European Central Bank Banking Supervision Board member Sharon Donnery outlined supervisory expectations for artificial intelligence and cyber risk in an interview, emphasizing that boards and senior management remain accountable for AI-enabled decisions. Banks must understand where AI is used, the risks it creates and the controls applied, while maintaining strong governance, operational resilience and risk management. Following a recent letter to all bank CEOs, banks must submit action plans by October 2026 covering cyber resilience, incident response and oversight of critical third-party providers. Donnery also discussed the ECB’s increasingly forward-looking approach to geopolitical risk. Its 2026 reverse stress test requires banks to identify combinations of geopolitical events that could seriously challenge their resilience, assess the effects on their businesses and demonstrate their responses. The ECB plans to publish the exercise’s outcome and is simplifying supervision to focus more closely on material bank-specific risks without lowering prudential standards.
European Central Bank - Banking Supervision2026-07-28
European Central Bank Banking Supervision requires cyber action plans by October, reinforces AI accountability
European Central Bank Banking Supervision expects bank boards and senior management to remain accountable for AI use and associated risks. Banks must submit cyber action plans by October 2026 addressing resilience, incident response and critical third-party oversight. The ECB also plans to publish the outcome of its 2026 geopolitical reverse stress test.