Published 18 November 2025, the SSM supervisory priorities for 2026–28 set two priorities: resilience to geopolitical and macro-financial uncertainty, and operational resilience with robust ICT capabilities. AI falls under Priority 2: banks 'shall have strategies that effectively reflect opportunities and risks' of new technologies, and the ECB will continue monitoring general AI use while taking a more focused approach to generative-AI applications through targeted workshops, cooperation with AI Act market-surveillance authorities, and DORA-driven on-site campaigns on cybersecurity and third-party risk. The stance is explicitly technology-neutral, focusing on use cases and their risks.
| Document | SSM supervisory priorities 2026–28 — ECB Banking Supervision: SSM supervisory priorities for 2026–28 |
| Issued by | European Central Bank — Banking Supervision (SSM) |
| Type | Guidance |
| Status | In force |
| Published | Nov 18, 2025 |
| Effective | Jan 1, 2026 |
| Applies to | All significant institutions directly supervised by the ECB; frames JST work programmes for 2026–28. |
| Official source | bankingsupervision.europa.eu ↗ |
| Use cases | Generative & agentic AI · AI governance (general) · Cybersecurity · Third-party & vendor AI · Credit scoring & underwriting · Fraud detection |
What are the key points of SSM supervisory priorities 2026–28?
- Two priorities for 2026–28: (1) geopolitical/macro-financial resilience, (2) operational resilience and ICT capabilities
- AI and digitalisation sit under Priority 2 alongside DORA implementation and risk-data aggregation
- Continued monitoring of AI adoption, with a more targeted, in-depth approach to generative-AI applications
- Planned activities: targeted workshops on gen-AI use cases; cooperation with market surveillance authorities on AI Act implementation; stablecoin monitoring
- DORA: on-site inspection campaigns on cybersecurity and third-party risk management; threat-led penetration testing
- Persistent deficiencies in risk-data aggregation and reporting to be addressed via system-wide monitoring and management accountability
- Technology-neutral supervisory stance: assessment focuses on use cases and associated risks, not the technology itself
What did SSM supervisory priorities 2026–28 change for banks?
Compared with the 2025–27 priorities, AI moved from 'monitoring adoption' to a deliberate expansion of scope from prudentially relevant models to generative AI across the bank, with the ECB signalling it will form a stance on gen-AI materiality and coordinate with AI Act enforcers.
What are the ECB's supervisory priorities on AI for 2026–28?
AI sits under Priority 2 (operational resilience and ICT): continued monitoring of AI adoption with a more targeted approach to generative AI, targeted workshops, and cooperation with AI Act market-surveillance authorities.
When do the SSM priorities 2026–28 apply?
They frame supervisory work from 2026 through 2028 and were published on 18 November 2025.
| Date | Document | Status |
|---|---|---|
| Jul 7, 2026 | ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301) — Addressing AI-enabled cybersecurity threats — letter from the Chair of the Supervisory Board to CEOs of significant institutions | In force |
| Jun 3, 2026 | Elderson speech: 'Strengthening operational resilience for the age of AI' (June 2026) — Strengthening operational resilience for the age of AI — speech by Frank Elderson | Final |
| Feb 24, 2026 | Machado speech: 'Technology is neutral, governance is not' (Feb 2026) — Technology is neutral, governance is not: AI adoption in the banking sector — speech by Pedro Machado | Final |
| Feb 3, 2026 | Montagner speech: 'Encouraging innovation, managing risks' (Feb 2026) — Encouraging innovation, managing risks: the ECB's approach to digital transformation — speech by Patrick Montagner | Final |
| Nov 20, 2025 | Supervision Newsletter: AI use cases for credit scoring and fraud detection (Nov 2025) — AI's impact on banking: use cases for credit scoring and fraud detection (Supervision Newsletter, November 2025) | Final |
| Oct 14, 2025 | Machado speech: 'Artificial intelligence and supervision: innovation with caution' (Oct 2025) — Artificial intelligence and supervision: innovation with caution — speech by Pedro Machado | Final |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →