EU Governance of Critical Infrastructure: Resilience and Artificial Intelligence as Policy Challenges

European critical infrastructure governance is undergoing two intertwined transformations: a shift from protecting designated assets towards resilience, and the growing integration of artificial intelligence (AI). This article examines how these transformations have unfolded and interacted within EU governance. It develops a socio-technical framework combining path dependence and bounded agency and applies interpretive document analysis to developments from the mid-2000s to the mid-2020s across three governance pathways: regulation, research and innovation (R&I) policy, and standardisation. The analysis finds an incremental and uneven reconfiguration, not comprehensive system redesign. Resilience has become an integrative objective across physical and digital critical infrastructure, while AI functions both as a resilience capability and as an object of governance. Regulation provided the authoritative core, R&I supported earlier experimentation and policy development, whereas standardisation remained less developed in translating shared objectives into operational guidance. Together, these developments point to an emerging, provisionally stabilised, boundary-spanning EU critical infrastructure policy regime.