EBA, EIOPA, and ESMA Warn Financial Firms on AI-Related ICT Risks Across the EU

Europe’s three financial supervisory authorities have issued a joint warning that advanced artificial intelligence is creating a new generation of cybersecurity and operational risks for banks, insurers, investment firms, and other financial institutions across the European Union.

The European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA), and the European Securities and Markets Authority (ESMA) released a coordinated statement on AI-related information and communication technology (ICT) risks. They urged financial firms to strengthen governance, improve risk management, and increase operational resilience.

This warning marks a major shift in regulatory thinking. AI is no longer just a tool for innovation and efficiency. Instead, regulators increasingly view it as a potential source of systemic cyber and operational risk across the EU financial sector.

European regulators issue a coordinated AI risk warning

The joint statement focuses on the rapid growth of frontier AI models. These systems can increase the speed, scale, and sophistication of cyber threats.

The regulators urged financial institutions to improve their ability to identify, assess, prevent, detect, and respond to AI-related ICT risks. In addition, they called on national supervisors to apply a consistent, technology-neutral, and risk-based approach across the European Union.

The statement also builds on earlier warnings from the European Systemic Risk Board (ESRB). The ESRB has warned that advanced AI could amplify cyber vulnerabilities and create wider disruptions across interconnected financial institutions.

Why AI has become a financial stability issue

Artificial intelligence now plays a major role in financial services. Banks and insurers use AI for fraud detection, credit underwriting, algorithmic trading, customer service, claims processing, compliance monitoring, and operational automation.

These technologies can improve efficiency and decision-making. However, they can also help malicious actors.

The regulators warned that advanced AI systems may automate phishing campaigns, generate malicious code, identify vulnerabilities faster, and create more convincing cyberattacks. As a result, AI could become a force multiplier for cyber threats.

Therefore, operational resilience has become a much more urgent priority for financial institutions.

Stronger governance is now a board-level responsibility

The regulators stressed that AI-related ICT risks should not remain only within technology departments. Instead, boards of directors and senior management must take direct responsibility for overseeing these risks.

Financial institutions should establish governance frameworks that include:

• AI risk oversight
• Cybersecurity governance
• Third-party technology risk management
• Incident response planning
• Operational resilience testing
• Continuous monitoring of AI-related threats

Moreover, firms should regularly reassess their AI risk exposure as technology continues to evolve.

DORA and the AI Act provide the regulatory foundation

The joint statement highlights two key EU frameworks: the Digital Operational Resilience Act (DORA) and the AI Act.

DORA requires financial institutions to strengthen operational resilience and improve ICT risk management. It also increases oversight of critical third-party technology providers.

Meanwhile, the AI Act introduces a risk-based framework for the development and deployment of artificial intelligence systems across the European Union.

However, the regulators made it clear that minimum compliance may not be enough. They encouraged firms to adopt a more proactive approach to AI governance and cyber resilience.

Third-party AI and cloud providers face growing scrutiny

The statement also highlights third-party technology dependencies. Many financial institutions rely heavily on external providers for cloud computing, AI services, data analytics, and digital infrastructure.

The regulators warned that concentration risks and outsourcing arrangements could create vulnerabilities. If a major AI or cloud provider suffers a disruption, multiple financial institutions could feel the impact.

Under DORA, supervisors are expanding oversight of critical ICT third-party providers. Consequently, AI-related dependencies will likely receive greater regulatory attention.

The cyber threat landscape is changing rapidly

Recent supervisory data identified thousands of major ICT-related incidents across EU financial institutions. A significant share of those incidents had cross-border effects.

This finding shows how quickly operational disruptions can spread across institutions and jurisdictions.

Furthermore, AI could make future incidents even more interconnected. It can accelerate attack execution, increase automation, and reduce the time between vulnerability discovery and exploitation.

As a result, banks, insurers, asset managers, payment firms, and fintech companies must improve resilience faster than the threat environment evolves.

What financial institutions should do now

The joint statement provides a clear roadmap for financial firms.

Regulators expect institutions to:

• strengthen AI governance frameworks;
• improve cybersecurity monitoring;
• enhance incident response capabilities;
• assess AI-related third-party risks;
• increase board-level oversight;
• integrate AI risks into enterprise risk management;
• conduct resilience testing against AI-enabled cyber scenarios.

These expectations will likely become even more important as DORA supervision expands across the European financial system.

The bigger picture

The most important takeaway is that European regulators are reframing AI as an operational resilience and financial stability issue.

Previously, discussions focused mainly on AI innovation. Now, the focus has shifted toward resilience, governance, and cyber risk.

This change reflects a broader global trend. AI governance, cybersecurity, cloud resilience, and third-party technology risk are becoming closely connected.

Consequently, the EBA, EIOPA, and ESMA are likely to increase supervisory attention on AI-related ICT risks in the coming years.

Bottom line

The joint statement from the EBA, EIOPA, and ESMA is one of the strongest regulatory warnings yet on AI-related cybersecurity and operational risks.

The three authorities have called for stronger governance, better ICT risk management, and consistent supervision across the European Union. Therefore, AI resilience is becoming a strategic requirement for the financial sector.

For banks, insurers, investment firms, payment providers, and fintech companies, the message is clear. The AI era requires not only innovation, but also stronger governance, stronger cyber defenses, and continuous operational resilience.

EBA, EIOPA and ESMA call for enhanced governance and consistent supervision to mitigate ICT risks from frontier AI models in the EU financial sector

#ESMAAI cybersecurityAI governanceAI-related ICT risksArtificial Intelligencebanking regulationcyber resiliencedigital operational resilienceDORA regulationEBAEIOPAEU financial regulationEuropean Unionfinancial servicesfinancial supervisionfintechICT risk managementinsurance regulationoperational resilienceRisk Management