meta_id 3215655

On June 4, 2026, the French Financial Markets Authority (AMF) issued guidance calling on financial market participants to strengthen their cybersecurity arrangements in response to rapidly evolving threats posed by artificial intelligence (AI). The AMF identified operational resilience and cyber risk mitigation as strategic priorities in its 2026 action plan, emphasising that recent advances in AI models are likely to accelerate vulnerability identification, facilitate exploitation and contribute to the industrialisation of malicious campaigns. The AMF's guidance applies to portfolio management companies, crypto-asset service providers, crowdfunding service providers and market infrastructures under its supervision. These entities must comply with Regulation (EU) 2022/2554 (DORA). DORA requires financial sector participants to identify critical processes and systems, implement cybersecurity risk mitigation strategies, establish robust cyber incident management frameworks, conduct digital operational resilience testing and manage third-party risks. The AMF reiterates that cybersecurity is a major issue for investor protection, the continuity of financial services and, more broadly, the proper functioning of financial markets. The senior management of regulated entities must therefore ensure that cyber risks are identified, monitored at the appropriate level, tested regularly and integrated into internal control and risk management arrangements. The AMF sets out its recommendations and best practices, which include: Maintaining a robust inventory of critical systems, data and service providers, and ensuring that access is appropriately controlled. Protecting data confidentiality, in particular through cryptographic mechanisms adapted to the current threat landscape. Frequently backing up systems and data, and testing the proper functioning of recovery procedures. Training staff on common threats. Regularly testing incident response procedures and conducting cyber crisis management exercises. Incorporating AI-related risks into cybersecurity scenarios. The AMF will continue to carry out inspections of the cybersecurity arrangements of regulated entities within its remit. These inspections will assess the protection of client data, the quality of arrangements for preventing, detecting, managing and remediating cyber incidents and, more specifically, the measures implemented to address the evolving threat posed by the capabilities of artificial intelligence.