In a letter to a Member of the European Parliament, European Central Bank Banking Supervision said risks from advanced artificial intelligence are a key part of its supervisory priorities for 2026-28, with a particular focus on cyber and operational resilience. It warned that new large-scale AI models with stronger cybersecurity capabilities could help identify and exploit IT vulnerabilities faster and at lower cost, increasing the risk of systemic cyber incidents affecting financial institutions. It also said the ECB is monitoring broader financial stability risks from rapid AI adoption across the financial sector, especially where many firms depend on the same models, data, cloud infrastructure or third-party providers. The ECB said it has collected information on banks' AI strategies and use cases, held supervisory dialogues on governance and risk management, and used tools including the 2024 cyber resilience stress test, on-site inspections, threat-led penetration tests and oversight of critical third-party providers to identify weaknesses. It is following up through supervisory engagement and guidance, and on 26 May 2026 hosted an industry event to raise awareness, share practices and discuss focus areas. Banks are being encouraged to test a scenario based on AI-driven cyber threats prepared by the EU Systemic Cyber Incident Coordination Framework to identify preparedness gaps. The ECB also pointed to the Digital Operational Resilience Act as the core regulatory framework for strengthening IT, cyber risk management and supply-chain oversight, and said it is working with European and international bodies including the European Banking Authority, the European Artificial Intelligence Board, the G7 Cyber Expert Group and the Financial Stability Board. From a macroprudential perspective, it added that authorities so far do not view existing macroprudential tools as the most adequate response to cyber risk, although monitoring of systemic AI-related risks is continuing.
European Central Bank - Banking Supervision2026-06-25
European Central Bank Banking Supervision flags AI-driven cyber and concentration risks as a 2026-28 supervisory priority
In a letter to an MEP, European Central Bank Banking Supervision said AI-related cyber and operational risks are a supervisory priority for 2026-28 and warned that advanced AI could increase the likelihood of systemic cyber incidents. It is reviewing banks' AI use and controls, following up on weaknesses through supervision, and urging banks to test AI-driven cyber scenarios. The ECB also said it is monitoring wider financial stability risks from concentrated reliance on common AI tools and technology providers.