ECB Orders Banks to Address AI Cyber Risks

The European Central Bank has instructed major euro‑area lenders to produce detailed plans for tackling AI‑driven cyber threats, warning that new frontier‑scale models could undermine the resilience of financial infrastructure.

The move follows months of concern across global regulators after Anthropic’s Mythos demonstrated the ability to rapidly uncover software weaknesses and automate sophisticated attacks, prompting the ECB to convene banks earlier this year to underline the severity of the issue.

In letters sent to CEOs, the ECB set an end‑of‑October deadline for banks to outline how they will strengthen their defences. Immediate priorities include speeding up patch deployment across large IT estates, improving threat detection capabilities, and tightening oversight of third‑party technology providers. The ECB emphasised that institutions must reinforce protections around internet‑facing systems and widely used open‑source components, which it sees as particularly vulnerable in an era of AI‑enhanced exploitation.

Longer‑term expectations focus on modernising legacy infrastructure, bolstering crisis‑response and recovery processes, and expanding information‑sharing arrangements to help the sector react more quickly to emerging threats. The central bank also signalled that AI is only one part of a broader technological risk landscape, telling lenders to expect further guidance on quantum‑related cyber challenges.

Separately, the European Systemic Risk Board issued its own warning, describing frontier AI as a fundamental shift in cybersecurity. While these systems may eventually strengthen resilience, the ESRB cautioned that in the near term they give attackers a significant advantage by accelerating vulnerability discovery and enabling more complex intrusions. It also highlighted Europe’s reliance on non‑EU AI providers, warning that this concentration creates strategic and geopolitical exposure.