ECB orders eurozone banks to submit AI cyber action plans by 31 October
7 JULY 2026, FRANKFURT
The European Central Bank issued supervisory communication SSM-2026-0301 on 7 July 2026, ordering eurozone banks to submit AI cyber action plans to their Joint Supervisory Teams by 31 October 2026. The communication, associated with Supervisory Board Chair Claudia Buch, builds on DORA and reflects closer supervisory attention to the risks that emerging technology brings to the banking sector.
The order's reach extends past artificial intelligence. The communication closes by saying that post-quantum adoption must start now, and signals that a separate quantum supervisory letter will follow. That pairing tells banks the ECB treats post-quantum readiness as a near-term supervisory concern, not a distant one, even though the October deadline itself applies to the AI cyber plans.
Because the plans go to the Joint Supervisory Teams that oversee each bank, the exercise feeds directly into ongoing supervision. A bank's answer becomes part of how its supervisor judges its technology risk management, so the quality of the plan carries supervisory weight rather than serving as a one-off submission.
Why it matters. The ECB has tied artificial intelligence and quantum together as supervisory priorities and set a firm October 2026 date for the AI cyber plans. Its statement that post-quantum adoption must start now, plus the promise of a dedicated quantum letter, tells eurozone banks to begin cryptographic discovery and planning without waiting for that letter. Banks that start now will be ready to answer when the quantum-specific expectations arrive.