ECB orders banks to submit AI cybersecurity plans by October

The ECB on Tuesday directed eurozone banks to draw up plans countering AI-driven cyber threats, with submissions due by Oct. 31, according to Reuters.reuters
The directive cites risks from frontier AI models like Anthropic's Mythos and urges banks to modernize aging infrastructure, fix vulnerabilities faster and tighten third-party oversight.marketscreener+1
The European Systemic Risk Board issued a parallel warning that large-scale cyber disruptions could trigger bank runs and erode financial system confidence.marketscreener

The European Central Bank on Tuesday directed eurozone banks to draw up plans within four months to defend against cyber threats enabled by advanced artificial intelligence models, warning that such risks could undermine confidence in the financial system and disrupt payments.

A New Supervisory Mandate

In a letter sent to bank chief executives, the ECB cited concerns about frontier AI models — specifically referencing Anthropic's Mythos — whose cyber capabilities have become powerful enough that access to some of them has been restricted, a limitation that currently excludes eurozone banks. Banks have until October 31 to submit their plans.marketscreener+1

"These developments have potentially profound implications for the confidentiality, integrity and resilience of banks' information and communication technology systems," the ECB said in the letter, as reported by Reuters Thomson Reuters Corporation .reuters

The directive tells banks to prioritize protecting internet-facing systems and other exposed technology assets, including third-party software and open-source components, while accelerating vulnerability fixes and strengthening monitoring. Lenders are also urged to modernize aging technology infrastructure, improve cyber hygiene, and bolster crisis-management and information-sharing arrangements.marketscreener

Systemic Risk Warnings

The European Systemic Risk Board issued a parallel warning alongside the ECB's letter, declaring that large-scale cyber disruptions could erode trust in financial institutions and even trigger runs on companies or countries perceived as less secure. "The ESRB considers these developments to be a source of systemic risks to the financial system," it said.marketscreener

The ESRB outlined scenarios ranging from a gradual loss of confidence in smaller banks to state-backed espionage and coordinated attacks on payments, clearing, and settlement systems, potentially amplified by misinformation campaigns.marketscreener

Months of Escalation

Tuesday's order follows weeks of escalating regulatory concern. In May, ECB board member Frank Elderson called on banks to prepare urgently for AI-assisted cyberattacks, and the ECB summoned lenders to an emergency meeting later that month to discuss vulnerabilities exposed by new AI models. Elderson subsequently announced the ECB would send a "dear CEO letter" demanding proactive security measures. ECB President Christine Lagarde has separately cautioned that AI could potentially trigger a financial crisis.fstech+5

To free up resources for the effort, the ECB said it has postponed a separate IT survey and may adjust inspections and other supervisory work.reuters

Sources (25)