Letter SSM-2026-0301: the clock is running.
ECB Banking Supervision requires all significant institutions to submit a concrete action plan addressing AI-enabled cyber threats to their Joint Supervisory Team by 31 October 2026.
In a letter dated 7 July 2026 (SSM-2026-0301), the Chair of the ECB Supervisory Board, Claudia Buch, addressed the CEOs of all significant institutions directly: frontier AI models discover vulnerabilities and generate working exploits at unprecedented speed. The ECB treats this as a long-term shift in the threat landscape. Institutions must assess the impact without delay and submit a comprehensive action plan to their Joint Supervisory Team (JST) by 31 October 2026.
The plan must build on the existing cyber risk strategy and deliver concrete measures with timelines, clear roles and responsibilities, and the necessary resources. Short-term ECB priorities: protection of exposed attack surfaces (perimeter, internet-facing systems, third-party software and open-source components), vulnerability and patch management at scale, enhanced detection including AI-enabled defence, and robust ICT third-party risk management. Structurally, supervisors expect defence-in-depth, zero-trust principles, replacement of legacy systems and regularly tested response and recovery.
Importantly, the ECB introduces no new rulebook. DORA (Regulation (EU) 2022/2554) explicitly remains the binding framework; the action plan is, at its core, an accelerated DORA programme under sharpened assumptions. Open findings from on-site inspections, targeted reviews and the 2024 cyber resilience stress test must be prioritised. In return, the ECB postpones the IT Risk Questionnaire to February 2027.
Our approach: in two to three weeks we assess your current state against the six ECB focus areas, reconcile the results with your open DORA measures and prioritise by risk and effort. We then draft the action plan in the structure JSTs expect: measures, milestones, resources, governance. On request we support the JST dialogue and the implementation, from accelerated patch management to legacy replacement. The ECB will analyse all submitted plans horizontally: a well-structured, credible plan is also a signal to your supervisors.
6 service modules
Structured baseline in two to three weeks: attack surfaces, vulnerability and patch management, detection, governance and supply chain, defence-in-depth, response and recovery.
We write the submission-ready plan: concrete measures, timelines, responsibilities and resource needs, built on your cyber risk strategy.
The ECB names it as the first short-term priority: prioritised scanning, accelerated patch cycles and emergency changes, anchored contractually with ICT service providers.
After submission the work begins: we steer implementation, provide progress evidence for your JST and prepare you for questions from the ECB horizontal analysis.
Structural hardening in line with ECB expectations: segmentation up to micro-segmentation, zero-trust principles with continuous verification, and replacement or ring-fencing of legacy and end-of-life systems.
Tested crisis management, backup and recovery arrangements aligned with DORA, including exercises for high-speed scenarios and legally sound arrangements for sharing cyber threat information.
5 phases
We work in a fixed four-week rhythm that builds on your existing cyber risk strategy and your open DORA measures. Every phase delivers an audit-proof interim result.
structured baseline against the six ECB focus areas based on evidence, not self-assessment. Reconciliation with open findings from on-site inspections, targeted reviews and the 2024 cyber stress test.
maturity scoring per focus area and a prioritised measure list.
evaluation by risk, effort and supervisory visibility. Alignment of budget, staffing and responsibilities with IT, information security and risk control.
an agreed roadmap with milestones.
writing the action plan in the structure Joint Supervisory Teams expect: concrete measures, timelines, roles, resources and a governance chapter with reporting lines and escalation logic.
review with the management body, incorporation of feedback, finalisation and timely submission to the JST before 31 October 2026.
measure tracking with progress evidence, preparation for questions from the ECB horizontal analysis, and support for immediate measures from accelerated patch management to legacy hardening.
Your contact
Sarah Richter
Head of Information Security, Cyber Security
10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security
The action plan must be submitted to the responsible Joint Supervisory Team by 31 October 2026. The ECB analyses all submitted plans horizontally and feeds the results back to institutions; a weak plan is therefore also a signal to your supervisors. In return, the ECB postpones the IT Risk Questionnaire to February 2027.
8 QUESTIONS, BRIEFLY ANSWERED
The CEOs of all significant institutions under direct ECB supervision in the SSM. Less significant institutions should prepare as well: national supervisors such as BaFin typically adopt ECB expectations with a delay, and the underlying DORA obligations apply to all financial entities anyway.
Concrete measures to strengthen the relevant controls, allocated resources, clear roles and responsibilities, and implementation timelines. It must build on the existing cyber risk strategy and combine short-term priorities (attack surfaces, vulnerability and patch management, detection, third parties) with structural measures (defence-in-depth, legacy replacement, response and recovery).
The ECB is explicit: no new rules, DORA remains the binding framework. AI amplifies the speed and scale of known risks. Institutions with solid ICT risk management, a clean register of information and tested resilience arrangements can develop the plan largely from existing work. Gaps, however, now come with a hard deadline.
The JST discusses the plan with the institution and monitors progress. In addition, the ECB runs a horizontal analysis of all submitted plans, identifies trends and weaknesses and feeds the conclusions back to institutions. Depending on the results, workshops and further supervisory activities may follow.
The annual IT Risk Questionnaire is postponed from September 2026 to February 2027. Adjustments to other supervisory activities, such as on-site inspections or deep dives, are considered case by case in the dialogue between JST and institution.
Typically four weeks: two to three weeks of gap assessment against the six ECB focus areas including reconciliation with open DORA findings, followed by plan drafting in a JST-ready structure. Institutions starting in September risk submitting a plan without a credible baseline. Supervisors notice the difference.
The effort depends on institution size and maturity. The four-week core package (gap assessment against the six focus areas plus a submission-ready action plan) can be scoped as a fixed-price project; subsequent implementation support is billed by effort or as a monthly package. Institutions with a current DORA gap assessment start cheaper because phase 1 can be shortened. We scope transparently and state the price before the project starts.
Yes, and that is the normal case. The ECB does not expect a completed transformation by October but a credible plan: a solid baseline, prioritised measures, resources and timelines. Open DORA findings explicitly belong in the plan, with priority. It only becomes critical for institutions that can present neither a baseline nor a plan. That is exactly the gap our four-week approach closes.
Our clients trust our expertise in digital transformation, compliance, and risk management
Schedule a strategic consultation with our experts now
Book Strategy Session30 Minutes • Non-binding • Immediately available
Direct hotline for decision-makers
Strategic inquiries via email
For complex inquiries or if you want to provide specific information in advance