ECB urges banks to prepare for AI cyber threats
Major eurozone banks must prepare action plans to address evolving cybersecurity risks linked to increasingly capable AI models.
The European Central Bank has called on major euro area banks to prepare action plans to address AI-enabled cybersecurity threats.
In a letter to bank CEOs, ECB Banking Supervision said emerging AI models can identify software vulnerabilities and generate functioning exploits at unprecedented speed.
The ECB warned that AI is compressing the time between vulnerability discovery and exploitation, with potentially serious implications for the confidentiality, integrity and resilience of banks’ ICT systems.
The central bank said the change is a long-term shift in the threat landscape, not a temporary risk linked to a single tool.
Banks have been asked to submit action plans to their Joint Supervisory Teams by 31 October 2026.
The plans should set out concrete measures, resources, roles, responsibilities and implementation timelines for strengthening cyber resilience.
Short-term priorities include faster vulnerability and patch management, stronger monitoring and detection, AI-enabled defensive capabilities and updated third-party risk management.
The ECB also called for structural measures such as defence-in-depth, improved cyber hygiene, infrastructure modernisation, crisis management, recovery arrangements and information-sharing.
The letter follows a European Systemic Risk Board warning about systemic cyber risks posed by frontier AI models.
ECB Banking Supervision also said it will address cybersecurity risks linked to quantum computing in a separate letter.
Why does it matter?
The ECB letter turns AI-enabled cyber risk into a concrete supervisory issue for major euro area banks. If AI accelerates vulnerability discovery and exploit generation, banks will face shorter windows for patching, detection and response. The focus on third-party providers and supply chains is also important because financial institutions depend heavily on external ICT services. The ECB’s approach links AI cyber threats with DORA-style operational resilience, showing that advanced AI is now part of mainstream financial supervision.
Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our chatbot!