October 2026
The recent development of advanced artificial intelligence (AI) models —or frontier AI models¹— presents a range of opportunities and risks for the financial sector, which are currently being analysed and addressed by various international organisations, European institutions and financial authorities.
Specifically, on 31 July, the European Supervisory Authorities (ESAs) published a Statement outlining the risks inherent in information and communication technologies (ICT) arising from frontier AI models² and their intention to adopt a consistent and risk-based supervisory approach for the three relevant sectors.
In the Statement, the ESAs draw the financial sector’s attention to the growing significance of the risks associated with these models and exhort those within the sector to urgently strengthen their cyber resilience policies and measures with robust governance structures to ensure the mitigation of such risks through prevention, detection and management strategies.
Cybersecurity measures must adapt to the new status quo and enhance the capacity for immediate response to potential incidents. New AI tools could pose systemic risks given their ability to discover and exploit vulnerabilities at high speed, attack vulnerabilities in shared infrastructure and take advantage of entities’ single points of failure. The ESAs provide a series of examples³ that supervised entities can use as a reference to implement the strategies and measures they deem appropriate. The advantages of these models for developing substantial improvements in defence measures are also highlighted.
For their part, the ESAs will work with the national competent authorities (NCAs) to adopt a proportionate, risk-based supervisory approach and are carrying out various initiatives that will be integrated into and inform their supervisory activities planned for 2027.
This Statement is part of a series of documents issued in June and July by various EU authorities and institutions. Among these, the following are particularly noteworthy:
- The EU Action Plan on Cybersecurity and Artificial Intelligence⁴ (see the last section).
- The European Systemic Risk Board (ESRB) Warning⁵ on systemic cyber risks stemming from frontier AI models and the need for the financial industry, in its broadest sense, to adopt urgent measures and coordinate with national and European authorities.
- The ECB’s letter⁶ addressed to the Chief Executive Officers (CEOs) of credit institutions under its supervision, urging them to promptly develop an action plan with a cybersecurity strategy tailored to the new models, distinguishing between structural measures and short-term measures.
- The first edition of ENISA’s recommendations⁷, addressed, among others, to national authorities and service providers, prompting them to develop their operational capabilities to address these risks.
At the global level, it is worth noting the most recent work of the Financial Stability Board in this area, from the perspective of financial stability:
- On the one hand, the letter that its chair sent to the G20 finance ministers and central bank governors, in which he also warns of the new risks posed by frontier AI models⁸. The letter highlights the importance of taking these new technological developments and their potential risks into account, given the interconnectedness of the global financial system, the significant fragmentation that exists, differences in the level of cybersecurity development across jurisdictions, and supply concentration in a small number of service providers. It also reiterates the need for financial institutions, market infrastructures and technology providers to adapt and strengthen their resilience frameworks to address a potential threat environment with a greater number of vulnerabilities. Finally, it states that the safe and responsible model release and deployment on a global basis should be a priority.
- Additionally, in October, it published its Final Report on Sound Practices for the Responsible Adoption of Artificial Intelligence (AI)⁹, aimed at the entire financial sector, which describes the industry’s current uses of AI models, as well as their benefits, advantages and vulnerabilities. The report contains case studies and twelve best practices for the use of AI (with a special focus on generative and agentic AI), which are non-binding and structured around governance and risk management functions throughout the entire lifecycle of the models. The adoption of these practices must be guided by the principle of proportionality, taking into account the size, complexity and connectivity of the entity concerned, as well as the nature of and risks entailed by the functions to which AI is applied. The report highlights the responsibility and necessary involvement of Boards of Directors and senior management in designing a strategy and control mechanisms for the new tools, as well as the need for coordination, cooperation and information sharing that these practices aim to promote. The practices will be updated as new tools are developed.
¹ The European Systemic Risk Board’s Warning, of 25 June 2026, defines ‘Frontier AI Models (FAIMs)’ as ‘advanced general-purpose AI models capable of materially affecting offensive or defensive cyber operations’.
² ESA Statement toward a consistent and risk-based approach for ICT risks from frontier AI Models.
³ See the Annex to the Statement (Examples of risk mitigation strategies and actions).
⁴ Action Plan on Cybersecurity and Artificial Intelligence.
⁷ ENISA’s view on Cybersecurity in the Frontier AI Era.
⁹ Sound Practices for the Responsible Adoption of Artificial Intelligence (AI). Final report.