AI in action · Regulation
The Basel Committee Is Asking Whether Its Bank Risk Categories Still Fit an AI World
After its meeting of October 1, 2026, the Basel Committee on Banking Supervision said it would review whether the loss-event categories in its operational risk framework remain adequate, with a focus on cyber risk and AI. It said frontier AI could amplify vulnerabilities through cyberattacks and correlated dependencies.
The Basel Committee writes the capital rules that most of the world's banks follow, and it rarely says anything quickly. Its media release of October 1, 2026 is therefore worth reading for a single sentence: the committee agreed to examine whether the existing "event type" loss categories in its operational risk framework are still sufficient and adequate, with a focus on cyber risk and artificial intelligence.
Those categories decide how banks record and capitalise losses that are not credit or market losses: fraud, system failures, legal costs, damage to assets. They were written for a world of mainframes and rogue traders. The committee said AI developments had "moved quickly" since its May meeting, and that frontier AI could bring efficiency and innovation but could also amplify operational vulnerabilities, including from cyberattacks and "correlated dependencies", the situation in which many banks rely on the same few models and providers.
The release does not propose a separate AI rulebook. The GRC Report, an independent compliance publication, read it as the committee checking whether the framework it already has still fits, rather than building a new regime. The committee said integrating AI into critical functions would require strong governance and risk management, and that it would keep monitoring AI and discussing its supervisory implications.
Supervisors have been converging on this view. The Financial Stability Board's final guidance on responsible AI adoption, published on October 16, puts accountability on boards; the Bank of England's Financial Policy Committee record of September 30 flagged AI incidents in test environments as an operational risk; the UK's FCA told MPs on October 13 that existing rules apply. Basel's contribution is narrower and more technical: if an AI model causes a loss, which box does it go in, and does the box carry enough capital?
For markets the relevance is indirect but real. Bank capital requirements decide how much lending the system can do, and a decision that AI and cyber losses deserve their own treatment would eventually show up in how much capital banks hold against the technology they are all buying at once.
Sources: Bank for International Settlements — Basel Committee meets to advance supervisory and regulatory initiatives (media release, Oct 1, 2026); GRC Report — Basel Committee takes on AI risk in push to modernize bank supervision (Oct 2, 2026); FinanceFeeds — Basel Committee reviews AI cyber risks, cryptoasset rules and liquidity frameworks