The governance of digital convergence: cybersecurity maturity and AI readiness in the European Union
TL;DR
The results indicate that the nexus between cybersecurity maturity and AI readiness remains statistically stable despite the 2025 GARI recalibration, and that AI readiness is most strongly associated with operational cybersecurity dimensions, specifically capacity development and cooperation, rather than formal legal preparedness.
Abstract
This study aims to investigate the structural alignment between national cybersecurity maturity and government artificial intelligence (AI) readiness across the EU-27. It specifically examines how the statistical relationship between these domains shifts following the 2025 methodological recalibration of the government AI readiness index (GARI), exploring what these changes reveal about the transition from foundational digital strategy to implementation-oriented governance within the European digital regulatory framework. The research uses a comparative quantitative design, integrating the global cybersecurity index (GCI, 2024) with the GARI 2024 and GARI 2025 datasets. The analysis uses Pearson and Spearman correlations, Steiger’s test for comparing dependent overlapping correlations and a two-stage clustering procedure, incorporating hierarchical Ward’s linkage followed by k-means classification, to assess typological stability and national governance profiles. The results indicate that the nexus between cybersecurity maturity and AI readiness remains statistically stable despite the 2025 GARI recalibration. However, pillar-level decomposition reveals that AI readiness is most strongly associated with operational cybersecurity dimensions, specifically capacity development and cooperation, rather than formal legal preparedness. The transition to an implementation-centric framework in 2025 exposes a significant implementation gap among member states, where high structural security scores do not coincide with operational AI resilience or public-sector adoption. This paper contributes new empirical evidence to the debate on digital benchmarking by demonstrating how the recalibration of composite indicators serves as a diagnostic instrument for identifying structural gaps between strategic preparedness and operational capacity. It offers a novel comparative framework for understanding the coevolution of cybersecurity and AI governance as a unified institutional capability within the EU Digital Single Market.