On the occasion of the 2026 European Cybersecurity Month (ECSM), the European Data Protection Supervisor (EDPS) emphasized the dual nature of the human factor, considering it both as the main vulnerability and as an essential safeguard.

The EDPS recalls that human error is the most frequent cause of personal data breaches reported by the EU institutions, bodies and agencies (EU IBAs), a trend worsened by techniques such as phishing and social engineering, now amplified by artificial intelligence. At the same time, in the context of automated decisions, the EDPS nuances the idea that human intervention constitutes a sufficient safeguard, warning about the risks of automation bias where an operator places excessive trust in the system. To address this issue, the EDPS published a technical document on human oversight in September 2025, followed in May 2026 by a checklist intended for EU IBAs to assess the maturity of their supervision measures.

The EDPS also made recommendations in several opinions, notably a joint opinion with the European Data Protection Board (EDPB) on proposals related to a Cybersecurity Act 2 and the Directive on Security of Network and Information Systems (NIS 2), advocating mandatory cybersecurity training for staff and management. This requirement is already present in the Cybersecurity Regulation 2023/2841 for EU IBAs. Furthermore, the EDPS recommended extending the European cybersecurity skills framework to all employees and has implemented cybersecurity incident simulation exercises for EU IBA staff.