The ECB Gave Europe's Banks Until October 31 to Prove They Can Survive an AI Attack

The European Central Bank has ordered the biggest banks it supervises — including Deutsche Bank, BNP Paribas, Santander, and the European units of JPMorgan Chase, Goldman Sachs, Citi, and Morgan Stanley — to submit a plan by October 31, 2026, detailing immediate and longer-term measures to strengthen resilience against AI-powered cyberattacks.

Why now

The trigger was a formal warning from the European Systemic Risk Board (the EU body that watches for threats to the financial system as a whole) about "systemic cyber risks stemming from frontier artificial intelligence models." According to the board, such models can run fully automated cyberattacks and build a working exploit in minutes or hours — a process that used to take human experts days or weeks.

What the plans need to cover

The regulator wants the plans to prioritize faster vulnerability and patch management, stronger AI-enabled monitoring and detection systems, and closer scrutiny of third-party technology providers and supply-chain risk. To give banks more room to focus on the new threat, the ECB also pushed back its annual IT Risk Questionnaire from September 2026 to February 2027.

In a parallel move on the UK side, a Treasury designation took effect on July 13 naming AWS, Microsoft Azure, Google Cloud, and Oracle as "critical third parties" to the UK financial system — placing all four under direct oversight by the Bank of England, the PRA, and the FCA.

What this means in practice

Regulators on both sides of the Atlantic are effectively acknowledging that financial-system infrastructure risk is now tightly bound up with AI capability and cloud-provider concentration, not just traditional threats. For banks, this isn't just a paperwork exercise — it's real pressure on cybersecurity budgets this year.

This material is for informational purposes only.