EPSO AD8 ICT 2026: 494 places in AI and cybersecurity

On 8 September 2026 EPSO published the notice of competition for EPSO/AD/430/26, the first AD8 selection built specifically around artificial intelligence and cybersecurity. It is one notice covering two separate fields, each with its own reference number, its own reserve list and its own field-related test. This guide reads the notice line by line: who can apply, on which qualifications, on which test, and against which cut-off.

Source throughout: the notice of competition EPSO/AD/430/26, Official Journal of the European Union C/2026/4668, published 8 September 2026.

What has EPSO opened, and how many places per field?

You apply for one field only. It is chosen at application and cannot be changed afterwards, and it determines which qualifications count, which functions the notice describes for you, and which field-related test you sit. The grade is AD8, which is not an entry grade: the notice pairs it with a seven-year minimum professional experience requirement, discussed below.

Who can apply? The four eligibility routes

The notice sets out four combinations of education and professional experience, and meeting any one of them is enough:

• 3 years of study + 7 years of relevant professional experience.
• 4 years of study, or a master's/doctorate in a relevant field, + 6 years of relevant professional experience.
• 5 years of study, or a master's/doctorate in a relevant field, + 5 years of relevant professional experience.
• 3 years of study in a different field + 9 years of professional experience.

The fourth route is the one candidates most often miss. It does not require your degree to be in AI, cybersecurity or anything adjacent — a three-year degree in any subject qualifies, provided it is backed by nine years of professional experience that is itself relevant to the field you are applying for. In practice this is the route for people who built a career in the field through work rather than through a matching diploma: two extra years of experience substitute for a specialised qualification, not for the experience requirement itself. Whichever route you use, the experience still has to be relevant to the field's functions and the field-related test still assumes AD8-level, senior professional depth — the notice is not testing entry-level knowledge in either field.

Which qualifications count for each field?

For Artificial Intelligence, the notice accepts a degree in: artificial intelligence, computational linguistics, data science, computer science/IT, electrical or electronic engineering, telecommunications, software engineering, cybersecurity, cloud computing, high-performance computing, quantum technologies, information systems, statistics, mathematics, or another discipline whose main subject matter is artificial intelligence.

For Cybersecurity, the notice lists qualifications on two levels:

• Direct qualifications: cybersecurity, information security/assurance, information security engineering, digital forensics and incident response, cryptography and key management.
• Related qualifications, accepted with demonstrated specialisation: systems architecture, software engineering, network engineering, telecommunications engineering, ICT governance, data science, artificial intelligence/machine learning, applied mathematics.

The distinction matters for the cybersecurity field: a related qualification is only accepted where you can demonstrate specialisation in security within it, not on the strength of the degree title alone.

What will you actually be doing? The functions in Annex II

For Artificial Intelligence, Annex II describes three areas of duties: the design, development, validation and management of AI solutions; AI governance, compliance and enablement; and the drafting and application of AI policy.

For Cybersecurity, Annex II describes five: risk management and security assurance; architecture, design and technology; security operations and incident response; governance, policy and coordination; and awareness, capability-building and advisory work.

These are the areas the field-related test draws from — not a generic IT syllabus, but the specific duties the notice attaches to the post you are competing for.

What is the test format, test by test?

Language 1 is one of the 24 official EU languages at C1 level or above; language 2 is a different one of the remaining 23, at B2 level or above. You can submit your candidature in any official language, but the reasoning tests are taken in L1, and the field-related test and the essay are taken in L2.

The essay is worth naming carefully: the notice describes it as a free-text piece on subjects related to the European Union, and states explicitly that it "is neither a language test nor a factual-knowledge test". Fluency and recall are not what is scored — structured, coherent argumentation is.

Why is the field-related test the one that eliminates you?

Look at the "role" column again. Verbal reasoning, numerical/abstract reasoning and the essay are each a pass/fail gate: clear the minimum and the test contributes nothing further to your position on the list. The field-related test is different on both ends. You need 15/30 to pass it — but passing is not enough. The notice also requires you to be among the best-ranked candidates on that test, with EPSO applying a cut-off around 1.5 times the number of places in the field. For Artificial Intelligence, with 240 places, that puts the practical bar somewhere near the top 360 scorers on that single 30-question test; for Cybersecurity, with 254 places, near the top 381.

This is the same mechanism behind the AD7 audit and AD7 ICT competitions, where only the field-related test is ranked and everything else is pass/fail. For AD8 AI and Cybersecurity it means the same thing: reasoning gets you to the start line, the essay keeps you on it, and 30 questions on your own specialism decide whether you make the reserve list at all.

What is NOT part of this competition

The notice contains none of the following: no situational judgement test, no assessment centre, no interview before the reserve list is drawn up, no talent screener applied to applications, and no separate digital skills test. If you have prepared for an older-format EPSO competition with extra stages, that structure does not carry over here. The selection is five remote tests, and the field-related test is the only one that ranks you.

What is known about the calendar, and what is not

What the notice fixes: the application window opens with publication on 8 September 2026 and closes on 13 October 2026 at 12:00 (noon), Brussels time. Supporting documents proving eligibility are due later, by 14 January 2027 at 12:00, Brussels time.

What the notice does not fix: test dates. As with other recent EPSO competitions, the exact schedule for the remote, supervised tests is not published in the notice — it is communicated to each candidate individually after the application phase closes. Treat the gap between the January documents deadline and your eventual test invitation as preparation time, not as a fixed countdown; EPSO has historically given candidates only a few weeks' notice once an invitation is sent.

What should you study first, depending on your profile?

• Senior specialist already meeting the 4+6 or 5+5 route, degree in field: your eligibility is the easy part. Spend most of your preparation time on the field-related test for your specialism — it is the only ranked test — and treat the reasoning tests as a gate to clear early and stop revisiting.
• Career-changer using the 3+9 route (different-field degree, nine years of experience): your eligibility does not exempt you from the content. The field-related test assumes the same senior, AD8-level depth in AI or cybersecurity regardless of which route got you into the room, so budget real study time against the Annex II functions for your field, not only against your work history.
• Strong in your field but rusty on formal reasoning: verbal and numerical/abstract reasoning are pass/fail at a modest 10/20 threshold. A short, focused refresh is usually enough — do not let reasoning drill crowd out field preparation, since reasoning cannot improve your rank once you have passed it.
• Not confident writing at length in your L2: the essay is pass/fail at 5/10 and is not a language or knowledge test, but structure and clarity in a second language still take practice. A few timed 40-minute essays on EU-related topics before the real thing is the highest-value use of limited essay preparation time.

For the fuller picture of how this ranking mechanism plays out across EPSO's specialist AD competitions, see EPSO AD7 2026: only one test decides your rank, and it is not reasoning. If you are deciding between the two AD8 fields or want the current status of preparation content for each, the EPSO AD8 AI & Cybersecurity page tracks that. And if you want a read on where your reasoning and field knowledge currently stand, try the score gap report.

PassEPSO is an independent preparation platform. It is not affiliated with, endorsed by or connected to EPSO or any European Union institution, and using it is not a guarantee of a pass or a place on the reserve list. Official information about EPSO/AD/430/26 is published only by EPSO, in the notice of competition (OJ C/2026/4668) and on eu-careers.europa.eu.