The eurozone’s top banking supervisor, the ECB, on Tuesday told major European banks to draw up action plans to address cybersecurity risks posed by increasingly powerful artificial intelligence systems.
The emergence of AI models such as Anthropic’s Mythos, which is particularly effective at identifying weaknesses in computer systems, has raised concerns among European governments and policymakers.
The ECB’s supervisory board sent a letter to the 110 banks it directly supervises, arguing that the latest AI models represent a “long-term shift in the threat landscape rather than a temporary phenomenon”.
“While these developments do not introduce entirely new risks, they significantly amplify the speed and scale at which such risks materialise,” wrote Claudia Buch, chair of the ECB’s Supervisory Board.
The ECB is asking major lenders, including Deutsche Bank, BNP Paribas and Santander, to submit by 31 October a plan detailing the immediate and longer-term measures they intend to take to strengthen their resilience against cyberattacks.
It said the plans should prioritise faster vulnerability and software patch management, stronger AI-enabled monitoring and detection systems, and closer scrutiny of third-party technology providers and supply-chain risks.
These efforts must be directed from the highest levels of these institutions, the ECB stressed.
To give banks more time to focus on the new threat, the ECB said it would postpone its annual IT Risk Questionnaire from September 2026 to February 2027 and would consider adjusting other supervisory activities on a case-by-case basis.
Following the deadline, the ECB will analyse every bank’s plan, discuss it with each institution, and conduct a horizontal analysis to identify common weaknesses and best practices across the banking sector.
The letter also mentioned other emerging technologies, including quantum computing, which it said: “will have a significant impact on the cybersecurity landscape”. The ECB said it would address the risks posed by quantum computing in a separate letter “in due course”.
Systemic cyber risk becomes ‘severe’
The supervisory board’s move comes alongside a warning from the European Systemic Risk Board (ESRB), the EU body responsible for monitoring systemic financial risks.
The ESRB on Tuesday warned about “systemic cyber risks stemming from frontier artificial intelligence models”.
The warning follows the ESRB General Board’s decision in June to raise its assessment of systemic cyber risk to “severe” from “elevated” in March.
The watchdog said frontier AI models represent a “paradigm shift” in cybersecurity and have become a source of systemic risk to the EU financial system. According to the watchdog, “AI is already being used by malicious actors to enhance cyber-attacks”.
The ESRB warned that AI could dramatically reduce the time available for banks to identify and patch software vulnerabilities before they are exploited, increasing the risk of simultaneous cyber incidents across the financial sector.
The ESRB also warned that the concentration of leading frontier AI developers outside the European Union exposes the bloc to strategic dependency and geopolitical risks.
Anthropic, one of the world’s leading AI developers, have been creating increasingly capable frontier AI models. The company initially withheld the full version of Mythos over concerns that it could be misused to identify software vulnerabilities and assist hackers before releasing a public version with built-in safety safeguards last month.