ECB urges banks to prepare action plans for AI-enabled cybersecurity threats
The European Central Bank warned that advanced AI models like Anthropic's Mythos pose growing cybersecurity risks to banks by enabling rapid vulnerability identification and exploitation. The ECB required 110 supervised banks to submit action plans by October 31, 2026, addressing these AI-enabled threats and strengthening their cyber resilience.
What happened
The European Central Bank's supervisory board sent a letter to 110 banks on 5 July 2026 requiring them to submit action plans by 31 October 2026 to address cybersecurity risks posed by advanced AI models.
The ECB stated that emerging AI models such as Anthropic's Mythos are capable of identifying software vulnerabilities and generating exploitation tools at unprecedented speed, reducing the time between discovery and exploitation of vulnerabilities.
Reported impact
The ECB warned that advanced AI models represent a 'long-term shift in the threat landscape rather than a temporary phenomenon' and significantly amplify the speed and scale at which cybersecurity risks materialise, with implications for the confidentiality, integrity and security of financial institutions' IT systems.
The European Systemic Risk Board warned of growing 'systemic cyber risks stemming from frontier artificial intelligence models,' noting that advanced AI models were already being used by malicious actors to enhance cyberattacks.
Index analysis
The ECB identified vulnerability management, systems updates, third-party technology supplier supervision and incident response as priority areas for bank action plans.
Governance controls
The ECB emphasized that responsibility for responding to the evolving cyber-risk environment lies with banks' management bodies and stated that banks must review decisions on IT technology investments, resource allocation and governance mechanisms.
The ECB grounded its requirements in the Digital Operational Resilience Act (DORA) and asked banks to provide action plans detailing immediate and longer-term measures, assigned resources, defined responsibilities and execution timelines.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.