Banks must submit frontier AI risk plans by end-2026
Giuseppe Siani, Bank of Italy banking and financial supervision head, said supervised banks must submit frontier AI risk plans by end-2026. He spoke at CETIF, Università Cattolica del Sacro Cuore, in Milan on October 14, 2026.
Technology dependence tests bank resilience
The Bank of Italy requires directly supervised intermediaries to assess frontier AI exposures, assign responsibilities, fund remediation and submit plans by end-2026.
IT incidents rose 80 percent in 2023-25 against the preceding three years; cyber incidents represented a quarter in 2025.
Over two-thirds interrupted services, some for more than 24 hours, and half involved suppliers.
In 2025, supervisors mapped over 3,700 ICT suppliers and subcontractors, about 10,000 contracts and €2.4 billion in annual spending.
Supply chains reached five levels; half of suppliers supporting critical functions were hard or impossible to replace.
Siani called for stronger controls, testing and supplier contracts under the Digital Operational Resilience Act (DORA).
Credit grows but recoveries lag
Private non-financial sector lending rose 3.3 percent year-on-year in July, led by larger firms; lending to weaker small firms still contracted.
Credit quality remained high.
Supervisors are gradually extending calendar provisioning expectations for pre-2019 loans to smaller banks, with case-specific exemptions.
NPL securitization securities totaled about €80 billion at end-2025: €22 billion in publicly guaranteed senior tranches and €58 billion in other securities.
Repayments reduced state exposure to €6.3 billion; recoveries slowed, particularly for pre-2019 guaranteed deals.
Human oversight must be substantive
Siani said human oversight requires information, skills and time, not merely formal participation.
Agentic AI requires traceable decisions, defined delegation and controls proportionate to autonomy and risk.
The Bank of Italy, IVASS and Consob will oversee high-risk financial AI systems under the AI Act.