Google Cloud Cybersecurity Forecast 2026: EMEA special report on threats and regulation

In two minutes

• Google Cloud expects cyber physical attacks on European critical infrastructure such as energy grids, transport and digital infrastructure in 2026, likely paired with information operations to undermine public trust (p. 1).
• It anticipates more state cyber espionage, particularly from Russia and China, aimed at European governments, defense, and research in critical and emerging technology (p. 1).
• Threat actors are expected to keep targeting European supply chains, especially managed service providers and software dependencies, to reach many downstream targets (p. 1).
• DPRK IT workers are likely to have scaled up across Europe by 2026, after law enforcement pressure and awareness hurt their operations in the U.S. (p. 1).
• The report expects more aggressive extortion by these workers, who have threatened to release sensitive data or source code, and growing skill in AI and blockchain (pp. 1-2).
• Virtualized corporate infrastructure and BYOD environments may make detection of these workers harder, and facilitators in the UK support the wider ecosystem (p. 2).
• Regulation moves from preparation to enforcement: the EU AI Act's strictest requirements, including for high-risk AI systems, take effect in August, with fines up to 7% of global annual turnover (p. 2).
• NIS2 transposition continues, making cybersecurity a board-level duty with supply chain risk management, mandatory incident reporting, 2% turnover penalties and personal liability for senior management. The UK's similar bill is following (p. 2).

Key numbers

• 7% of global annual turnover: Maximum fine the report cites under the EU AI Act (p. 2).
• 2% of global turnover: Penalties the report cites under the NIS2 Directive (p. 2).
• August (2026): When the EU AI Act's most stringent requirements, notably for high-risk AI systems, come into force (p. 2).
• October 2025: Date of the EU Commission President's statement that Europe needs more than traditional defense against hybrid warfare (p. 1).

What to do with it

• Check AI governance against the EU AI Act timeline: the report says high-risk AI systems need risk management systems, data quality and unbiasedness, and human oversight by August.
• Brief the board on NIS2 duties the report names: board-level responsibility, supply chain risk management, mandatory incident reporting and personal liability for senior management.
• Review exposure to managed service providers and software dependencies, which the report expects attackers to target to reach downstream victims.
• Plan for DPRK IT worker risk in hiring and monitoring, including extortion threats over data or source code and weaker visibility in virtualized and BYOD environments.
• Test readiness for cyber physical attacks and information operations if you run or supply energy, transport or digital infrastructure.

Read the full document if

• you run security for an organization operating in the EU, UK or wider EMEA and need a short view of 2026 threats and enforcement dates.
• you want the regulatory points (EU AI Act, NIS2, UK bill) summarized for a board conversation.
• you want the global Google Cloud forecast, which this excerpt points to for AI, cybercrime and nation-state activity.

What it relies on

The excerpt cites no dataset, sample or method. It rests on Google Cloud's own expectations, its statement that it has "observed" DPRK workers threaten to release data, and a stated October 2025 remark by the EU Commission President. Regulatory points refer to the EU AI Act, the NIS2 Directive and the UK Cybersecurity & Resilience Bill. The publisher sells cloud and security services, though this excerpt recommends no product.

Our read

A short regional summary of what Google Cloud expects in 2026. It is most useful for the enforcement dates and penalty levels it lists and for the DPRK IT worker point. It gives no evidence behind its predictions, so treat it as a prompt for planning, not a measurement.