meta_id 3423068

On August 21, 2026, Denmark's Financial Supervisory Authority (Finanstilsynet) issued guidance highlighting the need for enhanced cybersecurity measures in response to threats posed by advanced artificial intelligence (AI) models. The authority warned that frontier AI models, highly sophisticated AI systems, enable malicious actors to identify and exploit vulnerabilities in financial institutions' information technology systems faster and at greater scale than previously possible, fundamentally altering the threat landscape for the financial sector. The guidance follows warnings issued by the European Systemic Risk Board (ESRB) on July 7, 2026, regarding systemic cyber risks from frontier AI models, and a joint statement from the European Supervisory Authorities (ESAs) on July 31, 2026, urging the sector to strengthen its resilience against cyberattacks. Finanstilsynet emphasised that financial institutions must assess how AI-driven cyberattacks could affect their operations and enhance their cybersecurity preparedness accordingly. The authority recommends that financial institutions, proportionate to their size and risk profile: Establish visibility over their internal use of AI and associated risks Continuously evaluate how advanced AI affects their threat landscape Assign clear responsibility for AI risks to boards and management Implement effective vulnerability monitoring and security update processes Update business continuity and disaster recovery plans to account for AI-driven cyberattacks Test relevant threat scenarios; ensure access to necessary AI and cybersecurity expertise Share knowledge and experiences on AI risks internally and across the sector. Finanstilsynet noted that no single standard solution exists for all institutions and that leadership must maintain clear understanding of vulnerabilities while ensuring preparedness is tested. During the second half of 2026, Finanstilsynet will analyse the financial sector's use of AI and associated risks, with work continuing through Digital Operational Resilience Act (DORA) supervision and national and European cyber risk collaboration.