ECB Orders Bank CEOs to Submit AI Cyber Risk Mitigation Plans

The European Central Bank (ECB) has instructed the chief executives of Europe’s largest banks to submit formal mitigation plans addressing cyber risks associated with artificial intelligence (AI), signalling that AI governance is becoming a supervisory priority for the banking sector.

The directive reflects the ECB’s growing concern that the rapid adoption of AI technologies could introduce new operational, cyber and third-party risks if not supported by robust governance and effective internal controls. Supervisors are seeking assurance that banks have identified AI-related vulnerabilities and established clear strategies to manage emerging threats before they materialise into operational or financial stability risks.

According to the ECB, banks are expected to assess how AI is being deployed across their organisations and evaluate the associated cyber security implications. Institutions should demonstrate that AI systems are subject to appropriate governance, risk assessments and oversight, particularly where they support critical business operations, customer services or cybersecurity functions.

The regulator is also placing increased emphasis on third-party risk management, recognising that many financial institutions rely on external technology providers and cloud-based AI services. Banks are expected to understand the risks arising from outsourced AI capabilities and ensure that appropriate contractual safeguards, monitoring arrangements and contingency plans are in place.

The ECB’s latest supervisory initiative aligns with a broader European regulatory focus on digital operational resilience and responsible AI governance. As financial institutions increasingly integrate AI into fraud detection, customer due diligence, credit decision-making and cyber defence, regulators are seeking greater assurance that these technologies do not introduce unacceptable operational or security risks.

The development also complements the European Union’s wider regulatory framework, including the Digital Operational Resilience Act (DORA) and the EU AI Act, both of which place greater emphasis on governance, accountability and resilience in the deployment of digital technologies within the financial sector. Together, these measures reinforce expectations that boards and senior management remain accountable for overseeing AI-related risks and ensuring that appropriate controls are embedded throughout the technology lifecycle.

Compliance Takeaway

The ECB’s directive reinforces that AI risk is now a board-level governance issue rather than solely a technology concern. Financial institutions should maintain comprehensive AI governance frameworks incorporating cyber security, operational resilience, third-party risk management and model risk oversight. Banks should ensure that AI systems undergo regular risk assessments, independent validation and continuous monitoring, while governance structures clearly define accountability for AI-related decisions and incident response. Senior management should also ensure that AI risk management is integrated into enterprise risk frameworks and aligned with existing regulatory obligations under DORA, the EU AI Act and cyber resilience requirements.

Editor’s Compliance Insight

The ECB’s latest supervisory expectations demonstrate that regulators are shifting their focus from the benefits of artificial intelligence to the governance required to manage its risks. For banks, AI can strengthen fraud detection, cyber defence and operational efficiency, but it also creates new vulnerabilities, particularly where critical processes depend on complex algorithms or third-party providers. Compliance leaders should recognise that AI governance is becoming inseparable from operational resilience. Institutions that treat AI as an enterprise risk issue—supported by board oversight, clear accountability and robust control frameworks—will be better positioned to meet evolving supervisory expectations and maintain stakeholder confidence.