Breaking

ECB Tells Major Banks to File AI Cyber Plans by Oct. 31

July 7, 2026 at 05:55 EDT

Policy & Regulation
Security
Finance

The European Central Bank's supervisory arm (SSM) on July 7, 2026 asked the major banks it oversees to submit comprehensive action plans addressing AI-enabled cybersecurity threats by October 31, 2026. The request covers the significant institutions directly supervised by the ECB across the euro area and was sent as a "Dear CEO letter" (SSM-2026-0301) signed by Supervisory Board Vice-Chair Claudia Buch. The letter

July 7, 2026 · European Central Bank

ECB Orders Euro-Area Banks to Confront AI Cyber Threats

In a rare letter addressed directly to bank CEOs, the ECB demands concrete action plans by October 31, 2026 — triggered by a frontier AI model deemed "too dangerous to release" that can discover software flaws and build exploits at machine speed.

85%+

of Europe's significant banks already use AI

50%+

use AI for fraud & cybercrime detection

Oct 31

2026 deadline for CEO action plans to JSTs

"AI versus AI": the response gap

Claude Mythos Preview compresses the timeline from vulnerability discovery to working exploit — outpacing traditional human-led defense.

Human pace

days → weeks

AI-driven attack

discovery → exploit, rapid

"Not a temporary phenomenon but a structural change in the threat landscape."

Four short-term priorities for banks

Vulnerability & patch mgmt

Accelerate response — AI tools allowed with mandatory risk assessment & human oversight

Monitoring & detection

Strengthen logs, network traffic & IoC monitoring; enhance AI defensive capability

Third-party risk

Verify ICT providers' vulnerability disclosure & patching capabilities

Perimeter & exposed assets

Prioritize internet-exposed assets: cloud, VPN and open source

Why it matters

A CEO-addressed letter is unusual and intended to force management-level investment. The ECB will analyze plans across banks and share findings industry-wide, building on the DORA framework.

The critique

Some call it unfair: U.S. banks use Mythos to find flaws while Europe races only to defend. Critics question whether DORA alone is enough without sovereign access to advanced models.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.