ESAs urge consistent supervision of frontier AI ICT risks
EBA, EIOPA and ESMA issued a joint statement calling for cross-sectoral, risk-based supervision to mitigate ICT risks from frontier AI models in EU finance.
The three ESAs are aligning supervisory expectations around frontier AI, emphasising ICT resilience, third-party dependency, and cybersecurity risks. The statement complements DORA, the EU AI Act and the Commission's Cybersecurity and AI Action Plan, signalling closer scrutiny of AI deployment in banking, insurance and markets.
Signals convergence of AI, ICT and operational resilience supervision across EU financial sectors.
Action Required
Review AI governance, model risk, and ICT third-party frameworks against evolving ESA supervisory expectations and DORA obligations.
Joint ESA action foreshadows harmonised supervisory reviews of AI and ICT controls across regulated entities.
Assess AI model inventory, third-party ICT dependencies, and governance controls against ESA statement. Update AI risk taxonomy and integrate into DORA operational resilience testing.
“The ESAs (EBA, EIOPA, ESMA) published a statement calling for a cross-sectoral, risk-based and consistent supervisory approach to mitigate ICT risks stemming from frontier AI models, referencing the European Commission's Action Plan on Cybersecurity and AI and ESRB publications.”