The European Central Bank has asked European banks to strengthen their defences against cyber risks linked to advanced artificial intelligence, giving them until November to put protections in place.
A tight deadline
The ECB wants banks to update their systems, tighten security and test new safeguards before AI-related threats become a real problem for the financial system. Many experts consider the timeline tight: AI is advancing faster than many banks’ technology teams can keep up with.
The model behind the concern
Part of the background to the warning is the emergence of AI systems with exceptional abilities in cybersecurity, such as Anthropic’s Claude Mythos Preview, a model that can identify vulnerabilities in software. Because those capabilities could also be used to attack systems, Anthropic chose not to release the model publicly. Instead, it has given access to a limited group of technology, cybersecurity and financial companies — including Amazon Web Services, Apple, Google, Microsoft, Nvidia, CrowdStrike, Cisco, Broadcom, Palo Alto Networks, JPMorgan Chase and the Linux Foundation — so that they can find and fix flaws in critical software.
Why banks are exposed
Banks rely on complex, interconnected systems, much of them built on older software. If attackers gained access to AI tools capable of finding weaknesses quickly, those systems could be exposed. Because banks are so interconnected, a successful attack on one large institution could spread through the financial system — a systemic risk.
What the ECB expects
- Security by design: building security into systems from the start rather than patching problems later.
- Monitoring: detecting intrusions early.
- Rapid response: being able to isolate affected systems quickly and limit the damage.
- Regular testing and updating as the technology evolves.
The other side of the coin
The same AI tools that could help attackers can also help defenders, by finding and fixing vulnerabilities before they are exploited. That is the logic behind limited access programmes like the one for Mythos. For European banks, the question is whether they can obtain and use such defensive tools quickly enough — a concern also reflected in the European Commission’s recent plans to secure structured access to advanced AI for cybersecurity.
The ECB’s deadline is a sign that regulators now see AI not just as an opportunity for the financial sector, but as a potential source of systemic risk that must be managed.
