meta_id 3157721

On 15 May 2026, the Bank of England (BoE), Financial Conduct Authority (FCA), and HM Treasury published a joint statement addressing cyber security risks posed by frontier artificial intelligence (AI) models to the United Kingdom's financial sector. The statement recognises that frontier AI models represent a significant advancement in capability with material implications for cyber security and operational resilience. Current frontier AI models already exceed the capabilities of skilled cyber practitioners whilst operating at greater speed, scale, and lower cost. The authorities note that if deployed maliciously, these capabilities amplify cyber threats to firms' safety and soundness, customers, market integrity, and financial stability. Firms with underinvested core cyber security fundamentals face progressively greater exposure as more advanced models become available. The authorities expect regulated firms and financial market infrastructures (FMIs) to take active steps across five domains: (1) governance and strategy, ensuring boards and senior management understand frontier AI risks and make appropriate investment and resourcing decisions; (2) identification and risk management of vulnerabilities, with firms required to triage, prioritise, and remediate vulnerabilities more rapidly and at scale; (3) managing third-party risks from supply chains and open-source software; (4) protection through effective access management, network security, and data protection, potentially including automated and AI-enabled defences; and (5) response and recovery capabilities enabling firms to quickly address disruption. The statement reinforces existing expectations under operational resilience rules rather than introducing new requirements. Firms should consult cyber resilience guidance published by the BoE, Prudential Regulation Authority (PRA), and FCA in October 2025, and engage with resources from the Cross Market Operational Resilience Group (CMORG) and the National Cyber Security Centre (NCSC).