meta_id 3123407

On May 4, 2026, the Central Bank of Iceland (Seðlabanki Íslands) issued a circular to supervised entities addressing the cybersecurity implications of rapidly advancing artificial intelligence (AI) technology, particularly large language models, on financial market participants. The Central Bank highlights that threat actors are increasingly leveraging AI to identify system vulnerabilities and automate attacks with unprecedented speed and efficiency. Advanced AI models can discover previously unknown zero-day vulnerabilities and chain them into complex attack sequences, reducing the time available for organisations to respond to emerging threats. This development creates a potential gap between attackers' ability to exploit vulnerabilities and organisations' capacity to detect and remediate them. The guidance references Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), which entered into force in Iceland through Act No. 78/2025, as providing a framework to address these risks. The Central Bank directs supervised entities to: - Maintain robust foundational security practices, including timely security updates, secure access controls, and regular access reviews - Ensure clear visibility and regular updates of information and communication technology systems and their exposure - Enhance monitoring and analysis capabilities to detect anomalies earlier and respond faster - Prioritise vulnerability remediation and automate responses where appropriate - Maintain clear, documented, and regularly tested incident response procedures - Assess risks from service providers and third parties through regular reviews and oversight - Evaluate how AI can support their own security operations, including vulnerability detection and anomaly monitoring - Establish clear policies governing AI usage, including data handling and information security considerations - Enhance staff awareness training regarding AI-enabled threats, including deepfakes and social engineering - Conduct business impact analyses for various scenarios and adjust security measures accordingly Supervised entities lacking sufficient expertise are encouraged to seek appropriate specialist assistance to ensure adequate responses to these evolving threats.