AI cyber risk: what the ECB and the Bank of Italy require from banks

Why the authorities have acted

On 13 May 2026 the Vice-Chair of the ECB Supervisory Board, Frank Elderson, described the capabilities of Mythos, Anthropic's model. According to the ECB, the model finds and exploits vulnerabilities on its own and combines minor flaws into large-scale attacks. It can also derive exploits from published patches in a few hours rather than weeks (Teleborsa, in Italian).

European banks do not have access to Mythos. For Elderson this does not justify inaction; if anything, it makes acting now even more urgent. The next day the ECB asked for updated plans, specific to each institution and in line with DORA (Milano Finanza, in Italian).

In its July letter the ECB makes clear that this is not a risk tied to a single tool. It is a long-term shift: the risks are not new, but they materialise much faster and on a larger scale.

The ECB's request to significant banks

On 7 July 2026 the Chair of the Supervisory Board, Claudia Buch, wrote to the CEOs of significant banks (letter SSM-2026-0301). Each bank must assess the impact of the new scenario and prepare a comprehensive action plan, with concrete measures, resources, roles and implementation timelines. The plan must be delivered to the Joint Supervisory Team by 31 October 2026.

The annex to the letter sets out six areas, four short-term and two structural:

1. Protect the attack surface: inventory of ICT assets, including third-party and open-source software, continuous monitoring of what is exposed to the Internet, cloud and VPNs to third parties.
2. Speed up vulnerability and patch management: prioritised scans, more frequent and more numerous patches, change management that allows rapid intervention, adequate clauses in SLAs with suppliers.
3. Strengthen monitoring, detection and AI-based defences: application and access logs, network traffic, indicators of compromise.
4. Governance, budget, training and supply chain: check that people, tools and capacity for change are sufficient, and remember that the bank remains responsible for outsourced services.
5. Defence in depth and modernisation: segmentation, zero trust, MFA, complete logging, secure development, replacement or protection of legacy systems.
6. Operational resilience: crisis management, tested response and recovery, exercises on high-speed scenarios, information sharing.

The ECB also asks banks to review their risk appetite framework, with metrics and thresholds on patch frequency. To ease the burden, it has moved the annual IT Risk questionnaire from September 2026 to February 2027.

The Bank of Italy's communication for other intermediaries

On 17 July 2026 the Bank of Italy published a communication to the market (in Italian) addressed to the entities it supervises directly:

• less significant banks and banking groups, including Bancoposta;
• payment institutions and electronic money institutions;
• investment firms, asset management companies and alternative investment fund managers;
• crypto-asset service providers and crowdfunding service providers;
• financial intermediaries under Art. 106 of the Consolidated Law on Banking (TUB).

There are six areas: governance, cyber hygiene, management of ICT assets and of the exposure surface, vulnerabilities and patches, monitoring and defence, testing activities. On governance, the Bank of Italy expressly asks that the Board of Directors include technology expertise, including on artificial intelligence. It also asks for precise contractual requirements for suppliers on security monitoring and patch management.

What must be delivered by 31 December

1. The Board of Directors examines the communication in a joint meeting with the Board of Statutory Auditors and starts drafting a report.
2. For each area, the report describes the current level of risk exposure, the adequacy of safeguards, the shortcomings and the priorities.
3. The attached work plan sets out actions, timelines and investments, in proportion to the risk profile, and how the Board will monitor progress.
4. The intermediary notifies the supervisory authority of a point of corporate responsibility, for example the second-level ICT risk control function.

The two requests compared

How to prepare: a suggested path

Those who must deliver the report to the Bank of Italy have about ten weeks left. This is our view of how to use them, to be adapted to the size of each institution and the extent to which its IT is outsourced.

1. Joint meeting and point of responsibility: schedule the Board of Directors–Board of Statutory Auditors meeting straight away and appoint the point of responsibility, because they are the formal prerequisite for the report.
2. Inventory and exposed surface: start from what can be reached from the Internet, including services managed by the outsourcer, because this is the area both authorities put first.
3. Measure patch times: use the ticketing systems to obtain the actual time between publication of a vulnerability and its fix in production, by severity. Without this figure the report cannot describe the current level.
4. ICT suppliers: check clauses on remediation times, evidence of testing and right to audit. Banking outsourcers will receive the same question from all their client banks.
5. Gaps and priorities by area: for each area, shortcomings and actions with timelines and investments, proportionate to the risk profile.
6. Testing: include in the plan exercises on fast, high-volume scenarios, in line with Arts. 24 and 25 of DORA.

This article summarises public documents and does not constitute legal or regulatory advice. For the obligations of each intermediary, the authorities' texts and the guidance of its own compliance function are authoritative.

Frequently asked questions