The ECB's October 31 deadline: What the supervisory letter on AI-powered cyber threats requires

By letter dated July 7, 2026, ECB Banking Supervision has requested the Chief Executive Officers of all significant institutions in the euro area to submit an action plan against AI-powered cyberattacks by October 31, 2026. The letter (SSM-2026-0301), signed by the Chair of the Supervisory Board Claudia Buch, was published alongside a warning from the European Systemic Risk Board (ESRB) on systemic cyber risks arising from powerful frontier AI models. A few days later, the three European Supervisory Authorities — EBA, EIOPA and ESMA — made it clear that they view addressing these risks as a duty under DORA, for banks, insurers and investment firms alike. The message is clear: from the supervisors' perspective, AI-powered attacks are no longer a future issue, but an immediate area for action.

Why the supervisor is acting now

The trigger is the rapid advancement of so-called frontier models — the most powerful AI systems on the market. In the ECB's assessment, they are fundamentally changing the economics of cyberattacks: the window of opportunity between finding a vulnerability and exploiting it is shrinking dramatically because AI systems can find weaknesses faster, develop exploits more quickly, and automate attacks on a larger scale. At the same time, generative tools are lowering the costs of convincing phishing, voice cloning, and deepfakes.

The supervisory authority is explicitly treating this as a permanent shift in the threat landscape, not a temporary spike. And the concern goes beyond individual institutions: a successful attack on critical payment infrastructure or a loss of trust in the data integrity of a major bank would affect the financial system as a whole.

What the letter concretely demands

The ECB expects every significant institution to submit an action plan to its Joint Supervisory Team by October 31, 2026. In terms of content, the letter addresses several priorities:

• Accelerate vulnerability and patch management. When attackers exploit gaps faster, closing these gaps must also be faster and more automated — across the board, not just for a few core systems.

• Reduce the attack surface. Institutions should identify and decommission internet-exposed systems if they are not needed.

• Strengthen detection and response. Monitoring must keep pace with automated, rapidly changing attack patterns.

• Review third parties and supply chains more closely. Risks from software and technology providers belong in the scope — a point that links directly to DORA's requirements on ICT third-party risk.

• Modernize legacy technology. Systems that are unsupported or at the end of their life cycle are considered preferred entry points and should be replaced.

A relieving element is also worth mentioning: to free up capacity for the action plans, the ECB is postponing the annual IT Risk Questionnaire survey from September 2026 to February 2027.

No new law — but a binding expectation

Formally, the letter does not create new legislation. It concretizes supervisory expectations based on the existing framework, above all the DORA Regulation which has been in force since January 2025. This is precisely where its impact arises: the requirements for ICT risk management, resilience testing, and third-party supervision already exist — the letter makes it clear that supervisors will now explicitly measure compliance against the benchmark of AI-powered threats. Institutions should assume that the action plans will feed into ongoing supervision and that progress will be tracked.

The other side of the coin: AI in defense

The letter is about risk — but at the same time, it is an argument for the structured use of AI in defense. Attack patterns that change in minutes instead of days can no longer be managed manually. Anomaly detection in transaction data, automated prioritization of vulnerabilities, and AI-powered analysis of security events are evolving from a nice-to-have to a necessary tool.

The consequences reach far beyond security teams. Using AI productively against attacks requires the same foundation as AI in customer business: clean, up-to-date, access-controlled data, clear responsibilities, and understandable models. Data platforms that prepare customer data for segmentation and personalization, and security architectures that protect that same data, are two sides of the same governance task. Institutions that are already modernizing their data landscape for customer lifecycle applications should build in security and resilience requirements from the very beginning — instead of retrofitting them later.

What needs to be done now

Little time remains until the end of October. Proven steps for the coming weeks:

1. Inventory taking along the priorities of the letter. Where does the institution stand regarding patch speed, attack surface, detection, third parties, and legacy systems? An honest gap analysis is the foundation of the action plan.

2. Consolidate responsibility. The plan affects IT, information security, procurement, data management, and business units. Without a clear mandate, five sub-plans will not become a unified action plan.

3. Prioritize instead of simulating completeness. The ECB emphasizes that institutions should focus their resources on the key areas. A credible, prioritized plan with milestones is more convincing than an exhaustive catalog with no implementation path.

4. Reuse DORA work. Registers of ICT third-party providers, resilience tests, and incident processes from DORA implementation provide direct building blocks for the action plan.

Conclusion

The ECB letter of July 7 marks a turning point: AI-powered cyber risk is now officially a board-level issue and part of ongoing supervision. The deadline of October 31, 2026, is ambitious but achievable — especially for institutions that have taken their DORA implementation seriously. And those who approach the necessary modernization of data, systems, and security architecture strategically will win twice: greater resilience against attacks and a better foundation for the productive use of AI in customer business.