ECB demands major banks plan against AI cyber threats

What happened?

The European Central Bank (ECB) has taken an unprecedented step by requiring major eurozone banks to submit, by October, a specific plan to protect against cyber threats generated by frontier artificial intelligence (frontier AI). According to The Next Web on July 16, 2026, the regulatory body, led by Claudia Buch, fears that a sufficiently intelligent AI model could infiltrate the financial system. This directive applies to systemically important institutions directly supervised by the ECB, including giants such as Deutsche Bank, BNP Paribas, Santander, and Unicredit, among others. The communication was made via a letter addressed to the boards of these banks, according to sources close to the regulator.

Why is it important?

This is the first time a top-tier financial regulator has required banks to have an explicit plan against cyberattacks based on frontier AI. The move acknowledges that advanced AI models, such as Claude, GPT-4, or Gemini, are not only defensive tools but can also be used by attackers to automate intrusions, generate adaptive malware, or impersonate identities with unprecedented realism. The ECB anticipates a qualitative leap in the offensive capabilities of cybercriminals, as frontier AI enables attacks at scale with real-time learning and adaptation. According to the ECB, the risk is not theoretical: attempts to use advanced models for social engineering and hyper-personalized phishing have already been detected. The directive comes amid a 40% increase in cyberattacks on the financial sector in 2025 compared to the previous year, according to data from the Bank for International Settlements (BIS).

Consequences for banks and the sector

Affected banks will need to invest in new detection, response, and simulation capabilities for AI-based attacks. This includes everything from specialized AI teams to real-time monitoring systems, as well as specific stress tests against frontier models. The ECB has suggested that plans should cover scenarios such as impersonation of senior executives via voice or video deepfakes, manipulation of trading algorithms, and exploitation of vulnerabilities in financial service APIs. The measure could also raise operational and compliance costs, although the ECB presents it as a necessary investment for system stability. European banks already spend around €5 billion annually on cybersecurity, and this new requirement could increase that figure by 10-15% in the short term. In the long run, other regulators, such as the US Federal Reserve or the Bank of England, are expected to follow suit, creating a global standard for cyber resilience against AI. In fact, the ECB has already coordinated with the European Banking Authority (EBA) to align this directive with upcoming updates to ICT risk guidelines.

What should readers know?

For users and businesses, this regulation means banks will be better prepared to protect their data and funds against increasingly sophisticated attacks. However, it is also a reminder that frontier AI poses systemic risks. Readers should monitor how these measures evolve and consider cybersecurity a key factor when choosing financial institutions. Additionally, banks are likely to start proactively communicating their defensive AI investments, which could influence consumer trust. On the other hand, the measure could accelerate the adoption of technologies such as advanced biometric authentication and quantum encryption, although these solutions are still in early stages.

"Frontier AI is a double-edged sword: it can defend or attack. The ECB has decided banks must be ready for the worst."

Context and comparisons

This directive adds to other regulatory initiatives such as the EU AI Act, which classifies AI systems by risk level, and the cyber stress tests the ECB has been conducting since 2022. Unlike these, the new requirement focuses exclusively on threats from frontier AI models, indicating an evolution in risk perception. While AI was previously seen as a defensive tool, it is now considered a potential offensive threat. In comparison, the EU AI Act does not yet specifically address malicious use of frontier models by non-state actors, leaving a gap that the ECB is filling with this directive. Moreover, the ECB conducted a generative AI cyberattack simulation exercise in 2024, whose results, according to internal sources, revealed critical vulnerabilities in authentication systems and customer communication channels. This exercise is believed to have motivated the current decision.

Speculation and unconfirmed

It has not been confirmed whether the ECB has specific information about real attacks using frontier AI, nor which specific models are of concern. Penalties for non-compliance are also not detailed, though speculation suggests they could include fines of up to 2% of annual revenue, similar to GDPR penalties. The information comes exclusively from The Next Web and has not been officially corroborated by the ECB. However, the source's credibility is high, as it had access to the ECB letter. It is unknown whether banks have already begun preparing their plans or if a draft of technical requirements exists. It is also unclear whether the directive will extend to mid-sized banks in the future.