ECB and artificial intelligence: the action plan banks must deliver against accelerated attacks

Analysis · 2 November 2026 · by cybercoverinsurance

On 7 July 2026 ECB Banking Supervision wrote to the chief executives of the banks it supervises directly. The message is simple: the most advanced AI models find vulnerabilities and write working exploits far faster than before, and banks must adapt. Each bank had to deliver an action plan to its supervisory team by 31 October 2026. The deadline has just passed, and the plans are now on the supervisors' desks.

For anyone underwriting cyber risk the letter matters for two reasons. First, the ECB states in writing that the time between discovering a vulnerability and exploiting it is shrinking. That is a change in expected claims frequency, not only a compliance topic. Second, the six areas the ECB asks banks to cover are, almost one by one, the questions of a good underwriting questionnaire for a bank.

In brief

• The letter is signed by Claudia Buch, Chair of the ECB Supervisory Board, and addressed to significant banks in the euro area.
• According to the ECB, frontier models compress the time between discovery and exploitation of vulnerabilities: a structural change in cyber risk.
• Each bank had to deliver by 31 October 2026 an action plan with measures, resources, roles and timelines. The supervisory team monitors implementation and the ECB will run a horizontal analysis.
• Responsibility lies with the management body. Open findings, including those from the 2024 cyber stress test, must be closed.
• On the same day the European Systemic Risk Board (ESRB) published a warning on systemic cyber risks from frontier models, and in June it had raised systemic cyber risk from "elevated" to "severe".

What the ECB asks for

The threat. The letter describes AI models able to identify vulnerabilities and generate working exploits quickly, "compressing the timeline between vulnerability discovery and exploitation". The ECB calls this a structural shift, not a temporary spike (ECB, letter to banks).

The action plan. By 31 October 2026 each significant bank had to send its joint supervisory team a plan setting out control measures, resources, roles and implementation timelines. The supervisory team monitors progress. The ECB will run a horizontal analysis of the plans and may hold technical workshops with banks (ECB letter; A&O Shearman).

Who is accountable. Primary responsibility lies with the management body. Banks must close findings already raised by supervisors, including those from the 2024 cyber resilience stress test (ECB letter).

The six areas in the annex. The plan must cover:

1. Attack surface and inventory. A complete inventory of systems, including third-party and open-source components.
2. Faster vulnerability and patch management. Accelerated remediation times, also written into supplier contracts and service level agreements.
3. Monitoring and detection. Detection capabilities matched to the new speed, including AI-enabled defences.
4. Governance, resources and suppliers. Funding, training and supply chain assurance. The bank remains accountable for outsourced risk and must review its risk appetite, including patching metrics.
5. Defence in depth. Zero trust, network segmentation, multi-factor authentication, least privilege and replacement of legacy systems.
6. Response, recovery and sharing. Exercises on waves of zero-day vulnerabilities, ransomware and supplier or cloud outages, and threat information sharing.

The supervisory calendar. The ECB moves the IT risk questionnaire deadline from September 2026 to February 2027, to make room for the plans. It recalls that DORA requirements remain fully valid and announces a separate letter on post-quantum cryptography, whose adoption "must start now" (ECB letter; KPMG).

The systemic picture: the ESRB warning

On the same 7 July the ESRB published a warning on systemic cyber risks linked to frontier models. The ESRB calls these models "a paradigm shift for cybersecurity". In the long run they should strengthen resilience, but in the short and medium term they give attackers an edge, letting them find vulnerabilities and attack faster, at greater scale and with more sophistication (ESRB, press release).

The ESRB also flags a concentration risk: the main providers of frontier models are largely outside the Union, creating strategic dependency and geopolitical risk. It asks authorities to reflect these risks in supervision and calls for a coordinated response from AI and software providers, security firms, open-source maintainers, financial institutions and authorities (Osborne Clarke; Regulation Tomorrow).

What changes for those who insure banks

Expected frequency goes up. If the time between publication of a vulnerability and attack gets shorter, the window in which a bank is exposed on an unpatched system grows in proportion to its patching delay. A pricing model based on historical claims frequency underestimates the risk of slow patchers. Mean time to patch critical vulnerabilities becomes a pricing variable, not just a questionnaire item.

Accumulation risk grows. A wave of zero-day vulnerabilities exploited in parallel hits many insureds at the same moment, especially if they use the same software or the same cloud provider. The ECB explicitly asks for exercises on this scenario. For a portfolio of financial institutions it is the accumulation scenario to model: one event, many claims, in the same week.

The supplier is still the bank's problem. The ECB repeats that the bank remains accountable for outsourced risk and asks for patching times written into supplier contracts. This is consistent with DORA, which already requires ICT third-party risk management. For an underwriter, the supplier contract is documentary evidence: if remediation times are missing, the risk of supplier-driven interruption is less controlled.

The plan is a document to ask for. Significant banks have just produced a document that describes, for the six areas, measures, resources and timelines. Asking for a summary at renewal gives the underwriter up-to-date information already endorsed by the bank's top management. Comparing what was planned with what was delivered, at the next renewal, measures the quality of management.

Smaller banks are not off the hook. The letter covers only significant banks, supervised directly by the ECB. Less significant banks, supervised by national authorities, have the same technical exposure but no deadline. For an insurer, the readiness gap is likely to be widest in this segment.

What to bring to renewals

Impact for insurersHigh

The ECB acknowledges in writing that AI accelerates the exploitation of vulnerabilities and asks significant banks for an action plan: patching speed, supplier risk and accumulation from zero-day waves become central underwriting variables.

On the portfolio side, the letter suggests treating time to patch as a pricing factor and modelling an accumulation scenario of rapid, simultaneous exploitation of vulnerabilities in the software most widely used in the financial sector. For less significant banks, which did not receive the same request, the ECB's six areas are a sound basis for the questionnaire.

Sources

• ECB Banking Supervision – letter to significant institutions on AI-enabled cybersecurity threats, 7 July 2026
• ESRB – press release of 7 July 2026 on the warning on frontier models
• A&O Shearman – ECB requires significant institutions to address AI-enabled cybersecurity threats
• KPMG – ECB calls for an action plan to combat AI-driven cyberattacks
• Osborne Clarke – ESRB warning ESRB/2026/3 and what it means for financial institutions
• Regulation Tomorrow – the ESRB warning and the ECB letter