meta_id 3302568

On July 7, 2026, the European Supervisory Authorities (ESAs)—comprising the European Banking Authority (EBA), European Insurance and Occupational Pensions Authority (EIOPA), and European Securities and Markets Authority (ESMA)—endorsed a warning from the European Systemic Risk Board (ESRB) regarding systemic cyber risks posed by frontier artificial intelligence (AI) models. The ESAs noted that recent advances in frontier AI models have significantly enhanced the ability of threat actors to identify and exploit high-severity vulnerabilities in information technology systems within very short timeframes. While the EU's regulatory framework—including the Digital Operational Resilience Act (DORA) and the AI Act—provides a foundation for managing cyber and AI-related risks, the speed and scale of these tools raise concerns that AI-enabled cyber-attacks could undermine the operational resilience of financial entities. The ESAs have engaged with EU competent authorities since the release of the first frontier AI models to ensure financial entities implement appropriate mitigation measures. In their first annual report on major information and communications technology (ICT)-related incidents under DORA, the ESAs encouraged financial entities to strengthen cybersecurity measures. The ESAs urge financial entities to make appropriate arrangements to adapt their cybersecurity capabilities and invite competent authorities to reflect these developments in their supervisory activities. The ESAs are working closely with the EU supervisory community to ensure financial entities across the EU proactively identify and mitigate these risks in line with DORA requirements. As Overseers of Critical ICT Third-Party Providers, the ESAs are engaging with these providers on measures they are taking to adapt to the situation and manage risks. The ESAs will continue to monitor the use and development of frontier AI models and assess their potential impact on the financial sector, working with national supervisors to clarify supervisory expectations and communicate them consistently to financial entities.