AI-boosted cyberattacks: ECB wants banks' plans by October 31

Large eurozone banks have until October 31 to submit to the European Central Bank (ECB) an action plan against cyberattacks facilitated by artificial intelligence. The deadline was set in a letter sent on July 7 by Claudia Buch, chair of the ECB's Supervisory Board, to the heads of the roughly 110 banks it directly supervises. In an October 13 article, Reuters reports, citing six sources, that US and European banking regulators are increasingly questioning banks about their use of AI.

What the ECB is asking for

The letter starts from a finding: AI models can now find vulnerabilities and quickly produce working exploits, which shortens the time between the discovery of a flaw and its exploitation. According to Claudia Buch, these developments "significantly" increase the speed and scale of the risks. Each plan must specify the measures, resources, owners and timeline. According to an analysis by the law firm A&O Shearman, short-term priorities include patch management at scale, AI-assisted detection and oversight of third-party providers. Also according to Reuters, banks must also map their uses of AI, including at their suppliers, so they can safely shut down and restart their systems.

The ECB is not creating a new rule: the EU's DORA regulation on digital operational resilience remains the reference framework. To free up resources, it is postponing its annual IT risk questionnaire from September 2026 to February 2027. It also announces a separate communication on post-quantum cryptography.

Washington and London ask their questions

According to Reuters, the US Federal Reserve and two other banking regulators are questioning banks: do they use AI technologies built in China? Do they entrust their cyber defense to AI agents? What limits do they impose on them, and would they be able to shut them down? Asked by Reuters, the three agencies declined to comment. The Bank of England and the ECB, for their part, are pushing banks to improve their incident recovery plans. UK supervisors would like the largest institutions to study backup systems entirely separate from their main IT, without imposing any new rules for now.

What every company can take away

• Shorten patch deployment times, starting with Internet-facing equipment.
• Inventory uses of AI, including those of providers, and know how to shut down an AI agent.
• Actually test restoration from backups isolated from the main system.
• Put senior management in charge of the issue, as the ECB requires.