The ECB supervises AI at large euro-area banks through its existing prudential toolkit — internal-model approvals (with machine-learning expectations added to the Guide to internal models in July 2025), operational-resilience expectations under DORA, and on-site inspections — rather than AI-specific rules. AI sits under Priority 2 of the 2026–28 supervisory priorities with a sharper focus on generative AI, and more than 85% of supervised banks already use AI. On 7 July 2026 the ECB used its rarely used 'Dear CEO' channel for the first time on a technology threat, requiring every significant institution to submit an AI-cyber action plan to its Joint Supervisory Team by 31 October 2026.
| Full name | European Central Bank — Banking Supervision (SSM) |
| Role | Prudential supervisor |
| Force on banks | Supervisory guidance |
| Applies to | The ~110 significant euro-area banking groups directly supervised under the SSM |
| Key document | SSM supervisory priorities 2026–28 (AI under the operational-resilience priority) |
| Latest move | 7 July 2026 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301): every significant institution must file an action plan with its JST by 31 October 2026 |
| Documents tracked | 12 · all documents → |
The ECB's involvement runs on two tracks. For regulatory-capital models (IRB), any machine-learning component passes through the ECB's internal-model approval and the EBA's ML-for-IRB expectations. For everything else — fraud detection, customer service, coding assistants, generative AI — the ECB supervises through operational resilience and governance expectations, now formalized in its 2026–28 supervisory priorities under the digitalisation and ICT priority.
ECB supervisors have been increasingly vocal in 2026: a February 2026 speech ('Technology is neutral, governance is not') captures the house view that AI adoption is welcome but board-level accountability, data quality, and control frameworks decide whether it is safe. The ECB is not the AI Act's market-surveillance authority — that falls to national authorities — but it factors AI Act readiness into its assessment of banks' governance.
What has the ECB actually published on AI?
| Date | Document | Status |
|---|---|---|
| Jul 7, 2026 | ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301) — Addressing AI-enabled cybersecurity threats — letter from the Chair of the Supervisory Board to CEOs of significant institutions | In force |
| Jun 3, 2026 | Elderson speech: 'Strengthening operational resilience for the age of AI' (June 2026) — Strengthening operational resilience for the age of AI — speech by Frank Elderson | Final |
| Feb 24, 2026 | Machado speech: 'Technology is neutral, governance is not' (Feb 2026) — Technology is neutral, governance is not: AI adoption in the banking sector — speech by Pedro Machado | Final |
| Feb 3, 2026 | Montagner speech: 'Encouraging innovation, managing risks' (Feb 2026) — Encouraging innovation, managing risks: the ECB's approach to digital transformation — speech by Patrick Montagner | Final |
| Nov 20, 2025 | Supervision Newsletter: AI use cases for credit scoring and fraud detection (Nov 2025) — AI's impact on banking: use cases for credit scoring and fraud detection (Supervision Newsletter, November 2025) | Final |
| Nov 18, 2025 | SSM supervisory priorities 2026–28 — ECB Banking Supervision: SSM supervisory priorities for 2026–28 | In force |
| Oct 14, 2025 | Machado speech: 'Artificial intelligence and supervision: innovation with caution' (Oct 2025) — Artificial intelligence and supervision: innovation with caution — speech by Pedro Machado | Final |
| Jul 28, 2025 | ECB Guide to internal models (July 2025, ML section) — Revised ECB Guide to internal models — expectations for machine-learning techniques in internal models | In force |
| May 14, 2025 | Supervision Newsletter: suptech infrastructure (May 2025) — Benefits from advanced technology infrastructure in supervision (Supervision Newsletter, May 2025) | Final |
| Jul 11, 2024 | ECB digitalisation sound practices report (July 2024) — Digitalisation: key assessment criteria and collection of sound practices | In force |
| Jul 4, 2024 | Cipollone speech: 'Artificial intelligence: a central bank's view' (July 2024) — Artificial intelligence: a central bank's view — speech by Piero Cipollone | Final |
| May 1, 2024 | ECB FSR May 2024 AI special feature — The rise of artificial intelligence: benefits and risks for financial stability (Financial Stability Review, May 2024) | Final |
| Date | Type | Document / event |
|---|---|---|
| Oct 31, 2026 | Milestone | Deadline for significant institutions to submit AI-cyber action plans to their JSTs. Under the ECB's 7 July 2026 letter on AI-enabled cybersecurity threats (SSM-2026-0301), each significant institution must deliver a comprehensive action plan — measures, resources, owners, timelines — to its Joint Supervisory Team by 31 October 2026. The ECB will run a horizontal analysis of the plans and share conclusions with banks. |
| Jul 7, 2026 | Letter | ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301) — Addressing AI-enabled cybersecurity threats — letter from the Chair of the Supervisory Board to CEOs of significant institutions. On 7 July 2026 Claudia Buch, Chair of the ECB Supervisory Board, sent letter SSM-2026-0301, 'Addressing AI-enabled cybersecurity threats', to the CEO of every significant institution. source ↗ |
| Jun 3, 2026 | Speech | Elderson speech: 'Strengthening operational resilience for the age of AI' (June 2026) — Strengthening operational resilience for the age of AI — speech by Frank Elderson. On 3 June 2026 Frank Elderson, ECB Executive Board member and Supervisory Board Vice-Chair, told the Goldman Sachs European Financials Conference in Zurich that frontier AI models represent 'a structural shift in the economics of cyber risk', letting attacks that once needed expertise and time be run faster, at scale and by many more actors. source ↗ |
| Feb 24, 2026 | Speech | Machado speech: 'Technology is neutral, governance is not' (Feb 2026) — Technology is neutral, governance is not: AI adoption in the banking sector — speech by Pedro Machado. On 24 February 2026 Pedro Machado, ECB representative to the Supervisory Board, delivered 'Technology is neutral, governance is not: AI adoption in the banking sector' at the KPMG RiskTech Conference in Frankfurt. source ↗ |
| Feb 3, 2026 | Speech | Montagner speech: 'Encouraging innovation, managing risks' (Feb 2026) — Encouraging innovation, managing risks: the ECB's approach to digital transformation — speech by Patrick Montagner. On 3 February 2026 Supervisory Board member Patrick Montagner told the 10th Annual FinTech and Regulation Conference in Brussels that over 85% of ECB-supervised banks use AI and that the greatest risk facing European banks may be the innovations they fail to pursue. source ↗ |
| Nov 20, 2025 | Report | Supervision Newsletter: AI use cases for credit scoring and fraud detection (Nov 2025) — AI's impact on banking: use cases for credit scoring and fraud detection (Supervision Newsletter, November 2025). The 20 November 2025 Supervision Newsletter reports the ECB's annual innovative-technology data collection (107 significant institutions in 2023, 110 in 2024) and 2025 workshops with 13 banks on AI for credit scoring and fraud detection. source ↗ |
| Nov 18, 2025 | Guidance | SSM supervisory priorities 2026–28 — ECB Banking Supervision: SSM supervisory priorities for 2026–28. Published 18 November 2025, the SSM supervisory priorities for 2026–28 set two priorities: resilience to geopolitical and macro-financial uncertainty, and operational resilience with robust ICT capabilities. source ↗ |
| Oct 14, 2025 | Speech | Machado speech: 'Artificial intelligence and supervision: innovation with caution' (Oct 2025) — Artificial intelligence and supervision: innovation with caution — speech by Pedro Machado. On 14 October 2025 Pedro Machado, ECB representative to the Supervisory Board, spoke in Lisbon at Banco de Portugal on 'Artificial intelligence and supervision: innovation with caution'. source ↗ |
| Jul 28, 2025 | Guidance | ECB Guide to internal models (July 2025, ML section) — Revised ECB Guide to internal models — expectations for machine-learning techniques in internal models. On 28 July 2025 the ECB published a revised Guide to internal models that, for the first time, adds a section on the use of machine-learning techniques in the 'Overarching principles' chapter. source ↗ |
| May 14, 2025 | Report | Supervision Newsletter: suptech infrastructure (May 2025) — Benefits from advanced technology infrastructure in supervision (Supervision Newsletter, May 2025). The 14 May 2025 Supervision Newsletter article 'Benefits from advanced technology infrastructure in supervision' catalogues the ECB's suptech stack: Heimdall (machine reading for fit-and-proper files, cutting processing from 109 days in 2023 to 97 in 2024), Athena (NLP, translation and generative-AI text review across supervisory documents), Agora (unified prudential data lake), Delphi (news-based market monitoring), Navi (network analytics) and more than 100 robotic process automations running up to 15 times faster than manual work. source ↗ |
| Jul 11, 2024 | Report | ECB digitalisation sound practices report (July 2024) — Digitalisation: key assessment criteria and collection of sound practices. On 11 July 2024 ECB Banking Supervision published 'Digitalisation: key assessment criteria and collection of sound practices', built on a 2022 survey of all significant institutions, 21 targeted reviews of digitalisation steering and 10 on-site inspections. source ↗ |
| Jul 4, 2024 | Speech | Cipollone speech: 'Artificial intelligence: a central bank's view' (July 2024) — Artificial intelligence: a central bank's view — speech by Piero Cipollone. On 4 July 2024 ECB Executive Board member Piero Cipollone gave 'Artificial intelligence: a central bank's view' at the National Conference of Statistics in Rome. source ↗ |
| May 1, 2024 | Report | ECB FSR May 2024 AI special feature — The rise of artificial intelligence: benefits and risks for financial stability (Financial Stability Review, May 2024). In May 2024 the ECB's Financial Stability Review carried a special feature, 'The rise of artificial intelligence: benefits and risks for financial stability', by Leitner, Singh, van der Kraaij and Zsámboki. source ↗ |
Which of the 100 largest US banks answer to the ECB on AI?
3 of the 100 bank pages on this site name the ECB among the authorities their AI programme answers to. Each page lists the documents that apply and why.
- Horizontal analysis of the AI-cyber action plans due to JSTs by 31 October 2026, and any follow-up workshops or bank-specific measures the ECB draws from it
- Targeted generative-AI workshops and the ECB's stance on materiality of gen-AI applications under the 2026–28 priorities, including how AI Act readiness feeds into SREP governance scores
- First supervisory assessments of machine-learning components under the July 2025 Guide to internal models (explainability, 'complexity justified by performance')
- Whether the ECB consolidates speech- and newsletter-level AI expectations into a dedicated guide or sound-practices document
Does the ECB approve banks' AI models?
Only models used for regulatory capital (internal models under IRB) go through formal ECB approval, including any ML components. Other AI systems — fraud detection, chatbots, generative AI tools — are supervised through governance and operational-resilience expectations rather than pre-approval.
Is the ECB responsible for enforcing the EU AI Act on banks?
No. AI Act market surveillance is assigned to national authorities. The ECB supervises prudential soundness — but it assesses whether a bank's governance and risk management adequately cover its AI use, which in practice includes AI Act readiness.
What are the ECB's supervisory priorities on AI for 2026–28?
AI sits under the operational-resilience and ICT priority: continued monitoring of AI adoption with a more focused approach to generative-AI applications, and particular attention to AI in credit scoring and fraud detection.
What does the ECB's July 2026 AI cybersecurity letter require banks to do?
The 7 July 2026 letter (SSM-2026-0301) from Supervisory Board Chair Claudia Buch asks every significant institution to assess the AI-driven threat landscape without delay and submit an action plan to its Joint Supervisory Team by 31 October 2026. Short-term priorities are accelerated vulnerability and patch management, stronger monitoring/detection including AI-enabled defence, and third-party risk management for ICT providers; structural measures cover defence-in-depth, legacy replacement, and response and recovery. The ECB also pushed the annual IT Risk Questionnaire from September 2026 to February 2027 to free up bank resources.
Does the ECB allow machine learning in IRB capital models?
Yes. The revised ECB Guide to internal models published 28 July 2025 added a section on machine-learning techniques: models must be adequately explainable and their added complexity must be justified by performance. Linear and logistic regression are not treated as ML for the guide's purposes.
Follow every move these regulators make
the daily brief · six sourced stories · in your inbox by 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning