favor of the new streamlined ECF Digital Leadership policy window. While this does not necessarily undermine digital initiatives, it will likely change what they are called and how they operate.
The proposed MFF increases funding for digital programmes. Despite the consolidation of many related programmes, it appears that funding for cyber, AI and other digital initiatives will increase moving forward. In the 2021-2027 MFF, the Digital Europe Programme received EUR 8.2 billion over seven years, while CEF Digital – which focuses on deploying 5G systems and upgrading submarine and terrestrial fibre – received EUR 2.6 billion. While it is difficult to make a direct comparison to the 2028-2034 MFF here since those programmes were consolidated, the new Digital Leadership policy window that contains similar priorities will receive EUR 54.8 billion over seven years. Moreover, one programme where it is possible to make a direct comparison – Horizon Europe – will jump from EUR 95.5 billion in the 2021-2027 MFF to EUR 175 billion in the 2028-2034 MFF.
The proposed MFF’s NRP Plans could substantially change the EU approach to incident response. By tasking Member States with the development and implementation of these plans, the Commission risks reinforcing existing fragmentation in the execution of the ProtectEU strategy, including in areas like cyber incident response and critical infrastructure protection. However, it remains to be seen whether the controversial proposal will survive negotiations. Indeed, it touches on two of the most politically sensitive and heavily scrutinised areas of the EU budget: the Common Agricultural Policy (CAP), which provides subsidies to farmers, and Cohesion Policy, which supports regional development in poorer parts of the Union. NRP Plans face an uphill battle in Brussels as they would reduce direct funding to farmers, who are supported by powerful lobbies, and take control over cohesion projects away from regional authorities. With respect to the latter, critics argue that this centralisation of power in the national capitals would also undermine the collaborative, transnational nature of many EU initiatives and could weaken regional autonomy.
Proposed MFF could create a new corporate tax, including for tech companies. While Member States provide the majority of EU revenue contributions – approximately 70% – the EU also collects its own revenues called “own resources.” Under the 2021-2027 MFF, these own resources came from customs duties and the Value Added Tax (VAT). However, to further reduce the financial burden on Member States, the Commission is proposing in the 2028-2034 MFF to create five new own resources to collectively generate EUR 58.2 billion per year in revenue. Most notably, the Commission is proposing creating the Corporate Resource for Europe (CORE), an annual lump-sum contribution from companies operating and selling in the EU. While the proposal excludes SMEs, it is still controversial given that the threshold for payment is based on their net annual turnover – at least EUR 100 million – rather on profit. This measure is particularly controversial, but if it passes, it could prompt tech companies to reduce investments in research and innovation.
What's next for the 2028-2034 MFF?
Moving forward, the Commission will continue negotiations with the European Parliament, Member State governments, civil society groups, industry and other key stakeholders before seeking final approval from the European Parliament and the Council of the EU prior to the current MFF’s expiration in 2027. Given the controversial nature of some proposals, the budget will likely shrink and undergo substantial changes. Nevertheless, with broad consensus in Brussels and amongst the Capitals on digital sovereignty and competition with the United States and China – the 2028-2034 MFF’s emphasis on regulatory simplification and increased investment in technology will likely persist.
Read Next
Congress’ Proposed Chip Security Act Threatens to Create New Cyber Vulnerabilities in U.S. Semiconductors
As the U.S. races toward global AI dominance, a new bill aimed at preventing diversion of innovative U.S. semiconductors to China could inadvertently make those very same chips less secure.
Japanese Regulator Balances Cybersecurity, Competition Concerns In MSCA Implementation Guidelines
Promoting robust competition in the digital space while ensuring cybersecurity protections is challenging. The Japan Fair Trade Commission strikes a crucial balance between these priorities in its May 2025 guidelines.
The Clock’s Ticking: Why CISA 2015 Must Be Renewed Now
As the September 2025 expiration of CISA 2015 looms, Congress faces a critical decision that will shape the future of national cyber defense. At a time when the U.S. is under near constant cyber attacks, government and industry need to share intel.