Europe's three main financial regulators have issued a coordinated call for banks and financial firms to strengthen their defenses against cyber risks posed by cutting-edge AI models. The European Banking Authority (EBA), European Insurance and Occupational Pensions Authority (EIOPA), and European Securities and Markets Authority (ESMA) published a joint statement today outlining how financial institutions should manage the operational risks that come with deploying frontier AI systems, which are the most advanced AI models currently available.

This move represents a significant shift in how European regulators are approaching AI governance in the financial sector. Rather than waiting for problems to emerge, the three supervisory authorities are proactively establishing expectations for how banks and insurers should handle the unique cybersecurity challenges that frontier AI models introduce. The statement builds on existing regulatory frameworks, including the European Commission's Action Plan on Cybersecurity and Artificial Intelligence, and incorporates guidance from other EU agencies focused on systemic risk and cybersecurity.

Why Should Financial Institutions Care About Frontier AI Risks?

Frontier AI models represent a new category of technological capability that financial firms are increasingly adopting for tasks like fraud detection, customer service, and risk analysis. However, these powerful systems also introduce novel cybersecurity vulnerabilities that traditional IT risk frameworks may not adequately address. The regulators emphasize that financial entities must develop robust governance and risk management frameworks specifically designed to handle the cyber threats linked to these advanced AI systems.

The concern is not hypothetical. As financial institutions integrate frontier AI into their operations, they create new potential entry points for cyberattacks and operational failures. A compromised AI system could have cascading effects across trading platforms, payment systems, or customer data repositories. The regulators want to ensure that banks and insurers understand these risks before they materialize into actual incidents.

What Specific Steps Are Regulators Asking Financial Firms to Take?

• Governance Frameworks: Financial entities should establish clear governance structures that assign responsibility for AI risk management at the board and executive levels, ensuring that frontier AI deployment decisions are made with full awareness of cybersecurity implications.
• Risk Prevention and Detection: Institutions must implement systems to prevent cyber incidents related to frontier AI models and develop detection mechanisms to identify threats early, before they can cause widespread damage.
• Incident Management Protocols: Financial firms need documented procedures for responding to and managing cyber incidents that involve frontier AI systems, including communication plans and recovery procedures.
• Third-Party Oversight: The regulators are updating their supervision of critical ICT third-party providers, meaning that banks must carefully vet and monitor any external vendors who provide AI services or infrastructure.

The statement also encourages both financial institutions and their regulators to use this guidance as a foundation for ongoing supervisory dialogue. This means that banks should expect their regulators to ask detailed questions about how they are managing frontier AI risks, and regulators will be looking for evidence that institutions have thought through these challenges systematically.

How Can Financial Institutions Strengthen Their AI Resilience?

• Operational Resilience Assessment: Conduct a comprehensive review of how frontier AI systems are integrated into critical business functions, identifying which processes depend on AI and what would happen if those systems failed or were compromised.
• Cross-Functional Collaboration: Establish working groups that bring together cybersecurity teams, AI development teams, compliance officers, and business leaders to ensure that AI deployment decisions account for security considerations from the start.
• Vendor Due Diligence: Before adopting any frontier AI model or service, perform thorough security assessments of the provider, including their own cybersecurity practices, data handling procedures, and incident response capabilities.
• Continuous Monitoring: Implement ongoing monitoring systems that track how frontier AI models perform in production, looking for anomalies that might indicate a security breach or model degradation.
• Regulatory Engagement: Maintain open communication with supervisory authorities about AI deployment plans, seeking guidance early rather than waiting for regulatory inspections to surface concerns.

The regulators' statement reflects a broader recognition that frontier AI is no longer a distant future concern for the financial sector. Banks and insurance companies are already deploying these systems, and regulators want to ensure they are doing so responsibly. By establishing clear expectations now, the EBA, EIOPA, and ESMA are signaling that AI governance will be a key focus area in upcoming supervisory examinations.

This coordinated approach across three major regulatory authorities also suggests that the EU is moving toward a more unified stance on AI risk management in finance. Rather than having each country or regulator develop its own standards, the joint statement creates a consistent baseline that applies across the European Union. This consistency is important for financial institutions that operate across multiple EU member states, as it reduces the burden of complying with conflicting requirements.

The timing of this statement is significant. The EU AI Act, which establishes a comprehensive regulatory framework for artificial intelligence across the bloc, is already in effect. This new guidance from financial regulators shows how the broader AI Act principles are being translated into sector-specific requirements. Financial institutions should view this statement not as a standalone directive but as part of a larger regulatory ecosystem that is rapidly evolving to address AI governance.

For financial institutions still in the early stages of frontier AI adoption, this guidance offers a roadmap for responsible deployment. For those already using these systems, it signals that regulators will soon be asking detailed questions about risk management practices. Either way, the message from Europe's financial regulators is clear: frontier AI governance is no longer optional, and institutions that take it seriously now will be better positioned to navigate the regulatory landscape ahead.