EPSO is preparing one of the most senior specialist competitions of the year: AD8 IT experts in two fields — Artificial Intelligence and Cybersecurity. The EU Careers "Upcoming opportunities" page lists it plainly as IT experts, 2 fields (grade AD8 – AI, Cybersecurity) – September 2026. This guide explains what that means, what to expect, and — most importantly — what to do now, while the competition is still on the horizon.

Read this first: the competition is planned, not published

As of today the Notice of Competition (NoC) — the only legally binding document — has not been released. Until it does, the exact test format, the number of reserve-list places, the precise eligibility rules, and the field syllabus (Annex II) are all unconfirmed. Everything below that is not the literal EU Careers line above is inference from the closest recent precedents, chiefly the 2026 AD7 ICT competition (EPSO/AD/429/26) and the 2022 AD8 ICT Security round (EPSO/AD/398/22).

The single highest-value action you can take today costs nothing: create an EU Careers / EPSO account and switch on notifications for this selection, so the notice lands in your inbox the day it publishes (expected September 2026). When it drops, re-verify every number in this article against it.

1. Who it is for — AD8 eligibility

AD8 is a senior administrator grade. Unlike entry-level AD5 or mid-level AD7, it targets deep specialists with a substantial professional track record. The confirmed AD7 ICT 2026 rules give the clearest baseline; expect the AD8 notice to be similar in structure but with more required experience.

Working assumptions (confirm against the notice):

• EU nationality with full citizen rights.
• Language 1 at C1 plus Language 2 at B2, likely from any of the 24 official EU languages.
• A relevant degree (computer science, informatics, ICT, engineering, mathematics/statistics, data science, or — for AI — related quantitative fields) plus senior experience — expect thresholds a couple of years above AD7's 5–7 years.
• Two fields, apply to one: AI or Cybersecurity, not both.

Eligibility is checked strictly. In the AD8 ICT Security precedent, 375 applied but only 289 cleared the eligibility check — roughly 23% filtered out before a single test. Read Section 3 and Annex I/II line by line the moment the notice is out.

2. The format — and the one insight that decides everything

EPSO's current post-reform model — used by both 2026 AD7 IT competitions — runs three blocks online, webcam-proctored, typically on a single day. There is no assessment centre and no interview. Best-estimate structure:

Here is the insight most candidates miss: reasoning is a gate, not a score. Numerical and abstract share a combined 10/20, so a strong abstract score can rescue a weak numerical one. Those points do not count toward your rank — you clear the gate or you're out. The FRMCQ decides everything: it is both the pass gate and the only test that ranks you, and only roughly the top 1.5× the number of places gets the essay scored. The EUFTE is a final filter — fail it and you're removed, but it won't lift you up the list.

Consequence for your prep: reasoning and the essay are things you must not fail; the FRMCQ is the thing you must win.

Reasoning: build the habit now

The reasoning gate rewards speed under a timer, not perfection. Twenty minutes a day of mixed verbal, numerical and abstract practice comfortably clears it — and abstract reasoning improves fastest with reps. Our exam simulator runs full timed sets under real conditions.

There's a good chance the reasoning block runs on SHL's Verify G+ engine, as several EPSO-adjacent AD7 selections do (confirm against the notice). G+ blends numerical, inductive and deductive items into one hard-timed flow where the winning skill is fast triage. It's excellent conditioning either way — see our SHL Verify G+ preparation guide and practise it directly via the SHL G+ mock.

3. AI & Cybersecurity — what the FRMCQ will test

The field MCQ tests precise knowledge — "what does this regulation actually say," "which control applies here" — not general familiarity. Prepare across three layers: EU digital regulation, field-specific technical depth, and EU institutional context.

Common ground (both fields): read the primary texts at the level of what they say — the AI Act (Regulation (EU) 2024/1689), GDPR (2016/679), the NIS2 Directive (2022/2555), the Cyber Resilience Act and the Cybersecurity Act (a revised version was proposed on 20 January 2026), plus the Data Act and Data Governance Act. Know the EU bodies: ENISA, the European AI Office, DG DIGIT, CERT-EU, JRC.

Field — Artificial Intelligence: ML/DL fundamentals and evaluation; generative AI and LLMs (transformers, fine-tuning vs RAG, general-purpose models and their AI Act obligations); MLOps and the model lifecycle; trustworthy AI (transparency, human oversight, conformity assessment); and AI-specific security threats (data poisoning, adversarial examples, model inversion, prompt injection).

Field — Cybersecurity: security fundamentals (CIA triad, zero trust, cryptography, PKI); network, cloud and DevSecOps security; identity and access management; threats and SOC operations (SIEM, incident response, threat intelligence, CVSS); GRC (ISO/IEC 27001, NIST CSF); and EU cyber regulation applied — NIS2 measures and reporting timelines, CRA product-security requirements, and EU certification schemes.

When the notice publishes, its Annex II duty list is your exact syllabus. Read the named regulations in the original, not summaries — the FRMCQ rewards people who know the specific article, threshold or timeline.

4. A preparation plan that starts today

Because the notice isn't out, split your prep into "start now" and "after the notice."

Start now:

• Reasoning: 20–30 min/day of mixed, timed practice on the simulator, including a few full G+-style runs to fix your pacing.
• Domain foundation: read the primary regulatory texts for your field and build a personal cheat-sheet of risk tiers, obligations, thresholds, reporting timelines and who's who among EU bodies.
• Written-test muscle: practise a tight, structured 40-minute argument from source documents — clarity and structure over eloquence. Our EUFTE guide walks through the anchors and method.

After the notice: read it end to end, confirm the real structure and pass marks, map Annex II to study blocks, then drill FRMCQ-style questions in your field and run two or three full timed simulations before test day.

5. After the tests — the reserve list

Passing does not mean a job. Success puts you on a reserve list valid for years (the 2022 AD8 ICT Security list runs to 31 December 2027). EU institutions and agencies — the Commission/DG DIGIT, the AI Office, ENISA, CERT-EU, Parliament, Council — search that list and invite matching profiles to targeted recruitment interviews run by the recruiting service, not EPSO, usually in English and/or French. A strong FRMCQ score both ranks you higher and makes you more visible once you're on it. In the meantime, our EU jobs board and job watch alerts track live openings.

The bottom line

The AD8 AI/Cybersecurity competition is a senior specialist selection where the reasoning tests are pass/fail, the field MCQ ranks you, and the essay is a final filter. The win condition is mastery of your field's EU regulation and technical depth. You don't need the notice to start: enable your EPSO alerts, begin daily reasoning practice, and start reading the AI Act, NIS2 and GDPR today. For the closest live precedents, see our breakdowns of the AD7 ICT and AD7 Audit competitions.

This guide is based on official EU Careers listings and the closest recent precedents. The Notice of Competition, when published, overrides anything here. Try a free practice session to see where you stand.