EBA Warns AI Models Increase Cyber Risks for Banks

The European Supervisory Authorities (EBA, EIOPA and ESMA) published their first annual report on major ICT-related incidents in the EU financial sector on June 3, 2026, under the Digital Operational Resilience Act (DORA). The report covers 3,383 major ICT incidents reported by EU financial entities and finds that roughly one third had cross-border impact, driven by shared infrastructure and third-party services. The EBA press release states that "it is key that financial entities uphold to the highest cybersecurity standards to be able to keep pace with the potential use of highly capable AI-driven tools."

System failures and external events were the main incident drivers. Around 10% of reported incidents were directly related to cybersecurity. Cross-border incidents accounted for approximately one third of the total, underscoring growing interconnectedness through shared infrastructure. Direct client and transaction impact was generally limited, but the supervisors flag systemic dimension and third-party risk as the central concern.

The ESAs flag, per the June 2026 DORA report, that highly capable AI-driven tools may amplify the speed and sophistication of exploitation attempts. The report does not frame this as a realized incident type but as a forward-looking operational resilience concern: financial entities should assume that adversaries will use AI tools and should plan accordingly. This framing differs from traditional cyber risk guidance in that it explicitly names AI capability growth as a driver of future risk, not just current incidents.

The DORA ICT incidents report is the first mandatory reporting of its kind under EU law. Its AI-cyber risk flag carries regulatory weight because it will inform supervisory expectations under DORA and the EU AI Act. Banks and insurers operating in the EU should treat this as a signal that their operational resilience frameworks will be assessed against AI-amplified threat scenarios in future supervisory reviews.

Per the report, regulators are also watching third-party and outsourcing risk as channels for AI-enabled exploitation. Practitioners should track follow-on guidance from national competent authorities incorporating the DORA report findings, and monitor whether the EBA publishes more detailed AI-cyber risk guidance in its forthcoming Risk Assessment Reports.