meta_id 3368908

On July 31, 2026, the European Banking Authority (EBA), European Insurance and Occupational Pensions Authority (EIOPA), and European Securities and Markets Authority (ESMA)—collectively known as the European Supervisory Authorities (ESAs)—published a statement calling for enhanced governance and consistent supervision to mitigate information and communications technology (ICT) risks stemming from frontier artificial intelligence (AI) models in the European Union financial sector. The statement establishes a cross-sectoral, risk-based supervisory approach aligned with existing regulatory requirements, the European Commission's Action Plan on Cybersecurity and Artificial Intelligence, and recent publications from the European Systemic Risk Board (ESRB), the European Union Agency for Cybersecurity (ENISA), the Single Supervisory Mechanism (SSM), and other competent authorities. The ESAs emphasise that financial entities must implement robust governance and risk management frameworks to strengthen operational resilience against cyber risks linked to frontier AI models. The statement prioritises prevention, detection, and management of these risks. Additionally, the ESAs outline updates to ongoing and planned Digital Operational Resilience Act (DORA) oversight activities for critical ICT third-party providers (CTPPs) to address frontier AI-related risks. The ESAs encourage financial entities and competent authorities to use the statement as a foundation for supervisory dialogue, integrating existing supervisory expectations. This collaborative approach aims to ensure the EU financial system maintains resilience against risks driven by frontier AI technologies.