Security3 publishers2 min readPublished
Von der Leyen puts hacking "on a level we never thought possible" into the State of the Union
The Commission president's September 16 speech named model-enabled intrusion as a sharpening risk and pointed to the AI Act as the guardrail, while the new bills she promised cover children's feeds and jobs.
The Watch · Security desk
What happened
- European Commission President Ursula von der Leyen delivered the State of the European Union 2026 speech on the morning of September 16, 2026, starting at 9:00 am CEST.
- She said models being developed will allow hacking on a level never thought possible and will soon be in the hands of adversaries, and that the dangers of self-improving models are becoming ever more apparent.
- The instrument she named against that risk was the AI Act, which she called a crucial piece to put in place guardrails and a base for shaping global efforts.
- The Commission is proposing a new Kids Act covering children's social media use, with what she called a gradual and differentiated approach by age.
- She also said the upcoming EU Quality Jobs Act, framed as support against AI's societal costs, will be delivered before the end of the year.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint European compliance teams still answer to AI Act text written before this warning, because the September 16 announcements add no duty on model-enabled intrusion.
- exposure The new law flowing from this speech lands on platforms serving minors. That puts the compliance work on consumer product and trust and safety teams. Model builders are not the ones carrying it.
- precedent Once a Commission president asserts from the Parliament floor that coming models will enable hacking beyond expectation, that assertion becomes a premise in the next round of EU legislating and in the audit questions built on it.
Her one example on model risk was the Hugging Face incident, which the SecurityWeek account of the speech cites without describing [4]. She dated the intrusion capability itself only to "soon" [3]. I read the passage as a guide to the legislating to come.
The guardrail she named already exists. "The AI Act is, of course, a crucial piece to put in place guardrails," she said [5], and said Europe would step up together with like-minded partners like Canada, the UK and others [6]. Mark Carney, the Canadian prime minister, was her guest in the chamber in Strasbourg [2].
Across the AI and social media passages, the AI Act is on the books. A Kids Act is proposed [11], and neither it nor the Quality Jobs Act is directed at model-enabled intrusion [18]. The Quality Jobs Act is promised "before the end of the year" [10], which leaves 106 days from the speech to December 31, about 15 weeks [17].
The legislative detail in the speech went to children's feeds. "Young Europeans now spend four to six hours a day on screens," she said [12]. She cited Olea Orban, a 14-year-old girl from Flemalle, near Liege, who killed herself following social media cyberbullying, and quoted her mother saying "I am convinced that had it not been for these omnipresent networks, my daughter would still be with us" [13]. Von der Leyen added: "Now it's time for Europe to act" [14].
POLITICO reported the speech as a case for "independence" economically, militarily and technologically, and quoted her calling this a "complex age of great possibilities and great perils" [15]. Its takeaways piece counted 12 [16]. The AI section sat beside energy independence, the trade imbalance with China, sanctions on Russia, and a climate passage in which she said "Europe is warming at double the global rate" [19].
"I am an optimist that AI has the potential to benefit humanity if we get it right," she said, before warning of "massive risks" [7]. She also said Europe does not need to develop new frontier models to draw benefit from them [8]. The value, in her words, is in "moving AI from the screen to the real economy and the real society, on the factory floor, on the hospital ward, in precision agriculture, in our energy grids, smart grids, for autonomous driving, for defense" [9].
What to watch
- Whether the published Kids Act text touches AI-enabled abuse or stays on age gating and feed design.
- Whether the promised coordination with Canada and the UK produces a named instrument or remains a line in a speech.
- Whether the Commission publishes detail on the Hugging Face incident it now cites as evidence on self-improving models.