European financial watchdogs have called for a consistent, risk-based approach to supervising cyber and technology risks linked to “frontier” AI models used in the EU financial sector, according to a joint statement by the European Supervisory Authorities (EBA, EIOPA and ESMA).
The authorities declared on Saturday that the approach should apply across different parts of the financial system and focus on reducing ICT risks — problems affecting information and communications technology, such as cyber incidents and disruptions — stemming from frontier AI models.
Their statement references existing regulatory requirements as well as the European Commission’s Action Plan on Cybersecurity and Artificial Intelligence, and also takes account of recent publications by the European Systemic Risk Board, the EU Agency for Cybersecurity (ENISA), the Single Supervisory Mechanism and other authorities.
The watchdogs set out measures for financial firms to strengthen “operational resilience”, meaning their ability to keep services running and recover quickly when hit by technology failures or cyber attacks.
Governance, risk management and oversight
Financial companies should have robust governance and risk management frameworks to manage and reduce cyber risks linked to frontier AI models, the authorities said.
The statement also provided an update on ongoing and planned oversight work under the EU’s Digital Operational Resilience Act (DORA), including supervision of critical ICT third-party providers — outside technology suppliers that financial firms rely on for key services — according to the same document.
Financial firms and national regulators were encouraged to use the statement as a basis for supervisory dialogue, taking account of existing supervisory expectations.
