The UK’s senior cyber leadership has warned that the country is likely to face AI-enabled cyberattacks on critical infrastructure by 2028, with criminal groups and state-linked actors expected to make wider use of artificial intelligence in their operations. While the statement is a forward-looking assessment rather than a report of a specific incident, it signals how cyber risk is evolving for organisations connected to essential services, digital infrastructure and supply chains.

What happened

According to SecurityWeek, the warning comes from the UK cyber chief, who said the UK will likely face AI cyberattacks on critical infrastructure by 2028. The reported assessment links the growing cyber risk to increased use of AI by both criminals and hostile states, including China and Russia.

The source describes this as a likely future threat scenario, not a confirmed attack campaign already underway. That distinction matters for businesses: the warning should be read as strategic threat guidance rather than evidence that a new AI-driven attack wave has already materialised.

Why it matters for European businesses

For European companies, the practical significance is that AI can make cyber operations faster, cheaper and easier to scale. Attackers may use AI to improve phishing messages, automate reconnaissance, generate malicious code variations, impersonate staff more convincingly or identify weaknesses across large digital estates.

Even businesses that are not part of critical infrastructure may still be exposed indirectly. Many SMEs provide software, maintenance, logistics, cloud services, marketing technology, data processing or other support to larger organisations in regulated sectors. If threat actors target essential services, suppliers and service providers can become stepping stones or collateral victims.

This also matters because AI-enabled attacks do not only affect operational technology or industrial environments. The same techniques can be used against common business systems such as email, SaaS platforms, customer databases, websites, e-commerce stacks and collaboration tools.

For boards and management teams, the warning reinforces a broader trend: cyber risk is increasingly tied to AI adoption. As organisations deploy more AI tools internally, they need to consider not only productivity benefits but also misuse, identity abuse, data leakage and new attack surfaces.

Who may be affected

• Critical infrastructure operators and organisations supporting energy, transport, telecoms, healthcare and other essential services.
• SMEs in supply chains that provide IT, software development, managed services, industrial support or data services to larger enterprises and public-sector operators.
• E-commerce and digital businesses that depend heavily on cloud platforms, payment systems, customer accounts and web infrastructure.
• Internal IT and security teams dealing with phishing, endpoint protection, identity security and third-party risk.
• Founders and business owners who may need to review whether current cyber controls match a faster-moving threat environment.

What companies should consider

• Review phishing and identity controls: AI can improve social engineering, so stronger multi-factor authentication, email protection and staff awareness remain important.
• Assess supplier and third-party exposure: Companies should understand which partners have access to systems, data or operational environments and whether security expectations are documented.
• Strengthen detection and response: Faster attacks require faster visibility. Logging, endpoint monitoring, incident response plans and backup testing should be current and practical.
• Map critical business dependencies: Identify which digital systems, cloud services and external providers are essential to operations and what the fallback options are if they are disrupted.
• Secure AI adoption internally: If employees are using generative AI or automation tools, businesses should define what data can be shared, who can approve tools and how usage is monitored.
• Follow regulatory expectations where relevant: Businesses in regulated or essential sectors should monitor applicable cybersecurity obligations, including sector-specific rules and wider European requirements such as NIS2 where they apply.

The immediate takeaway is not that every company will face a sophisticated AI-led infrastructure attack tomorrow. It is that European businesses should expect cyber threats to become more automated, more persuasive and more scalable, and plan security investments accordingly.