Minutes to Break, Months to Notice: Europe's Frontier AI Blind Spot

The European Systemic Risk Board (ESRB) adopted a warning on systemic cyber risks from frontier artificial intelligence (AI) models on 25 June 2026 and published it twelve days later, alongside a letter from the European Central Bank (ECB) to the chief executive of every bank under its direct supervision and an action plan from the European Commission. On 31 July the European Supervisory Authorities (ESAs) closed the sequence with a statement on how financial entities should manage the same risk under the Digital Operational Resilience Act (DORA). Four interventions in six weeks, three of them on a single day, amounts to a sprint by European standards. Yet across the warning, the letter and the ESA statement, the words fraud, sanctions and money laundering do not appear once.

Europe has conceded the gap

The most consequential sentence in the package is an admission. Recital 9 of the ESRB warning states that where frontier model risks materialise simultaneously across critical functions and institutions, the result could be a permanent increase in systemic cyber risk for which there is, at present, "no fully effective mitigation framework available". That is a macroprudential authority describing a hazard it cannot yet answer.

The preamble is blunter still. Faced with a surge in critical vulnerabilities, the ESRB says, institutions may have to choose between leaving themselves exposed and cutting back patch testing, accepting operational outages in exchange. Neither option is compliance. Both are risk.

The instrument chosen matters as much as the wording. The ESRB issued a warning of a general nature under Articles 16 and 18 of Regulation (EU) No 1092/2010, not a recommendation; only a recommendation engages the act-or-explain duty in Article 17, under which an addressee must report the action it has taken or substantiate its inaction. This warning names no addressee, and nobody owes the ESRB an account of what they did about it. Its force is reputational. The binding edge lies elsewhere.

Time was always the control

The technical case rests on a single variable. Crafting a weaponised exploit once took human experts days or weeks; frontier models now do it in minutes or hours. Disclosure convention gives vendors roughly ninety days to patch, a window designed for an era when serious flaws were found rarely and by researchers. The ESRB describes the consequence as a collapse of the defensive time buffers on which continuity through remediation depends. No control framework in financial services was built for that arithmetic.

The evidence is no longer hypothetical. Anthropic disclosed in November 2025 that a Chinese state-sponsored group had turned its coding tool against roughly thirty entities, financial institutions among them, with the model executing 80 to 90 per cent of tactical operations independently and at request rates Anthropic described as "physically impossible" for a human team; a handful of those intrusions succeeded. Eight days before the ESA statement appeared, the threat intelligence firm Hunt.io published logs recovered from an exposed staging server showing an open-source agent, running with its approval prompts disabled, enumerating hosts and cataloguing personnel records inside Thailand's Ministry of Finance. Hunt.io found no evidence that files left the network and the ministry has not confirmed a breach; what matters is the method rather than the outcome. A single fingerprint search by the same researchers returned 575 exposed directories in which other operators had left their agents' output publicly readable.

Openness is the policy and the problem. The Commission's action plan encourages organisations to use AI, open-source models included where appropriate, to detect and remediate vulnerabilities faster. The property that puts those models within reach of defenders is the property that makes them untraceable in other hands.

The supervisor is rationing effort

The hard obligation sits in the ECB's letter rather than the ESA statement. Letter SSM-2026-0301, signed by Supervisory Board Chair Claudia Buch on 7 July, requires every significant institution to submit an action plan to its Joint Supervisory Team by 31 October 2026, with concrete measures, assigned roles, allocated resources and implementation timelines. It creates no new rule; it accelerates DORA. What it does create is a dated artefact against which a bank can later be measured.

Two features of that letter deserve more attention than they have received. The first is retrospective. The ECB tells banks to address without delay the open findings from earlier on-site inspections, targeted reviews and the 2024 cyber-resilience stress test, warning that unresolved weaknesses may become increasingly material. The finding itself has not changed. Its consequence has.

The second is that the supervisor is rationing its own demands in order to fund the effort, deferring the annual IT Risk Questionnaire from September 2026 to February 2027 and offering case-by-case adjustment of remediation outside the focus areas. Supervisors rarely trade away their own visibility. This one has.

Britain moved earlier and asked for less. The Bank of England, the Financial Conduct Authority (FCA) and HM Treasury published a joint statement on frontier AI models and cyber resilience on 15 May 2026, six weeks before the ESRB acted, judging that frontier model capability already exceeds what a skilled practitioner can achieve, and does so faster, at greater scale and at lower cost. It set no deadline and required no submission, directing firms instead to existing operational resilience rules and to guidance from the National Cyber Security Centre. The diagnosis was identical. The mechanism was not.

Obligation sits far from control

The ESRB is explicit that concentration is part of the hazard. Frontier models are built by a small number of providers, most of them outside the Union, themselves dependent on cloud platforms, open-source components and widely deployed software. The warning goes further than most commentary has noticed, calling for adequate and proportionate Union access to newly developed models and cautioning that arrangements granting access only to selected institutions or jurisdictions would fragment the single market. Defensive capability, on that reading, is a level playing field question rather than a procurement one.

The Commission has taken the point. Its action plan commits to a European blueprint, developed with the EU Agency for Cybersecurity, for secure access to advanced AI systems for cybersecurity purposes, and to a secure testing platform for critical sectors including finance. Neither exists yet. The action plans are due in October.

Set that against the levers actually available. The ESAs designated nineteen critical ICT third-party providers under DORA in November 2025, and their statement records targeted engagement with those providers and the embedding of AI risk into oversight examinations for 2027. The designations were drawn from the registers of information firms maintain on their contractual arrangements, and the entities named are the European cloud, infrastructure and services arms of their groups rather than the parents that build models. A model that reaches a bank indirectly, embedded inside a vendor's product, sits a long way down that chain. The Commission's enforcement powers over providers of general-purpose AI models became exercisable only on 2 August 2026, two days after the ESA statement appeared.

The asymmetry that follows is uncomfortable. The party asked to move fastest is the financial entity, which controls neither the models, nor their release schedule, nor the disclosure of what they can do. The ESRB concedes as much when it observes that establishing where AI sits inside an institution is itself difficult, given its spread across customer interfaces, internal agents, business processes and third-party integrations. No firm manages an exposure it cannot locate.

Financial crime fails quietly

Here the package stops short of the risk. The ECB's opening paragraph names implications for the confidentiality, integrity and resilience of bank systems. Integrity then disappears. The six focus areas that follow are built around intrusion and continuity: attack surface, patching, monitoring, governance, hygiene and recovery. Not one asks whether a system that is running is producing the right answer. The ESA statement never uses the word integrity at all, and confidentiality survives there only twice, in a single row of the annex about protecting a firm's own source code.

The omission matters because the risk here is not that a financial crime control stops, but that it carries on. A sanctions screening engine can be patched, monitored and fully available while returning the wrong answer: a stale or corrupted list feed, a quietly altered threshold, a matching parameter narrowed by an account that should never have held the permission. Availability metrics stay green throughout.

Consider what that means for reporting. A major ICT incident triggers a defined notification clock under DORA. A screening system producing confident, complete and wrong output triggers nothing, because nothing has broken. The failure surfaces months later as an enforcement matter under a different rulebook, assessed by a different supervisor, against records the firm never thought to keep. Cyber failure announces itself. Compliance failure is discovered in a look-back.

Europe's other supervisory arm reached this terrain first. The Anti-Money Laundering Authority (AMLA) published the report of Chair Bruna Szego's 2025 Roadshow on 11 May 2026, recording that supervisors, financial intelligence units and industry associations across the Union identified technology-enabled fraud, deepfakes and sanctions-evasion typologies as the emerging threats that matter, compounded by remote onboarding and the speed and irrevocability of instant payments. Its account of the control problem is the ECB's in different clothing: arrangements resting on end-of-day batch processing and next-day review, it warns, are poorly suited to interrupting fast-moving typologies.

The asymmetry lies in what each side noticed. AMLA's report reaches across to cyber-enabled criminal activity and names it as a risk interacting with sanctions evasion. The cyber package makes no reference to financial crime at all. One arm of European supervision has looked over the fence; the other has not.

The template will not ask

Firms drafting for the October deadline should test three things the exercise itself will not raise. First, whether the financial crime control stack appears in the register of information and sits inside the boundary of critical or important functions; where the screening platform, the monitoring engine and the list data provider fall outside it, none of the accelerated patching, third-party assurance or resilience testing reaches them. Second, what evidence would show that such a system had been producing a wrong answer rather than no answer, and how long that evidence would take to assemble. Third, whether concentration in the compliance technology market has been assessed on the ESRB's own terms, because the asymmetry it describes between well-resourced and poorly resourced institutions applies with equal force to the suppliers they share.

None of this calls for a new framework. It calls for the existing one to be pointed somewhere it currently is not.

Minutes are not the only measure

Europe has been unusually candid this summer. It has told the market that the attacker's economics have improved, that the gap between discovery and exploitation has closed and that no complete mitigation yet exists. It has followed that candour with a deadline, a horizontal analysis and a set of controls any competent security function would already recognise. As an answer to the question asked, it is proportionate and defensible.

Yet the question left unasked is what happens to the controls that fail without falling over. Screening, monitoring and customer due diligence are ICT systems that produce legal conclusions, and when they degrade nothing goes dark, nothing alerts and nothing is reported. The frontier AI debate has been conducted entirely in the language of minutes, because minutes are what the attacker has gained. The exposure that should trouble a financial crime function runs the other way. It takes months to surface, and by the time it does, the only clock that mattered was the one nobody was watching.

Could you prove that your screening was working correctly last Tuesday, rather than simply working?

If that answer rests on uptime, we can help you build the evidence a supervisor will actually ask for; contact us.

At OpusDatum we treat financial crime systems as what they are: ICT assets whose characteristic failure is a wrong answer rather than an outage. Our work tests whether screening, monitoring and customer data controls sit inside a firm's operational resilience perimeter, and whether the evidence exists to show they were producing the right output on the day a supervisor asks.