EPSO/AD/430/26 Is Open: The AI and Cybersecurity AD8 Competition Explained

The speculation is over. EPSO/AD/430/26 is open — and it is one of the clearest senior-technology opportunities EPSO has published in years.

The competition will create two reserve lists for permanent AD8 administrators: 240 successful candidates in artificial intelligence and 254 in cybersecurity. That is a target of 494 reserve-list places, but candidates must make one consequential choice: you may apply to one field only.

The legally binding notice of competition C/2026/4668 was published on 8 September 2026. Applications close on 13 October 2026 at 12:00 Brussels time. This guide turns the notice into a decision and preparation plan.

The competition in one sentence

Clear the reasoning gates, then beat the field in a 30-question specialist MCQ; candidates with the highest field scores move forward to eligibility checking and the EU-focused written test.

This matters because the tests do not contribute equally. Verbal, numerical and abstract reasoning are qualifying tests. The field-related MCQ is both a pass gate and the ranking engine. The EUFTE written test is another pass gate, but it does not improve your rank.

First decision: AI or cybersecurity?

Do not choose from the title alone. Choose the field whose Annex II duties you can prove with work examples, projects and documents. This is an AD8 competition: depth and responsibility matter.

Field 1 — Artificial intelligence

The AI profile is broader than model development. The notice groups the work into three areas:

• End-to-end AI delivery: architecture, build-versus-buy decisions, model selection, data readiness, quality assurance, integrations, MLOps and full lifecycle operation.
• Trustworthy and compliant AI: governance, AI Act implementation, data protection, security, evaluation, explainability, traceability, fairness, safety, auditability and AI procurement.
• Policy and enforcement: analysing technical trends and societal impact, assessing strategies, working with the general-purpose AI ecosystem and testing whether policy claims are technically sound.

The syllabus is strikingly current. Annex II explicitly reaches generative AI, retrieval-augmented generation, APIs, cloud services, model context protocol and agentic AI. A purely academic ML profile is not the only fit; the institutions are also looking for people who can govern, procure, evaluate and operate AI responsibly.

Field 2 — Cybersecurity

The cybersecurity field spans five duty groups:

• Risk and assurance: threat and risk analysis, security controls, testing and compliance.
• Architecture and engineering: cloud and hybrid security, IAM and PAM, cryptography, secure development, DevSecOps, SIEM, XDR and emerging AI or quantum risks.
• Security operations: monitoring, detection, threat hunting, digital forensics, incident response, threat intelligence, red teaming and CSIRT work.
• Governance and coordination: security programmes, policies, standards, audits, team leadership and representation.
• Awareness and advice: training colleagues, building security skills and advising stakeholders.

That makes this a genuine senior-practitioner competition. It is not limited to penetration testers or SOC analysts; architects, governance leads, incident responders and security programme managers can all map strongly to the notice.

Can you apply? Four routes, one evidence problem

Both fields use the same four education-and-experience structure:

For AI, accepted study areas include AI, computational linguistics, data science, computer science, ICT, engineering, software, cybersecurity, cloud, high-performance computing, quantum technologies, information systems, statistics and mathematics. Another discipline may qualify when it contains a demonstrable AI focus.

For cybersecurity, directly relevant degrees include cybersecurity or information security, security engineering, digital forensics and incident response, and cryptography or key management. Other ICT, engineering, governance, audit, risk, project-management, data-science, AI, mathematics or statistics degrees need a demonstrable security focus.

“Focus” is not a vibe. The notice gives evidence routes such as a formal specialisation, at least 30 ECTS or one semester of relevant coursework, or a relevant thesis. For certain cybersecurity routes, a peer-reviewed publication produced during studies or a primary contribution to a formal national or EU research project may also establish the focus.

You must also meet the general conditions: EU nationality, full rights as an EU citizen, compliance with any military-service obligations and the character requirements for the duties. Language 1 requires at least C1 in one official EU language. Language 2 requires at least B2 in a different official EU language.

The exact test sequence

All candidates who submit on time and meet the identity-document requirement are invited to remotely proctored tests. The official competition page names TAO by Open Assessment Technology as the provider. Your personal invitation and current provider instructions remain authoritative.

Thirty specialist questions in 40 minutes means an average of 80 seconds per question. That is the central preparation fact. Broad familiarity is too slow. You need retrieval speed: definition, distinction, control, obligation, lifecycle stage or best action — then move.

The EUFTE measures written communication using EU-related source documents made available by EPSO. It does not test factual EU knowledge or Language 2 proficiency. Your job is to extract the relevant evidence, organise it and communicate clearly within 40 minutes.

How the ranking works

1. You must pass verbal reasoning and the combined numerical-plus-abstract threshold.
2. You must score at least 15/30 in the field-related MCQ.
3. Candidates are ranked by their field-related MCQ score.
4. EPSO processes the EUFTE and eligibility of the highest-ranked candidates, in descending order, until the reserve-list target can be reached.
5. Only candidates who pass every required stage and whose application evidence supports their declarations can enter the reserve list.

A place on a reserve list does not guarantee recruitment. It makes you available to EU institutions and services recruiting against that profile.

A five-week application and preparation sprint

Week 1: choose field and evidence route

Read Sections 3 and 4 plus Annex II of the notice. Build a one-page map from your degree and every relevant job to the eligibility wording. Choose Language 1 for reasoning speed and Language 2 for specialist reading and writing strength.

Week 2: establish timed baselines

Run complete verbal, numerical and abstract sets. Record accuracy, unanswered questions and seconds per item. Reasoning needs safe pass-level consistency, not heroic overinvestment.

Week 3: turn Annex II into a syllabus

Rate every duty group green, amber or red. For AI, separate delivery, governance and policy. For cybersecurity, separate risk, architecture, operations, governance and awareness. Start with red areas that carry many distinct concepts.

Week 4: train the ranking test

Use short, hard-timed field MCQs. Review wrong answers by misconception, not only by topic. The target is a decision within 80 seconds, supported by exact technical or regulatory knowledge.

Week 5: submit early and rehearse the full chain

Complete the application before deadline day. Confirm the ID upload. Then run a full reasoning block, field MCQ and 40-minute written exercise under controlled conditions. Continue the cycle until EPSO publishes your test invitation.

Your document checklist

• Submit the application and valid identity document by 13 October 2026 at 12:00 Brussels time.
• Collect diplomas, transcripts and proof of any qualifying study focus.
• Collect employer certificates or other records showing dates, workload and actual duties.
• Attach supporting documents by 14 January 2027 at 12:00 Brussels time.
• Check your candidate account at least every three calendar days.

Prepare against the notice, not a generic IT syllabus

EPSOHQ's EPSO/AD/430/26 AI and cybersecurity study centre now maps its learning tracks and practice banks to C/2026/4668. Use the exam configurator for timed reasoning practice and the EUFTE guide for the written gate.

Choose your field. One click opens a ready-made training session:

The smartest strategy is asymmetric: make reasoning safe, make the EUFTE structurally reliable, and put the largest share of serious study into the field MCQ that determines rank.

Sources: the legally binding Notice of Competition C/2026/4668 and the official EPSO competition page. Where this guide summarises the notice, the official text prevails.