The ECB Asked Banks for AI-Cyber Plans. What Happens After the Deadline?

The October 31 deadline has passed. Around 110 euro-area banks were in scope for a European Central Bank request to explain how they would strengthen cybersecurity against AI-enabled threats. Yet the ECB has not publicly disclosed how many plans arrived, what they contain or whether supervisors have identified common weaknesses.

That leaves an important question unresolved. Banks have been asked to explain how they will respond to faster, more scalable cyberattacks. Supervisors now need to determine whether those plans are credible, adequately resourced and capable of addressing weaknesses already identified in the banking system.

The exercise follows a warning from the European Systemic Risk Board (ESRB), which raised its assessment of systemic cyber risk from "elevated" in March to "severe" in June, citing frontier AI models.

A Deadline That Changed Supervisory Priorities

On July 7, 2026, ECB Supervisory Board Chair Claudia Buch sent a letter titled Addressing AI-enabled cybersecurity threats to the CEOs of significant institutions.

The letter called for comprehensive cybersecurity action plans to be submitted to the banks' respective Joint Supervisory Teams (JSTs) by October 31.

The ECB was concerned that AI could accelerate vulnerability discovery, exploitation and cyber operations, placing additional pressure on established defensive processes.

Banks were asked to address six areas: attack-surface protection, vulnerability management, monitoring and detection, governance and supplier assurance, defence-in-depth, and operational resilience.

The request builds on the Digital Operational Resilience Act (DORA), which has applied since January 2025. It introduces no new AI-specific cybersecurity regulation. The ECB's approach is to reassess whether existing controls and resources remain adequate as the threat environment changes.

The supervisory priority was significant enough for the ECB to move its IT Risk Questionnaire collection deadline from September 2026 to February 2027, giving institutions additional capacity to focus on cyber resilience.

The Vulnerability That Cannot Be Patched

Consider an ageing banking system that cannot be patched promptly because of technical limitations or dependencies on an external provider.

A vulnerability assessment might identify the exposure. A security team might recommend remediation. Yet the system remains vulnerable while the bank determines whether it can accelerate changes, introduce compensating controls or replace the technology.

Under the ECB's approach, that unresolved weakness becomes part of a wider management decision.

An action plan should identify the proposed measure, the resources needed, who is responsible and when implementation is expected. For an ageing system, supporting evidence could include vulnerability records, compensating controls, supplier commitments and a modernisation schedule.

The ECB does not prescribe that evidence package or a standard submission template. Its letter asks for concrete measures, necessary resources, clear roles and responsibilities, and defined implementation timelines.

This matters because the ECB already has a history of identifying cyber-resilience weaknesses. Its 2024 cyber-resilience stress test covered 109 banks, and the July letter specifically calls for unresolved findings from that exercise, inspections and targeted reviews to be addressed "without delay."

What that phrase means for an individual remediation programme remains unspecified.

A bank with a long-standing infrastructure weakness may therefore face two connected questions: why the issue remains unresolved and whether its current remediation timetable is appropriate for an environment in which exploitation can happen faster.

Where Supervisory Expectations Become Complicated

The letter's legal status has prompted differing interpretations.

Some legal and advisory commentators describe the request as a material escalation of supervisory expectations. Others emphasise that it does not itself create new legislative obligations.

The ECB's wording is narrower than either extreme. It is "calling on" banks to act and says plans "should be submitted." Annex 1 lists six areas the plans should address, with suggested actions for each.

The letter does not establish a uniform remediation deadline, a mandatory evidence checklist or a specified penalty for missing the submission date.

It does establish a supervisory follow-up process.

Management bodies retain primary responsibility for the response, including assessing whether staffing, budgets, tools and risk tolerance remain appropriate. JSTs will discuss the plans and monitor implementation.

The ECB will also conduct a horizontal analysis across institutions, looking for common trends, challenges and areas for improvement.

That second review is potentially the most revealing part of the exercise.

What the ECB Still Needs to Establish

In an October 30 interview with Bloomberg, ECB Supervisory Board member Pedro Machado described "very swift and effective patching exercises" as the biggest challenge. He said a substantial assessment would only be possible after the ECB received the banks' plans.

The distinction between submitting a plan and demonstrating progress is consequential. October 31 was the submission deadline, not the date by which every remediation measure had to be completed.

As of November 10, 2026, no public ECB disclosure of submission totals or initial supervisory conclusions has been identified. The ECB has also not published its horizontal-review methodology, assessment criteria or timetable.

The plans may eventually reveal whether delayed patching is concentrated in particular institutions or reflects wider constraints involving legacy infrastructure, supplier dependencies and change-management capacity.

For now, supervisors have requested the information needed to investigate those questions. The next test is whether the cross-bank review can distinguish institutions with workable remediation capacity from those whose weaknesses remain open.

Further Reading

• ECB, Addressing AI-enabled cybersecurity threats, SSM-2026-0301
• European Systemic Risk Board, Warning ESRB/2026/3
• ECB, 2024 Cyber Resilience Stress Test
• Regulation (EU) 2022/2554, Digital Operational Resilience Act
• ECB, Interview with Bloomberg, October 30, 2026