meta_id 3246890

On June 17, 2026, the Cyprus Securities and Exchange Commission (CySEC) issued Circular No. C786 addressing cybersecurity risks posed by frontier artificial intelligence (AI) models under the Digital Operational Resilience Act (DORA). The circular alerts regulated entities to the emerging threat of advanced AI systems capable of identifying and exploiting software vulnerabilities at unprecedented speed and scale, which may significantly accelerate cyber-attack sophistication, frequency, and scale against financial entities and their information and communications technology (ICT) third-party service providers. CySEC reminded all regulated entities falling within the scope of Regulation (EU) 2022/2554 that they must maintain robust ICT risk management frameworks capable of addressing evolving cyber-threats, including those arising from emerging AI technologies. The circular applies to Cyprus Investment Firms, central securities depositories, trading venues, crypto-asset providers, alternative investment fund managers, and UCITS management companies. CySEC expects regulated entities, proportionate to their size, nature, scale, and complexity, to assess whether their existing ICT risk management arrangements remain adequate and strengthen relevant controls where necessary. The circular identifies eight key areas for consideration: identification and vulnerability management; protection and prevention; detection capabilities; response and recovery; and governance and continuous improvement. Under DORA, regulated entities must protect ICT systems against unauthorised access and malicious activities, detect anomalous activities and ICT-related incidents, maintain robust business continuity and backup arrangements, conduct appropriate ICT testing and vulnerability assessments, and manage ICT third-party risks effectively. CySEC will continue monitoring frontier AI developments and their implications for operational resilience within the financial sector, engaging with regulated entities regarding their preparedness and implementation of ICT risk mitigation measures. Regulated entities should direct queries to CySEC at ict.oversight@cysec.gov.cy.