Von der Leyen puts hacking "on a level we never thought possible" into the State of the Union
The Commission president's September 16 speech named model-enabled intrusion as a sharpening risk and pointed to the AI Act as the guardrail, while the new bills she promised cover children's feeds and jobs.
The Watch · Security desk
What happened
- European Commission President Ursula von der Leyen delivered the State of the European Union 2026 speech on the morning of September 16, 2026, starting at 9:00 am CEST.
- She said models being developed will allow hacking on a level never thought possible and will soon be in the hands of adversaries, and that the dangers of self-improving models are becoming ever more apparent.
- The instrument she named against that risk was the AI Act, which she called a crucial piece to put in place guardrails and a base for shaping global efforts.
- The Commission is proposing a new Kids Act covering children's social media use, with what she called a gradual and differentiated approach by age.
- She also said the upcoming EU Quality Jobs Act, framed as support against AI's societal costs, will be delivered before the end of the year.
Why it matters
- What it limits constraint European compliance teams still answer to AI Act text written before this warning, because the September 16 announcements add no duty on model-enabled intrusion.
- Who's exposed exposure The new law flowing from this speech lands on platforms serving minors. That puts the compliance work on consumer product and trust and safety teams. Model builders are not the ones carrying it.
- What it sets up precedent Once a Commission president asserts from the Parliament floor that coming models will enable hacking beyond expectation, that assertion becomes a premise in the next round of EU legislating and in the audit questions built on it.
Next story · Invest · Sep 14
EU's under-15 chatbot rule would rely on age-verification wallet built for 18+, adaptable to 13+Confirmed5 publishers
Her one example on model risk was the Hugging Face incident, which the SecurityWeek account of the speech cites without describing [5]. She dated the intrusion capability itself only to "soon" [3]. I read the passage as a guide to the legislating to come.
The guardrail she named already exists. "The AI Act is, of course, a crucial piece to put in place guardrails," she said [7], and said Europe would step up together with like-minded partners like Canada, the UK and others [8]. Mark Carney, the Canadian prime minister, was her guest in the chamber in Strasbourg [2].
Across the AI and social media passages, the AI Act is on the books. A Kids Act is proposed [14], and neither it nor the Quality Jobs Act is directed at model-enabled intrusion [18]. The Quality Jobs Act is promised "before the end of the year" [13], which leaves 106 days from the speech to December 31, about 15 weeks [19].
The legislative detail in the speech went to children's feeds. "Young Europeans now spend four to six hours a day on screens," she said [15]. She cited Olea Orban, a 14-year-old girl from Flemalle, near Liege, who killed herself following social media cyberbullying, and quoted her mother saying "I am convinced that had it not been for these omnipresent networks, my daughter would still be with us" [16]. Von der Leyen added: "Now it's time for Europe to act" [17].
POLITICO reported the speech as a case for "independence" economically, militarily and technologically, and quoted her calling this a "complex age of great possibilities and great perils" [4]. Its takeaways piece counted 12 [6]. The AI section sat beside energy independence, the trade imbalance with China, sanctions on Russia, and a climate passage in which she said "Europe is warming at double the global rate" [10].
"I am an optimist that AI has the potential to benefit humanity if we get it right," she said, before warning of "massive risks" [9]. She also said Europe does not need to develop new frontier models to draw benefit from them [11]. The value, in her words, is in "moving AI from the screen to the real economy and the real society, on the factory floor, on the hospital ward, in precision agriculture, in our energy grids, smart grids, for autonomous driving, for defense" [12].
What to watch
- Whether the published Kids Act text touches AI-enabled abuse or stays on age gating and feed design.
- Whether the promised coordination with Canada and the UK produces a named instrument or remains a line in a speech.
- Whether the Commission publishes detail on the Hugging Face incident it now cites as evidence on self-improving models.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+30
- Incentives45
- Confidence62
Perspective Coverage
5 publishers- Builder
- Builder 21%
- Operator
- Operator 50%
- Investor
- Investor 29%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Ursula von der Leyen, President of the European Commission, delivered the State of the European Union 2026 speech on September 16, 2026, at 9:00 am CEST.
- [2]
Von der Leyen delivered the speech in the European Parliament in Strasbourg, alongside special guest Canadian Prime Minister Mark Carney.
- [3]
She said: "These risks have become sharper and come sharper into focus. Models being developed will allow hacking on a level we never thought possible, and they will soon be in the hands of adversaries who see the world very differently than us. At the same time, the dangers of self-improving models are becoming ever more apparent."
- [4]
POLITICO reported that von der Leyen made the case for "independence" economically, militarily and technologically, and said this was a "complex age of great possibilities and great perils".
- [5]
The report says von der Leyen used the Hugging Face incident as her example of the dangers of self-improving models, and cites the incident without describing it.
- [6]
POLITICO published a piece listing "the 12 biggest takeaways" from the speech, describing a raft of proposals aimed at making Europe better prepared for a world of threats including hybrid warfare and TikTok.
- [7]
She said: "The AI Act is, of course, a crucial piece to put in place guardrails, and it puts Europe in a position to shape global efforts on how to tackle this."
- [8]
She said Europe would step up together with like-minded partners like Canada, the UK, and others.
- [9]
She said "I am an optimist that AI has the potential to benefit humanity if we get it right," then warned that the potential benefit comes with "massive risks", which must be tackled before the benefit can be achieved.
- [10]
The speech also covered energy independence, reducing the trade imbalance with China, increasing the effect of sanctions on Russia, and climate change, including this year's European wildfires and disappearing rivers, with the line "Europe is warming at double the global rate."
- [11]
She stressed that controlling the risk is not the same as inhibiting the potential, and that Europe does not need to develop new frontier models to draw benefit from them.
- [12]
She said the key is "moving AI from the screen to the real economy and the real society, on the factory floor, on the hospital ward, in precision agriculture, in our energy grids, smart grids, for autonomous driving, for defense."
- [13]
She mentioned the upcoming EU Quality Jobs Act, presented as Europe's support against the societal detriment of AI, which will be delivered "before the end of the year".
- [14]
The European Commission is proposing a new Kids Act on children's social media use, and she said "We will take a gradual and differentiated approach" because "Each age has its own" needs.
- [15]
She said: "Young Europeans now spend four to six hours a day on screens. Children are pulled ever deeper into feeds designed to keep them scrolling."
- [16]
She cited Olea Orban, a 14-year-old girl from Flemalle, near Liege, who killed herself following social media cyberbullying; Olea's mother said, "I am convinced that had it not been for these omnipresent networks, my daughter would still be with us. Enough is enough."
- [17]
Von der Leyen added: "She's right. C'est trop. Enough is enough... Now it's time for Europe to act."
- [18]
The AI and social media passages name three legislative instruments: the AI Act (already in place), the proposed Kids Act, and the Quality Jobs Act. Of the two not yet delivered, neither is directed at model-enabled intrusion.
- [19]
From the September 16, 2026 speech to December 31, 2026 is 106 days, about 15 weeks, the window for delivering the Quality Jobs Act.
Sources
5 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comSelf-improving AI should slow down, von der Leyen tells EU lawmakers
2 articles · September 16, 2026
- politico.euVon der Leyen tries to stem tide on global threats ― from Trump to AI and climate – POLITICO
5 articles · September 16, 2026
- securityweek.comEU Chief Warns of AI-Powered Hacking, Moves to Rein In Social Media
2 articles · September 16, 2026
- thecyberexpress.comEU Plans ‘Article 4’-Style Security Protocol for Cyberattacks and Hybrid Threats
1 article · September 16, 2026
- therecord.mediaEU chief wants joint response to cyberattacks, sabotage
1 article · September 16, 2026
Topics and entities
Topics
- EU AI Regulation
- Frontier AI safety
- Children's online safety
- AI-Enabled Cyber Threats