AI in action · Regulation
Nine Days to the ECB's Deadline: 110 Eurozone Banks Must File Action Plans Against AI-Enabled Cyberattacks by October 31
The European Central Bank's letter SSM-2026-0301, sent on July 7, 2026 by Claudia Buch, chair of its supervisory board, to the chief executives of the roughly 110 significant institutions it supervises directly, requires each to submit an action plan against cyberattacks driven by frontier AI systems to its joint supervisory team by October 31. The letter, summarised by Austria's Financial Market Authority, cites AI models that can find software vulnerabilities and generate working exploits at unprecedented speed, and sets six focus areas from accelerated patching to crisis recovery. Reuters reported on October 13 that eurozone banks must also map their AI use so that systems can be safely switched off and restarted. The deadline is for the plan, not for completing it.
The most concrete AI obligation any bank supervisor has imposed this year falls due next week. On July 7, 2026 the ECB's banking supervision arm sent letter SSM-2026-0301 to the chief executives of the significant institutions it supervises directly, about 110 banks holding most of the eurozone's assets, asking each to draw up an action plan against cyberattacks enabled by frontier AI systems and submit it to its joint supervisory team by October 31. Austria's Financial Market Authority published a summary the same day; the signatory was Claudia Buch, chair of the supervisory board. The letter is a supervisory instrument built on the Digital Operational Resilience Act rather than a new regulation, and the deadline applies to the plan, with concrete measures, resources, roles and timelines, not to the completion of every measure in it.
The reasoning is in the threat description. Frontier AI models, the letter says according to the secondary summaries, are capable of identifying software vulnerabilities and generating functioning exploits at unprecedented speed, which "significantly amplifies the speed and scale at which such risks materialise." The six focus areas are the practical consequence: prioritising vulnerabilities, accelerating patch management, AI-powered detection and response, governance and third-party risk, zero-trust defence in depth, and crisis management and recovery, with scenarios that include waves of zero-day exploits, destructive AI-driven attacks, ransomware and supply-chain failures, and with specific attention to non-human identities, meaning service accounts, APIs and agents. The ESRB's July warning, cited by Christine Lagarde on October 1, gave the number behind the urgency: in a simulated 32-step attack, models released at the end of 2025 completed about a third of the steps on average, and the latest models completed every one.
Reuters added the second half on October 13. Citing six people familiar with the discussions, it reported that the ECB and the Bank of England are pushing banks to improve their recovery plans, that UK supervisors want the largest banks to review backup systems fully separate from their main IT, and that eurozone banks must map their use of AI, including through outside suppliers, so that systems can be safely switched off and restarted; the ECB's annual IT-risk questionnaire deadline was moved from September to February to make room. The same report said the Fed, OCC and FDIC were asking US banks whether they use Chinese-built technology and how they would shut down an autonomous system, and quoted Grant Thornton's Michael Woodbridge: "The adoption of AI is often outpacing the ability to put the controls in place."
What happens after October 31 is a dialogue, not a verdict. Each joint supervisory team will review its bank's plan and challenge it through the normal supervisory cycle, and the ECB has not said it will publish an aggregate; the first visible output is likely to be a thematic finding in next year's supervisory priorities. For investors in European banks the letter is a cost line and a disclosure risk: the plans will require spending on patching and detection that was not in 2026 budgets, and a bank that cannot show its supervisor a credible plan will hear about it in its Pillar 2 requirement. For everyone else it is a marker. The ECB has set a date by which every large bank in the eurozone must have written down what a frontier model could do to it, and that date is next Friday.
Sources: Finanzmarktaufsicht (FMA) Austria — ECB urges banks to draw up action plans addressing AI-enabled cybersecurity threats (Jul 7, 2026); The Next Web, citing Reuters — US and European regulators question banks about AI agents and cyber risks (Oct 14, 2026); European Central Bank — Welcome address by Christine Lagarde at the 10th ESRB annual conference (Oct 1, 2026)