The EU's AI Security Theater: Glass Towers on Beds of Sand

The code of the EU's AI Cybersecurity Action Plan arrived not with a bang, but with a whisper. I was in a cold Vienna coffee shop, the morning light filtering through rain-streaked glass, when the press release crossed my screen. The espresso in my cup grew bitter as I read—not because of the coffee, but because of what the document lacked. It was a cathedral of intent, a structure of architectural promise, but I walked through its halls and found no foundation. No budget lines. No testing requirements. No enforcement mechanisms. Just a proclamation: 'Digital sovereignty is necessary.' I set down the cup and thought of a line I had written years ago, after auditing the whitepapers of 23 Ethereum-based tokens in the chaotic summer of 2017: 'We built towers of glass on beds of sand.' Here, in the sterile language of a Brussels communiqué, the same phantom was rising again. The plan, announced by the European Commission in early 2025, aims to address the cybersecurity risks posed by the rapid adoption of artificial intelligence. It speaks of strategic autonomy, of protecting European citizens, of ensuring that AI systems are trustworthy and resilient. On the surface, it is a noble ambition. But beneath the rhetoric, I saw the same pattern I had observed in countless DeFi protocols during the 2020 liquidity mining frenzy: a promise of value without a mechanism to deliver it. The plan is heavy on vision, light on execution. It calls for cooperation with existing frameworks like the EU AI Act, but offers no concrete steps for how AI security audits should be conducted, no earmarked budget for red-teaming infrastructure, no mandate for third-party verification. It is a governance token without dividends—a claim on future utility with no current claim on reality. Let me back up. Context is the soil in which truth takes root. The EU has long struggled with technological dependency. Its cloud market is dominated by American hyperscalers—AWS, Azure, Google Cloud. Its AI chips come almost exclusively from NVIDIA. Its cybersecurity tools are often sourced from Palo Alto Networks, CrowdStrike, and Zscaler. The Action Plan is a reaction to this reality, an attempt to reclaim sovereignty through policy. But as I learned during the 2021 NFT explosion, when I analyzed 100 collections and found 18 with any cultural substance, intent without embodiment is a ghost. The plan's 'lack of executable measures'—a phrase I repeat because it is the core wound—transforms a strategic opportunity into a political signal. It reassures domestic constituencies that 'something is being done' while allowing the status quo to calcify. In the decentralized world, we call this 'vaporware.' In Brussels, they call it a 'roadmap.' Core analysis demands we look at the technical gaps. The plan mentions cybersecurity for AI, but not a single technical standard. It does not specify how AI red-teaming should be performed, what metrics define a secure model, or whether the EU will fund a public testing facility akin to the UK's AI Safety Institute. It avoids the hard questions: Who audits the auditors? How do we verify that an AI system has been tested against adversarial attacks? Where is the accountability when a model fails? In my years auditing smart contracts, I learned that security is not a declaration—it is a continuous process of verification. The Ethereum ecosystem built itself on the principle of 'trust, but verify,' with formal verification tools and bug bounty programs. The EU's plan, by contrast, asserts trust without verification. It assumes that voluntary compliance will produce safety, ignoring the market incentives to cut corners. I remember the 2022 bear market, after the collapse of FTX, when I wrote an essay titled 'The Ethics of Trustless Systems.' I argued that we cannot code away human greed. Here, I argue that we cannot regulate away technical fragility with policy theater. The silence in the document—the absence of concrete technical requirements—is the most honest ledger of its intent. The contrarian angle tests the pragmatism of despair. One might argue that even a hollow plan is better than no plan, that it opens the door for future legislation, that it signals to the market that security matters. I respect that view, but I think it misses a deeper risk. The plan, in its current form, may actually deepen the dependency it seeks to end. Why? Because without executable measures, European enterprises will continue to rely on American security vendors who have already built the tools. Microsoft Security Copilot, AWS GuardDuty, Google Cloud Security AI—these products are battle-tested, scalable, and integrated. The EU's plan offers no alternative, no funding for European startups to compete. It creates a regulatory maze that small innovators cannot navigate, while large incumbents hire compliance teams to glide through. I saw this dynamic during the 2020 DeFi Summer, when protocols like Aave and Compound exploded with $10B+ in TVL, but the underlying mechanisms incentivized short-term greed. The plan here incentivizes compliance theater—hiring lawyers to produce reports that look like security but are not. The ghost of the ICO era returns: projects spent millions on whitepapers that promised nothing. The EU is spending political capital on a document that promises nothing. But where the market eats its fools, regulation feeds on its own delays. Yet there is a hidden opportunity beneath this sand. The plan's weakness creates a vacuum for decentralized, crypto-native solutions. Imagine an AI security standard verified on-chain, using zero-knowledge proofs to attest that a model has passed a battery of adversarial tests. Imagine a decentralized red-teaming marketplace where security researchers worldwide can challenge models and earn tokens for finding flaws. Imagine a protocol that publishes cryptographic commitments to model weights and training data, enabling public verifiability while preserving privacy. These are not fantasies—they are the natural extension of the principles I have championed since 2017: code as constitution, trust through transparency. The EU's centralized policy approach cannot achieve the speed or credibility of a permissionless network. It is the difference between a castle and a forest. A castle may look strong, but it is a single point of failure. A forest is resilient because it is decentralized. The EU should learn from blockchains, not ignore them. But let me not romanticize the contrarian. The pragmatic truth is that most crypto projects are not ready for this responsibility. DAO governance tokens, as I have argued, are essentially non-dividend stock—their value depends on greater fools. A decentralized AI security protocol would face the same challenge: how to align incentives among anonymous participants who may collude or attack the system. The plan's failure to address these issues is not merely a technical gap; it is a philosophical one. It ignores the human element. As I wrote in 2024 after analyzing 15 major asset managers entering the Bitcoin ETF space, institutional adoption dilutes core values unless we embed safeguards. The EU's plan lacks both the technical safeguards and the philosophical grounding. It is a document written by committee, not by conviction. Takeaway: The future of AI security will not be written in Brussels. It will be written in the open-source repositories of GitHub, in the cryptographic proofs of zero-knowledge circuits, in the quiet conversations between developers who care more about code than compliance. The EU's Action Plan is a reminder that truth is not mined from policy papers—it is revealed in the dark, in the failures that expose our vulnerabilities. The code whispers, but the soul listens. The European Union must listen to the soul of its technological fabric before it can build towers that stand. Until then, we build on sand. I walk out of the Vienna coffee shop into the rain. The streets glisten with a sheen of water, reflecting the neon signs of American cloud providers. The world is moving fast, and the plan is already trailing. But perhaps that is the point. Perhaps the delay is deliberate—a pause to let the market mature, to let technology find its own center before regulation cages it. I hope so. In the chaos of the chain, find your center. The chain of governance, of policy, of human intentions—it all demands a steady hand and an honest ledger. Silence is the most honest ledger. The plan spoke, but its silence said more.