The European Central Bank (ECB) has instructed significant banks across the euro area to prepare detailed action plans addressing the rising risks of cyberattacks enabled by advanced artificial intelligence. In a letter sent to bank chief executives, ECB Supervisory Board Chair Claudia Buch stressed the urgent need for institutions to evaluate and strengthen their defenses against these evolving dangers.
The directive, dated July 7, 2026, sets a clear deadline of October 31 for submission of the plans.
It focuses on models such as Anthropic’s Mythos, which demonstrate powerful capabilities in identifying software vulnerabilities and generating functional exploits at speeds previously unseen.
These tools can dramatically shorten the window between the discovery of a weakness and its exploitation, forcing banks to rethink traditional approaches to cybersecurity.
The ECB highlighted that such developments carry potentially profound implications for the confidentiality, integrity, and resilience of banks’ information and communication technology systems.
Beyond technical vulnerabilities, the regulator warned that successful attacks could disrupt payment flows, erode public trust in financial institutions, and create broader instability across the sector.
Banks must now outline concrete short- and long-term measures.
In the near term, priorities include accelerating large-scale software patching, enhancing real-time threat monitoring and detection capabilities, and improving oversight of risks associated with third-party providers and open-source components.
Special emphasis is placed on protecting internet-facing systems and other externally exposed assets that could serve as entry points for sophisticated AI-driven intrusions.
Over a longer horizon, institutions are encouraged to modernize legacy infrastructure, bolster operational resilience through stronger incident response and recovery processes, and establish more robust crisis management and information-sharing arrangements.
These steps aim to reduce reliance on outdated technology that may be particularly susceptible to rapid AI-assisted attacks.
This supervisory push follows earlier ECB engagement with banks on the topic, including meetings held in May 2026 to underscore the seriousness of the threat landscape.
It aligns with parallel concerns raised by the European Systemic Risk Board, which has flagged the potential for AI-enhanced cyber incidents to generate systemic risks, including scenarios involving coordinated attacks on payment and settlement systems or rapid loss of confidence in parts of the financial system.
The ECB’s approach appears more prescriptive than some international peers, reflecting a determination to ensure banks move beyond awareness to tangible preparedness.
By requiring comprehensive action plans, the central bank seeks to help the sector adapt to a cybersecurity environment where artificial intelligence acts as both a powerful defensive tool and an increasingly formidable offensive capability.
Financial institutions now face a tight timeline to demonstrate they are taking these risks seriously. Effective implementation of the requested measures will be critical to maintaining the stability and reliability of Europe’s banking system in the face of rapidly advancing technology.
