European Supervisors Demand Improved Governance Amid AI Risks
EBA, EIOPA, and ESMA urge enhanced oversight to mitigate ICT risks from AI models in the EU financial sector.
Key Takeaways
- European supervisors call for a risk-based approach to AI models.
- Strong governance frameworks are needed to mitigate cybersecurity risks.
- DORA oversees critical third-party ICT providers to enhance resilience.
The European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA), and the European Securities and Markets Authority (ESMA) have issued a joint statement calling for a consistent risk-based supervisory approach to mitigate ICT risks arising from advanced artificial intelligence (AI) models in the European Union financial sector.
Regulatory Requirements and Suggested Actions
This statement is based on existing regulatory requirements, the European Commission's Cybersecurity Action Plan, and publications from entities such as the European Systemic Risk Board (ESRB) and the European Union Agency for Cybersecurity (ENISA). European supervisors want financial entities to strengthen their operational resilience against cybersecurity risks associated with advanced AI models. Emphasis is placed on prevention, detection, and effective management of these risks.
Governance and Risk Management
It is essential that financial entities have robust governance and risk management frameworks to effectively manage the cybersecurity risks linked to advanced AI models. This recommendation also includes updates on ongoing and planned supervisory activities under the Digital Operational Resilience Act (DORA) for Critical Third Party Providers of ICT (CTPP).
Supervisory Dialogue and System Resilience
The ESAs encourage financial entities and competent authorities to utilize the statement as a basis for effective supervisory dialogue. This approach would help ensure that the EU financial system remains resilient against risks driven by emerging AI technologies.
For additional inquiries: Tayfun Yilmaz, Communications Officer, [email protected].
Frequently Asked Questions
What do EBA, EIOPA, and ESMA propose regarding AI risks?
They propose a consistent risk-based supervisory approach to mitigate ICT risks from AI models in the financial sector.
What is the significance of DORA in this context?
DORA oversees activities related to critical third-party ICT providers to strengthen operational resilience against cybersecurity risks.
How should the financial sector respond to this statement?
Entities should strengthen their governance frameworks and use the statement as a basis for supervisory dialogue with competent authorities.
Tags
About the author
Miguel Sandoval
Regulatory Affairs Correspondent
Miguel Sandoval tracks gambling legislation, licensing, and regulator enforcement — from Spain's DGOJ and the Latin American authorities to the UKGC, the MGA, and the state-by-state map in North America. The reports answer three questions precisely — what changed, where, and who it affects — with jurisdictions, dates, and penalties cited exactly as published. Operators and compliance officers read Miguel Sandoval to know which rulebook moved before their next meeting.
More from Miguel Sandoval
