Our financial system’s deepening reliance on digital innovation brings extraordinary efficiency and customer value but also an unprecedented exposure to intelligent, fast-moving cyberthreats and the potential for systemic risk. On July 7, 2026, Claudia Buch, chair of the European Central Bank’s (ECB) supervisory board, issued a direct letter to the CEOs of all significant institutions. The message was clear: Artificial intelligence (AI) has fundamentally altered the cyberthreat landscape, and banks must act now to reinforce their defenses.

The European Systemic Risk Board also upgraded its cybersecurity risk rating to “severe,” with banks required to submit a board-endorsed action plan by October 31, 2026. With the deadline approaching fast, banks have limited time to formalize their responses.

This initiative is part of a broader regulatory evolution. Alongside the Digital Operational Resilience Act (DORA), the ECB’s AI-specific mandate signals that supervisors expect financial institutions to treat AI as both an opportunity and a serious risk factor. Fortinet’s AI-powered platform is purpose-built to help banks translate these regulatory demands into a clear, defensible, and board-ready cyber strategy.

And this is not just a European story. Days after the ECB's letter was sent, media reported that the U.S. government is considering a FINRA-style watchdog to vet frontier AI models before release, which confirms that leaders on both sides of the Atlantic now view AI as a systemic cyber risk.

Understanding the ECB Mandate and Its Impact on Financial Institutions

The ECB’s letter recognizes that AI models can now discover and exploit software vulnerabilities at a speed that makes traditional patch cycles obsolete. Rather than a transient campaign, this is described as a long-term shift in the threat environment. Consequently, the ECB requires every significant institution to deliver a comprehensive action plan to its joint supervisory team by the end of October 2026.

The plan must cover both immediate and longer-term measures, allocate resources, assign clear management responsibility, and set realistic implementation timelines. Short‑term priorities include vulnerability and patch management, monitoring and detection, AI‑enabled defensive capabilities, third‑party Information and Communication Technology (ICT) risk management, and the protection of internet‑facing and perimeter technologies. Also, banks must reinforce defence‑in‑depth, modernize legacy technology, and strengthen crisis response and recovery.

Importantly, DORA obligations remain highly relevant. Recognizing the additional workload, the ECB has extended the IT risk questionnaire deadline from September 2026 to February 2027, giving institutions the breathing room to get their AI defense posture right first. The board of every bank must now own this challenge, with the management body identified as primarily responsible for the response.

How Fortinet’s AI Portfolio Supports Your ECB Action Plan

Addressing the ECB’s mandate requires more than point solutions; it demands an integrated platform that brings AI into every layer of defense. Fortinet’s platform approach brings together security, visibility, and automation across the digital estate, helping banks secure people, devices, and data everywhere.

1. AI for security: Defending at machine speed

Fortinet’s AI-driven threat protection continuously monitors everything entering and moving across your network. It detects AI-powered attacks in under a second and detects zero-day vulnerabilities in real time, dramatically shrinking the window of exposure. It also discovers unsanctioned “shadow AI” applications that employees might be using, assesses the associated risk, and enforces policies automatically. For the board, this means fewer operational surprises and demonstrable control over the AI-driven threat that the ECB highlights.

2. Security for AI: Protecting your AI journey

As your bank adopts AI for everything from customer service to credit risk analysis, it creates a new attack surface. Fortinet wraps AI infrastructure with layered protection that prevents sensitive data from leaking into public large language models (LLMs), stops adversarial manipulation like prompt injection, and ensures only authorized systems can access AI models.

3. AI-augmented teams: Multiplying the strength of your teams

Even the best technology is only as effective as the people who operate it. Fortinet provides generative AI (GenAI) assistants that act as a force multiplier for security and network operations teams. These assistants handle routine, high-volume tasks such as triaging alerts, hunting for threats in natural language, and generating secure configurations from simple sketches. This frees up your experts to focus on judgment and strategy. This directly aligns with the ECB’s requirement to embed AI into daily defensive operations and to allocate scarce resources intelligently.

Strengthening Every Priority Area of the ECB Mandate

The ECB’s requirements span multiple domains. Fortinet maps its capabilities directly to each one, providing a unified approach rather than a disjointed checklist.

• Vulnerability and patch management: AI-powered tools for the identification and prioritization of critical weaknesses, combined with automated configuration adjustments, can close exposures far faster than manual processes allow.
• Monitoring and detection: Real-time visibility into all network traffic, including unsanctioned AI usage, giving your teams a single source of truth and your board a clear risk picture.
• AI-enabled defensive capabilities: Threat prevention informed by FortiGuard Labs threat intelligence, including analysis from the Fortinet 2026 Global Threat Landscape Report.
• Third-party ICT risk: Consistent controls around data flows to external AI services and protection of the AI supply chain, supporting DORA’s third-party risk provisions without duplicating effort.
• Legacy modernization: Secure, high-performance infrastructures replaces outdated systems with AI-ready environments, avoiding the introduction of new security gaps.
• Crisis response and recovery: A unified security operations platform automates response playbooks and preserves evidence, giving the management body the governance structure needed during a cyber crisis.
• Management body oversight: Clear, reportable metrics on AI usage, risk posture, and incident trends through Fortinet security operations capabilities help boards demonstrate direct oversight and maintain defensible evidence during supervisory review.

Underpinning all of this is the Fortinet Security Fabric, Fortinet’s integrated cybersecurity platform, which delivers consistent protection, visibility, and automation across the extended digital estate.

Preparing for DORA and the Broader Regulatory Landscape

The ECB explicitly states that DORA remains highly relevant. Fortinet’s AI-enabled platform supports key DORA pillars naturally: unified ICT risk management, robust incident reporting, digital operational resilience testing, and third-party oversight become outputs of a well-architected security posture rather than separate compliance projects. The extension of the IT risk questionnaire deadline to February 2027 is a clear signal that supervisors value quality over speed. Fortinet helps you generate the substantive evidence your joint supervisory team expects.

Don’t Wait: Act Now to Build Your AI-Enabled Defense

Preparing for the ECB’s AI cybersecurity mandate is not just about meeting a regulatory deadline; it is an opportunity to strengthen your bank’s resilience in a way that builds trust with customers, investors, and supervisors alike. The October 31, 2026, deadline is close, but with a clear strategy and the right partner, it is entirely achievable.

Validate your security and network architecture with a complimentary assessment now.