The European Supervisory Authorities (EBA, EIOPA, ESMA) endorse the ESRB warning on cyber risks posed by frontier AI models and call for enhanced cybersecurity measures in the financial sector.
The European Supervisory Authorities (EBA, EIOPA, and ESMA) support the European Systemic Risk Board (ESRB) warning regarding systemic cyber risks from frontier AI models.
Recent advances in AI have increased the ability of these models to identify and exploit high-severity vulnerabilities quickly. While the EU’s regulatory framework, including DORA and the AI Act, provides a foundation for managing cyber and AI risks, the rapid development of these tools raises concerns about potential cyber-attacks undermining financial operational resilience.
Since the introduction of frontier AI models, the ESAs have raised awareness of ICT risks and engaged with EU authorities to ensure appropriate mitigation measures. Their first annual report under DORA encouraged financial entities to strengthen cybersecurity measures to maintain resilience amid evolving AI-driven threats.
The ESAs agree with the ESRB warning and urge financial entities to adapt their cybersecurity capabilities. They also invite supervisory authorities to incorporate these developments into their oversight activities. Additionally, the ESAs support the ESRB’s call for the EU to enhance its capacity, expertise, and strategic autonomy, involving AI providers, software firms, security companies, open-source maintainers, financial institutions, and national and EU authorities.
The ESAs are collaborating with the EU supervisory community to ensure proactive risk identification and mitigation in line with DORA, which establishes a harmonized ICT risk framework for the financial sector.
As overseers of critical ICT third-party providers, the ESAs are engaging with these providers to assess measures taken to adapt and ensure service continuity within the EU financial sector.
Background and next steps include monitoring frontier AI models’ development and impact, working with national supervisors to clarify supervisory expectations, and communicating these to ensure compliance with existing regulations.
