The EU is drafting its next action plan on Women, Peace and Security, and technology will inevitably be part of it. The review of 122 national and regional action plans conducted by the Gender in Geopolitics Institute shows how that usually goes: technology is named as a threat, answered with awareness campaigns and never regulated. The EU can do better.

Technology has entered Women, Peace and Security (WPS) national action plans (NAP) fast: before 2018, none treated it as a security issue, but since 2025, 77 per cent do. Yet naming is not acting. Cybersecurity appears in 24 plans, but only 13 take concrete measures. Hybrid threats are mentioned in the plans of Croatia, Finland, Romania, Serbia and NATO, but no country acts on them. Not one technology measure has a target, a baseline or a budget. WPS plans have discovered technology, but they treat it as a danger to women that awareness campaigns can manage. They do not treat it as a power to be governed.

The EU’s own 2019-2024 plan said nothing about technology. The challenge for the next one will be to act on it through the EU’s external action: bring technology into the EEAS’s security work with a gender perspective, ensure women’s participation in technology-related decisions and protect women and girls from its harms.

Women are mentioned as victims to be protected far more often than they are put into decision rooms. Out of the 122 plans analysed, only 27 intend to protect women from online violence or cybercrime, six commit to include them in cyber and technology decisions and only one – the one of the UK – measures whether it happens or not. Kenya goes further, setting gender quotas for cyber governance bodies. According to the European Commission, women represent only 7 per cent of the cybersecurity workforce in Europe, “limiting the diversity of expertise shaping threat assessments, technical standards, AI governance and counter-misinformation strategies”, as Loredana Teodorescu explains. The first trap for the EU’s future plan to avoid is to treat technology as a ‘protection’ issue alone. The plan should connect to the EEAS’ cyber, hybrid-threat and disinformation work, and include women in those decision-making rooms. The women who are actually in those decision-making rooms, such as the African Union Commission’s special envoy on WPS, Liberata Mulamula, call for integrating measures against AI- and technology-facilitated violence into WPS NAPs and early warning systems. The EU’s next plan should answer that call.

The fast-paced development of tech, while widely acknowledged as systematically hurting women and girls, is still massively provided to the public without preventive regulation – and most of the time, never regulated as thoroughly as it should. Sexual violence is filmed and shared, and once online, the images can resurface years after the end of a conflict, extending the harm for survivors. Such images may also be generated through generative AI to feed propaganda efforts. Yet, only Argentina’s NAP commits to studying how cyber incidents in armed conflict affect women and men differently.

But the threat is not restricted to sexual violence. Algorithmic biases, AI-assisted targeting and mass surveillance shape who is harmed in war. Sexist stereotypes spread fast online, and in wartime they foment hatred, dehumanisation, sexual violence and radicalisation. Fighters and warring groups exploit these dynamics. Only Luxembourg asks for a gender perspective on military AI. Encryption is a precondition for women’s safety: it protects women seeking sexual and reproductive healthcare where it is restricted, and survivors and investigators gathering evidence for justice. Their records, too, are targets as cyberattacks proliferate through cyberwars.

Advocating for tech-facilitated gender-based violence to be systematically included in NAPs, and not barely mentioned, is long overdue. As with the very few NAPs that go beyond condemning the use of tech-facilitated gender-based violence, the next EU plan can be the first to act on technology, not just name it as a threat to women and girls. Therefore, three commitments are necessary:

Regarding governance, the EEAS’s cyber, hybrid-threat and disinformation work needs to be brought into the plan, with a team accountable for the results; and AI and technology-facilitated gender-based violence need to be integrated into the plan and into EU-supported early-warning systems; and a gender analysis needs to be applied to EU cyber diplomacy and military AI.

Regarding participation, women need to be in the rooms where cyber decisions are made, from EU delegations to cyber negotiations to EU-funded capacity-building; and significant participation needs to be ensured.

Regarding protection, secure communication tools for women’s organisations and sexual and reproductive health services in partner countries need to be funded; and every EU-funded project that collects or monitors personal data needs to pass a human-rights and data-protection assessment before it is funded; and the tech sector needs to be included in the fight against technology-facilitated gender-based violence, online misogyny, masculinist radicalisation, sexual-abuse content and cyber-harassment, through safety-by-design settings and support to smaller technical initiatives.

Those objectives should present detailed actions, indicators and budget, building on the previous plan’s framework applied to other WPS-related issues. Institutions should present a unified front, as the EU is standing strong, promoting its regulations in tech sectors to guarantee its citizens’ fundamental digital rights. Such efforts should also extend to the EU’s external action.

Photo credits: nininika / Shutterstock.com