AI risks a key supervisory priority, Buch tells MEP
Claudia Buch, Chair of the ECB Supervisory Board, informed MEP Fabio de Masi that financial stability risks from advanced artificial intelligence applications are a key supervisory priority for the 2026-28 cycle.
Supervisory focus on AI resilience
Advanced AI models, with enhanced cybersecurity capabilities, pose a growing risk of systemic cyber incidents for financial institutions.
They can rapidly identify and exploit IT vulnerabilities, potentially lowering attack costs.
Consequently, AI risks are a key element of ECB Banking Supervision's 2026-28 supervisory priorities, building on existing cyber and operational resilience efforts.
The ECB has gathered information on banks' AI strategies, engaged in dialogues to assess risk management and governance, and collaborated with the European Banking Authority and the European Artificial Intelligence Board.
Supervisory tools, including the 2024 cyber resilience stress test, on-site inspections, and threat-led penetration tests, have identified weaknesses.
The Digital Operational Resilience Act (DORA) mandates continuous improvement in IT and cyber risk management and robust supply chain oversight.
Banks are encouraged to test scenarios based on AI-driven cyber threats to identify preparedness gaps.
The macroprudential dimension
Rapid AI adoption in finance presents significant financial stability implications, actively monitored by the ECB.
Risks stem from widespread AI use across entities relying on few technology suppliers.
AI, while boosting efficiency, can amplify vulnerabilities if many institutions depend on identical models or infrastructure.
Failures in widely used AI tools or over-reliance on a few providers could create systemic 'too-big-to-fail' externalities.
The ECB assesses these via financial stability monitoring and macroprudential oversight, coordinating with authorities.
Current macroprudential tools are not yet deemed adequate for cyber risk.
The ECB, as an ESRB and FSB member, supports developing a joint global governance framework for responsible AI deployment, noting the FSB's recent consultation on sound AI practices.
AI: Efficiency vs. Systemic Risk
AI offers undeniable efficiency gains but introduces concentrated systemic risks through reliance on few technology providers.
While supervisors are actively engaged, the letter highlights the challenge of applying traditional macroprudential tools to novel cyber threats.
This suggests a gap in the current toolkit, necessitating new approaches beyond existing frameworks to manage evolving risks effectively.