European Central Bank Orders Banks to Develop AI Cybersecurity Defense Plans

The European Central Bank has ordered euro zone banks to develop plans to defend against AI-enabled cyber threats by October 31. The directive, prompted by powerful new AI models like Anthropic's Mythos, requires banks to accelerate patching and modernize systems. The European Systemic Risk Board has warned these threats pose a systemic risk to the financial system, potentially eroding trust and triggering bank runs.

ECB cybersecurity directive

• ▪The European Central Bank has ordered euro zone banks to create plans to counter AI-enabled cyber threats by October 31
• ▪To help banks focus resources on the new directive, the European Central Bank has postponed a separate IT survey
• ▪The ECB's top supervisor, Claudia Buch, communicated the directive in a letter to bank chief executives

AI-enabled cyber threats

• ▪The ECB stated that AI developments have "profound implications" for the confidentiality, integrity, and resilience of banks’ IT systems
• ▪The directive responds to concerns about advanced AI models, such as Anthropic's Mythos, whose cyber capabilities are very powerful

Bank protection requirements

• ▪Banks must prioritize protecting internet-facing systems and other exposed technology assets, including third-party software and open-source components
• ▪Banks are also required to modernize aging technology, improve cyber hygiene, and strengthen crisis-management and recovery plans
• ▪The ECB urged lenders to accelerate software patching and vulnerability fixes, and to strengthen monitoring and AI-enabled cyber defenses

ESRB systemic risk warning

• ▪The ESRB, a European Union body, considers the development of powerful AI a source of systemic risk to the financial system
• ▪The European Systemic Risk Board (ESRB) warned that large-scale cyber disruptions could erode trust in financial institutions and trigger bank runs

Attack scenarios

• ▪The ESRB warned that cyber incidents could spread quickly due to the financial sector's reliance on common technology providers and shared software
• ▪Potential attack scenarios outlined by the ESRB include state-backed espionage and coordinated attacks on payment, clearing, and settlement systems