EPSO AD8: AI or Cybersecurity?

EPSO published the notice for EPSO/AD/430/26 on 8 September 2026, and the EPSO AD8 competition for administrators in artificial intelligence and cybersecurity is now open. Applications close on 13 October 2026 at midday, Brussels time. Before any of the preparation advice matters, the notice asks you for one irreversible decision: you may apply for one field only.

Most candidates make that choice in about ninety seconds, on instinct, from a job title. It deserves rather more, because in this EPSO AD8 competition the field you tick controls the only test that ranks you, the eligibility list your diploma is measured against, and — on the evidence of the last comparable EPSO round — your odds by a factor of roughly six.

What the EPSO AD8 competition puts on the table

These figures come from the notice itself, published in the Official Journal as C/2026/4668. They are not projections.

494 places makes this one of the larger specialist competitions EPSO has run. For scale: the 2026 audit competition sought 448 across a single field, and the AD 7 IT competition sought between 166 and 228 in each of its four. Each of the two EPSO AD8 fields is, on its own, a bigger intake than any single field of that IT competition.

The rest of the frame is common to both fields. The grade is AD 8, which on the salary scale currently in force starts at €8,911.48 a month in basic pay before allowances — the senior-specialist entry grade, explained alongside the others in our guide to the EU grade ladder. The posts are in Brussels, Luxembourg and Strasbourg. Your identity document is due with the application on 13 October; your supporting documents are not due until 14 January 2027, a gap that regularly catches people out in both directions.

One field, one shot: what the choice actually controls

The notice makes the restriction plain — "This notice of competition covers two fields. A candidate may only apply for one of them." Three consequences follow, and only the first is obvious.

It chooses your syllabus. The field-related multiple-choice test is specific to the field you picked: 30 questions, 40 minutes, pass mark 15 out of 30. Its content is mapped by the duties in Annex II of the notice for your field, and those two annexes have almost nothing in common.

It chooses the only test that ranks you. This is the point most candidates miss. The verbal, numerical and abstract reasoning tests are pass/fail gates. The EUFTE essay on EU matters is a pass/fail gate. Only the field-related MCQ produces a score that is ranked, and that ranking is what builds the reserve list. Your entire competitive position rests on 30 questions drawn from the field you chose in October.

It chooses the standard your diploma is judged against. The two fields publish different lists of acceptable degree areas. A degree that is unambiguously relevant in one field may fall into the "other area" category in the other — which raises the experience requirement from seven years to nine.

The eligibility gate: identical scale, different lists

Here is a finding worth stating plainly, because the guesswork before publication got it wrong. The EPSO AD8 competition asks for exactly the same experience as the AD 7 IT competition run earlier this year, despite being a grade higher:

The scale is the same in both fields, and the experience must have been acquired after the date of the final decision to award the diploma. What differs between the two EPSO AD8 fields is the list of areas that counts as "listed" — and that list is where the field choice can quietly cost you two extra years.

Field 1 — artificial intelligence

AI accepts fifteen degree areas: AI itself, computational linguistics, data science, computer science or IT, electrical or electronics engineering, telecommunications, software engineering, cybersecurity or information security, cloud computing, high-performance computing, quantum technologies, information systems, statistics, mathematics — and then a catch-all for any other discipline with a study focus on AI. To use the catch-all you must evidence the focus with one of three things: a formally recognised AI specialisation named on your diploma or transcript, AI coursework worth at least 30 ECTS, or an academic thesis on AI.

That catch-all is unusually generous. An economist, a physicist or a linguist whose thesis was on machine learning is inside the AI gate on the strength of the thesis alone.

Field 2 — cybersecurity

Cybersecurity is structured in three tiers rather than one list. Four areas qualify outright: cybersecurity, information security or information assurance; information security or cybersecurity engineering; digital forensics and incident response; cryptography and key management. Sixteen further areas qualify provided the studies included a focus on ICT security — a range that runs from software engineering and network engineering through to IT audit, risk management and project management. A third tier covers data science, AI and machine learning, applied mathematics and statistics, again conditional on a focus in security, cryptography, risk analysis or security analytics.

The evidence rules for "focus" are the same three as in AI — a named track, 30 ECTS, or a thesis — plus a fourth the AI field does not offer: a peer-reviewed article in a journal or conference proceedings related to cybersecurity, published during your studies, with you as author or co-author.

Read those two gates side by side before you tick a box. A data-science graduate qualifies unconditionally for AI but only conditionally for cybersecurity. A network engineer qualifies conditionally for cybersecurity and, in the AI field, has a listed telecommunications or software-engineering degree that qualifies unconditionally. The gates are not symmetric, and the notice is the only place that settles it.

What the two jobs actually are

Annex II of the notice is the closest thing to a syllabus you will get, because the field MCQ is built from it. The two annexes describe genuinely different careers.

Two observations that matter for the choice. The AI field is a third policy — one of its three duty categories is explicitly about policymaking and enforcement, which is a career in Brussels rather than a career in a data centre. The cybersecurity field is broader technically but more operational, and its governance category rewards people who have run programmes rather than only built systems.

What the last EPSO round says about the odds

Places sought is only one half of a ratio. The other half — how many people apply to each field — is not published until months after the deadline, so nobody can tell you today which EPSO AD8 field will be the softer entry. What the previous round can tell you is how much the answer varies, and the answer is: a great deal.

Places sought are from the notices of competition. The application counts come from the per-nationality graphs EPSO published on 1 September 2026; EPSO did not publish field totals, so these are our own sums of the bars in those graphs. Treat them as close, not exact.

Within one competition, run on one day, under one set of rules, the ratio ran from roughly three applications per place to roughly nineteen. Candidates in clouds and networks faced a competition six times gentler than candidates in ICT project management — and nothing about their preparation caused that. It was the box they ticked.

So the honest conclusion is uncomfortable: the single largest factor in your result may be something you cannot observe when you have to decide. That is an argument for humility about field-picking strategy, not for cleverness. Which leads to the rule that does work.

The rule that beats guessing

Pick the field where your documented experience is strongest, not the field that looks less crowded. Three reasons, all of them mechanical rather than motivational.

The first is that experience is checked, not declared. The eligibility check verifies your declarations against the documents you upload by 14 January 2027, and the experience must be relevant to the field you chose. Experience that is a stretch in your chosen field is not merely weak — it can be disallowed, and disallowed experience can take you below the seven-, six-, five- or nine-year threshold entirely. A candidate who ranks well and then fails the eligibility check gets nothing.

The second is the 30-question test. It is drawn from the duties of your field, and 40 minutes is not enough time to reason your way to answers you do not already know. Deep familiarity is worth more here than any estimate of crowding.

The third is that the ranking cut is tighter than the headline number suggests. EPSO scores the EUFTE essay and runs the eligibility check only for candidates taken in descending order of the field-MCQ ranking, in principle for no more than 1.5 times the number of places sought. That is about 360 candidates in AI and about 381 in cybersecurity. Everyone below that line stops there — their essay is never read and their eligibility is never checked, whatever else they did.

The other decision on the form: your two languages

The EPSO AD8 competition lets you choose any two of the 24 official EU languages — a thorough knowledge (C1) of language 1 and a satisfactory knowledge (B2) of language 2. There is no restriction to English, French or German, and there is no advantage in nominating a language you are not comfortable in.

What matters is which test runs in which language, and it is the opposite of most people's assumption:

Your technical test and your essay are both sat in your second language. If you have spent a career reading security or AI literature in English while your mother tongue is something else, English is very likely your language 2 for this competition, whatever your passport says. Read the two annexes in the language you intend to nominate before you commit on the form.

What to do in the five weeks

Applications close on 13 October. In practical order:

• Read Annex II for both fields before ticking either. It takes twenty minutes and it is the only document that describes what you would actually be tested on.
• Map your degree against both area lists in section 3.3. If you land in the "other area" bucket, check whether nine years of experience since graduation is a threshold you actually clear.
• Assemble the evidence now, not in January. Employment certificates with exact dates, contracts, diplomas with the date of the final award decision. The eligibility check happens against documents, and by then the field is fixed.
• Practise the reasoning tests. They are the same in both fields, they are the first thing scored, and failing them means the field test you prepared for is never even marked.

For the competition end-to-end — the timeline, the pass marks, how the reserve list is built — see our full guide to EPSO/AD/430/26. For how a fully remote, proctored EPSO test day actually runs, see the test-day guide. And for the structure this competition inherits, our guide to the AD 7 IT competition covers the same machinery one grade down.

Frequently asked questions

Whichever way you go, verify every figure here against the official notice — EPSO/AD/430/26, OJ C/2026/4668 — before you rely on it. It is the only text that binds.