ESAs Urge Enhanced Supervision for AI Risks in EU Finance
EBA, EIOPA, and ESMA emphasize the need for robust governance to manage ICT risks from AI models in the EU financial sector.
Key Takeaways
- ESAs call for enhanced governance to manage AI-related ICT risks.
- A cross-sectoral, consistent approach is emphasized.
- Robust risk management frameworks are crucial for operational resilience.
The European Supervisory Authorities (EBA, EIOPA, and ESMA) have called for a comprehensive supervisory framework to manage ICT risks in the EU financial sector. Their recent statement highlights the challenges from frontier AI models and emphasizes the need for robust governance and risk management systems.
Cross-Sectoral Approach to ICT Risks
On 31 July 2026, the ESAs published a statement advocating for a unified, risk-based supervisory strategy to mitigate ICT risks posed by AI models. This strategy incorporates the European Commission’s Action Plan on Cybersecurity and Artificial Intelligence and aligns with insights from other entities like the European Systemic Risk Board (ESRB) and the European Union Agency for Cybersecurity (ENISA).
The ESAs' paper stresses that financial entities should bolster their operational resilience by addressing threats associated with frontier AI technologies. Key areas highlighted include risk prevention, detection, and management.
Governance and Risk Management
For effective risk mitigation, financial entities must implement robust governance frameworks. These systems are vital in managing cyber threats linked to AI models. Such governance ensures that risk management practices comprehensively address the complexities of AI, maintaining financial stability across the EU.
The statement outlines specific actions financial entities can adopt to enhance their ICT infrastructure's resilience, reinforcing the importance of a strong governance structure.
Integration with DORA
The statement also discusses ongoing and planned oversight activities under the Digital Operational Resilience Act (DORA), particularly concerning critical ICT third-party providers (CTPPs). These efforts aim to enhance the resilience of the financial sector in the face of emerging technological threats.
Encouraging Supervisory Dialogue
In their communication, the ESAs urge financial institutions and regulatory bodies to engage in constructive dialogue. This dialogue should reflect existing supervisory expectations and encourage practices that protect the financial system against AI-driven risks.
The focus on a risk-based, consistent approach ensures that all stakeholders in the financial sector can effectively handle the challenges posed by cutting-edge AI models.
For more details, stakeholders can refer to the full ESMA news release.
Frequently Asked Questions
What ICT risks are associated with AI models in the EU financial sector?
The ICT risks linked to AI models include potential cyber threats that can affect the operational resilience of financial entities. Robust governance and risk management strategies are necessary to mitigate these risks.
What measures are the ESAs recommending?
The ESAs recommend a cross-sectoral, risk-based, and consistent supervisory strategy. This includes enhancing governance frameworks, improving risk prevention, detection, and management, and integrating DORA oversight activities for third-party providers.
How does the statement integrate with existing regulations?
The statement aligns with the European Commission’s Action Plan on Cybersecurity and Artificial Intelligence, considering legislative frameworks and insights from relevant EU bodies to ensure a cohesive approach.
Tags
About the author
Eleanor Whitfield
Regulatory Affairs Correspondent
Eleanor Whitfield tracks gambling legislation, licensing decisions, and regulator enforcement across key markets — from the UKGC, MGA, and Germany's GGL to Spain's DGOJ and the state-by-state map in the Americas. The reporting answers three questions precisely: what changed, where, and who it affects, with jurisdictions, effective dates, and penalty figures named exactly as published. Compliance officers and operators read Eleanor Whitfield to know which rulebook moved before their next board meeting.
More from Eleanor Whitfield
