The European Central Bank (ECB) has instructed the eurozone's largest banks to develop detailed plans to defend against AI-powered cyberattacks, warning that increasingly advanced AI models could dramatically increase the speed and sophistication of attacks on financial institutions. Banks have been given until October 31 to submit action plans, reflecting the ECB's growing concern that AI has become a major cybersecurity risk for the financial sector.
The ECB has asked banks to prioritize protecting internet-facing systems, strengthening cybersecurity monitoring, accelerating software patching, and improving oversight of third-party software and open-source components. Regulators also emphasized the need to modernize legacy IT infrastructure, which is often more vulnerable to AI-assisted attacks capable of identifying and exploiting weaknesses far faster than traditional methods.
Alongside the ECB, the European Systemic Risk Board (ESRB) warned that frontier AI models could pose systemic risks to the financial system. A large-scale AI-driven cyberattack could disrupt banking services, undermine public confidence, and potentially trigger broader financial instability. To help banks focus on these preparations, the ECB has postponed its annual IT Risk Questionnaire from September 2026 to February 2027.
The ECB's directive represents one of the strongest regulatory responses to AI-related cybersecurity threats so far. Unlike other central banks that have largely encouraged voluntary AI risk management, the ECB is requiring concrete action plans and closer supervision. The move signals that regulators now view AI-enabled cyber threats as an immediate operational risk requiring urgent investment in cybersecurity, resilience, and crisis response.
