AI in action · Regulation
Europe's Three Financial Supervisors Name AI-Enabled Cyberattacks and Dependence on Non-EU Technology Among the System's Key Vulnerabilities
The EBA, EIOPA and ESMA's Autumn 2026 risk update, published on September 23, identifies external dependencies, emerging technologies and private credit as the three main vulnerabilities in EU finance. It warns that advanced AI "could make cyberattacks more powerful and harder to contain" and that reliance on ICT providers outside the European Economic Area is a particular concern.
Twice a year the three European Supervisory Authorities, the banking authority EBA, the insurance authority EIOPA and the markets authority ESMA, publish a joint assessment of what could go wrong in the EU financial system. The Autumn 2026 edition, presented to the EU's Financial Stability Table on September 10 and published on September 23, puts artificial intelligence in two of its three headline vulnerabilities, not as a tool firms are adopting but as a technology that changes the threat environment they operate in.
The first vulnerability is external dependency. The ESAs note that EU investment funds hold substantial US exposures, that banks have funding gaps in dollars, sterling and Swiss francs, and that clearing, repo and credit ratings are largely intermediated by non-EU entities. Their conclusion is that "reliance on non-EU providers and infrastructures could amplify the impact of geopolitical shocks", and that "dependence on ICT service providers outside the European Economic Area remains a particular concern". The cloud and model providers on which most AI deployment in European finance runs are, almost without exception, outside the EEA.
The second is emerging technology, and here the language is direct: "The rapid development of advanced AI systems could make cyberattacks more powerful and harder to contain." Cyber and fraud are already the main operational risks the ESAs see, and concentration on a few non-EEA ICT providers heightens them. Insurers get a specific warning: "orchestrated AI-enabled cyberattacks could increase claims and accumulation risks" for those underwriting cyber cover, even if exclusion clauses limit the damage. Quantum computing is added as a second-order risk that could undermine the cryptography behind payments and blockchains sooner than commercially useful applications arrive.
The third vulnerability, private credit, is not an AI story on its face, but the two connect through the financing of data centres. The ESAs describe a sector that is still small in the EU but growing fast, with complexity, limited transparency, infrequent and possibly inaccurate loan valuations, uncertain leverage and data gaps, and with liquidity mismatches in private credit funds that could spill into banks through shared borrowers and financing commitments. Much of the AI infrastructure build-out outside the public bond market is funded exactly this way.
The recommendations are what supervisors always recommend, with one specific addition. Firms and national supervisors are asked to monitor and manage exposures to non-EEA providers and to private credit, to keep crisis-preparedness and resolution coordination current, and, in the ESAs' words, to "strengthen their preparedness" for risks from AI and quantum computing. There is no proposal for new rules; the EU already has the AI Act and the digital operational resilience regulation DORA. What the update does is tell the institutions that implement those rules where the authorities expect the next problem to come from.
Sources: European Banking Authority — ESAs call for vigilance over external dependencies, cyber threats and private credit risks (Sep 23, 2026); EIOPA — Joint Committee Update on risks and vulnerabilities in the EU financial system, Autumn 2026; Mondo Visione — ESAs call for vigilance over external dependencies, cyber threats and private credit risks