Europe’s three financial supervisory authorities have called for stronger governance, enhanced operational resilience and a more consistent supervisory approach to protect the European Union’s financial sector from the growing cyber risks posed by advanced artificial intelligence models.

In a joint statement, the European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA) and the European Securities and Markets Authority (ESMA) said the rapid development of frontier AI models is creating new information and communication technology (ICT) risks that require financial institutions and supervisors to act quickly.

The authorities said the statement builds on the existing EU regulatory framework, the European Commission’s Action Plan on Cybersecurity and Artificial Intelligence, as well as recent work by the European Systemic Risk Board (ESRB), the European Union Agency for Cybersecurity (ENISA), the Single Supervisory Mechanism (SSM) and other competent authorities.

According to the three authorities, the objective is to promote a cross-sectoral, risk-based and consistent supervisory approach while helping financial entities strengthen their operational resilience against cyber threats linked to frontier AI technologies.

The statement places particular emphasis on the prevention, detection and management of cyber risks and underlines the importance of robust governance and risk management frameworks capable of identifying, managing and mitigating AI-related threats.

The authorities also provided an update on ongoing and planned oversight activities under the Digital Operational Resilience Act (DORA) involving critical ICT third-party providers, saying these activities will increasingly address risks associated with frontier AI models.

The EBA, EIOPA and ESMA encouraged both financial institutions and national supervisors to use the statement as the basis for supervisory discussions while taking existing supervisory expectations into account.

They said this approach would help ensure that the EU financial system remains resilient as risks associated with frontier AI technologies continue to evolve.

The authorities warned that the advanced capabilities of recent frontier AI models are significantly accelerating cyber risks, increasing the urgency of strengthening cybersecurity defences and improving incident response capabilities.

According to the statement, AI-enabled cyber tools could create systemic risks because they can rapidly discover and exploit vulnerabilities, target weaknesses in shared infrastructure and take advantage of single points of failure affecting multiple organisations.

The statement also acknowledged that these same technologies can strengthen cyber defences.

However, the authorities cautioned that while defenders must deploy security responses through carefully validated procedures, malicious actors may exploit frontier AI capabilities much more rapidly.

The watchdogs referred to the European Commission’s Action Plan on Cybersecurity and Artificial Intelligence, published on July 7, which aims to reinforce cybersecurity and resilience across the European Union.

They also cited recent warnings from the ESRB, which said the misuse of highly capable AI models could have a substantial impact on the financial system.

The authorities warned that if AI-related disruptions persist for several days or affect multiple institutions simultaneously, the consequences could spread beyond individual firms to the wider financial system and the broader economy.

The statement also referred to ENISA’s recently published recommendations aimed at strengthening the operational capabilities of organisations facing AI-related cyber threats.

The supervisory authorities said discussions with financial institutions are already placing greater emphasis on these risks and on the measures firms have introduced to safeguard operational resilience.

They also pointed to recent supervisory action by the European Central Bank (ECB), which urged the chief executives of significant banking institutions to address without delay outstanding supervisory findings relating to ICT risks and cybersecurity weaknesses identified through previous inspections, targeted reviews and the 2024 cyber resilience stress test.

According to the statement, unresolved weaknesses are becoming increasingly significant as the cyber threat landscape evolves, and other competent authorities may adopt similar supervisory expectations.

The three European authorities said their mandate includes promoting supervisory convergence and coordination across the EU.

Against that backdrop, they said the statement is intended to provide practical context for the current risk environment while remaining fully consistent with existing legislation, supervisory expectations and the objectives of the European Commission’s action plan.

The authorities said the current EU regulatory framework, particularly DORA and the AI Act, already provides a solid foundation for addressing risks associated with highly capable AI models.

They explained that DORA establishes requirements covering ICT risk management, resilience testing, incident management, recovery planning and third-party ICT risk management.

Meanwhile, the AI Act introduces additional obligations for providers of general-purpose AI models with systemic risk, including transparency requirements, technical documentation and cybersecurity measures.

Although the EU’s regulatory framework remains technology neutral, the authorities warned that frontier AI has dramatically shortened the time available to identify and respond to cyber vulnerabilities.

As a result, they urged financial institutions to act proactively by strengthening cybersecurity capabilities and adapting existing safeguards to the new threat environment.

The statement added that all measures should be implemented proportionately, taking into account each institution’s size, risk profile and the scale and complexity of its activities.

To strengthen resilience and promote a level playing field across the EU, the authorities encouraged financial institutions to update ICT risk management processes, procedures and controls by focusing on prevention, detection and cyber risk management.

They said effective prevention depends on maintaining continuously updated inventories of IT assets, including infrastructure, applications, data repositories, application programming interfaces and AI or machine learning components, allowing firms to classify assets according to their importance and exposure.

The authorities also stressed the importance of secure-by-design principles, continuous monitoring, proactive software patching and assessing dependencies between IT systems when prioritising preventive measures.

On detection, they said existing vulnerability identification processes should become both faster and more sophisticated to keep pace with AI-assisted cyber threats.

The statement added that organisations should move from periodic monitoring to continuous surveillance while enhancing security operations centres and red team exercises with AI-based tools alongside existing technical capabilities and staff expertise.

On cyber risk management, the authorities called for stronger operational resilience testing, improved disaster recovery arrangements, enhanced data backup capabilities and higher levels of cyber maturity.

They also said governance structures, testing methodologies and business continuity planning should evolve to reflect AI-assisted threats and the possibility of failures affecting multiple systems simultaneously.

The watchdogs further urged competent authorities to ensure that management bodies remain fully committed to addressing frontier AI-related cyber risks through clear governance structures, defined accountability, timely response plans and sufficient investment in cyber resilience.

They added that institutions should review their risk appetite frameworks to incorporate updated metrics, tolerance thresholds and control measures reflecting both internal use of AI models and indirect exposure to them.

The statement stressed that financial entities should establish governance structures supporting the effective management of frontier AI risks without delay while closely monitoring developments.

At the same time, the authorities rejected a one-size-fits-all approach, saying institutions should tailor mitigation strategies according to their size, interconnectedness, risk profile and operational complexity, in line with Article 4 of DORA.

Looking ahead, the EBA, EIOPA and ESMA said they will continue working with national supervisors to maintain a proportionate, forward-looking and risk-based supervisory approach as AI technologies continue to evolve.

The authorities also revealed that, acting as Lead Overseers, they have already begun targeted engagement with relevant critical ICT third-party providers to examine how those companies identify, assess and manage AI-related risks while adapting to new technological capabilities.

They said the findings have already informed the annual risk assessment cycle and the prioritisation of activities under the 2027 Oversight Plan.

What is more, the authorities said they have started incorporating AI-related risks into their Oversight Examination Methodology and will continue expanding this work throughout 2027.

They added that AI-related threats are also expected to feature more prominently in oversight examinations and other supervisory activities during 2027 to assess whether critical ICT third-party providers are sufficiently prepared for an increasingly AI-enabled cyber threat environment.