Banking Regulators Intensify Oversight of AI Risks Worldwide

Authorities in multiple jurisdictions have increased scrutiny of artificial intelligence in banking, focusing on cyber resilience and risk management. Recent actions by European, US, UK, and Australian regulators reflect a coordinated effort to address evolving risks tied to AI adoption in financial services.

In July 2026, the European Central Bank issued a letter instructing banks to submit plans by the end of October on how they will address cyber threats involving AI, including requirements for improved back-up and recovery processes. Banks in the euro zone have also been asked to map out their use of AI across both internal operations and third-party providers to better understand dependencies and ensure systems can be safely shut down and restarted.

US regulators, including the Federal Reserve, began in October 2026 to query banks about their use of advanced AI models. Topics covered in these queries include the deployment of technology developed in China, the use of AI agents for cyber defence, and oversight of autonomous systems. In June 2026, US authorities also requested banks to identify AI use in high-risk areas such as lending, customer verification, and sanctions screening, and to provide details on governance, third-party risk, and contingency planning.

In the UK, the Financial Conduct Authority, Bank of England, and Treasury jointly issued a statement in May 2026 urging firms to enhance governance, risk management, and cyber resilience in response to risks from advanced AI systems. The UK approach has involved collaboration with industry rather than imposing new regulatory requirements at this stage.

What the numbers show

• ECB set an end-October 2026 deadline for AI cyber threat plans.
• US regulators conducted AI usage queries in June and October 2026.
• UK’s FCA published the Mills Review in July 2026.

In July 2026, the UK’s Financial Conduct Authority published the Mills Review, which outlined how AI could change retail financial services by 2030. The review recommended steps such as strengthening the regulatory perimeter and expanding the FCA’s AI Lab to address new challenges.

The Australian Prudential Regulation Authority called for a step-change in AI-related risk management and governance in April 2026. The authority stated that current practices in the country’s banking sector do not keep pace with the speed and complexity of AI adoption, and urged improvements in oversight and controls.

Across these jurisdictions, regulatory bodies have focused on ensuring that banks have robust frameworks to manage the risks associated with AI, including cyber threats and operational dependencies. Mapping AI usage and developing contingency plans are central components of these regulatory expectations.

While the approaches differ, with some authorities emphasizing collaboration and others setting deadlines for compliance, the trend among regulators is toward more active supervision of AI risks in banking. These actions are aimed at maintaining stability and resilience as AI technologies become more integrated into financial systems.

* This article is based on publicly available information at the time of writing.