The European Central Bank (ECB) has issued a firm directive to banks under its supervision, requiring them to develop and submit comprehensive plans addressing the rising threat of AI-powered cyberattacks. The deadline for these plans is set for October 31, 2026, signaling the ECB’s urgent focus on enhancing cybersecurity measures in the financial sector.
In a letter sent to the chief executives of all banks it directly oversees, ECB’s top supervisor Claudia Buch outlined detailed expectations. Banks must outline specific steps they will take to defend against AI-driven cyber threats, assign clear accountability within their organizations, allocate necessary resources, and establish timelines for implementation. The ECB plans to review each submission closely and engage with banks to ensure progress.
The directive emphasizes the need for banks to accelerate their patching of software vulnerabilities as AI technologies enable attackers to discover and exploit weaknesses faster than ever before. Additionally, banks are urged to reduce their internet-facing attack surfaces by identifying and removing unnecessary external systems, including third-party software and open-source components. This structural change aims to limit potential entry points for cyber intrusions.
Another significant requirement is the modernization of legacy technology. Many banks operate with outdated systems that are difficult to secure against advanced threats. The ECB highlights replacing unsupported or end-of-life technology as one of the most challenging yet critical tasks for banks to maintain robust cybersecurity defenses.
The letter also calls for enhanced monitoring and detection capabilities, including the use of AI-based defensive tools. Banks must ensure that oversight of critical technology suppliers remains stringent and that crisis management, recovery plans, and information-sharing protocols are strengthened.
Importantly, the ECB places responsibility for cybersecurity at the boardroom level, emphasizing that management bodies must prioritize decisions related to technology investments, staffing, and risk tolerance. This aligns with the EU’s Digital Operational Resilience Act, which governs the technological resilience of financial institutions.
To allow banks sufficient time and resources to comply with this new mandate, the ECB has postponed other supervisory activities such as an annual technology-risk questionnaire due in September, now rescheduled for February 2027. The regulator may also adjust on-site inspections on a case-by-case basis.
The ECB’s move contrasts with other major central banks like the Bank of England and U.S. Federal Reserve, which have taken a more consultative or lighter regulatory approach toward AI-related cyber risks. While these institutions emphasize collaboration and proportionate oversight, the ECB’s directive is among the most prescriptive measures seen globally on this emerging issue.
The urgency of the ECB’s action reflects concerns about frontier AI models capable of rapidly identifying software vulnerabilities and crafting exploits at unprecedented speeds. These developments pose systemic risks not only to individual banks but potentially to the entire eurozone financial system.
Looking ahead, Claudia Buch indicated that further guidance will follow regarding cybersecurity challenges posed by quantum computing technologies. For now, eurozone banks face a clear mandate: submit robust AI cyber defense plans by October 31 or face increased scrutiny from their regulator.
