On July 7, 2026, the European Central Bank (ECB) asked the banks it supervises directly to assess the threat from AI-enabled cyberattacks and to submit an action plan by October 31. Claudia Buch, chair of the ECB’s Supervisory Board, made the request in a letter to the chief executive of each bank.
Buch set no quantum or post-quantum deadline or reporting requirement. Post-quantum cryptography consists of encryption and signature algorithms designed to resist attacks by future quantum computers. In the letter’s final paragraph, Buch wrote that the adoption of post-quantum cryptography had to begin now and that the ECB would address the quantum risk to encryption in a later letter.
What the ECB asked banks to do
Buch addressed the letter to the chief executives of the ECB’s significant institutions, the term it uses for the banks under its direct supervision. She asked them to assess the impact of the changing threats without delay. She also asked each bank for a comprehensive action plan with concrete measures to strengthen controls, the resources to carry them out, clear roles and responsibilities, and timelines for implementation.
Buch wrote that each plan “should be submitted to the respective Joint Supervisory Team (JST) by 31 October 2026.” Every significant bank has a Joint Supervisory Team made up of ECB and national supervisors.
Each team will discuss the plan with its bank and monitor progress, Buch wrote. The ECB will also run what it called a horizontal analysis, comparing all the submitted plans to identify trends, challenges, and areas for improvement.
In an annex, the ECB listed six focus areas for the plans and grouped four of them as short-term remediation. The first two are protecting potential attack surfaces and accelerating vulnerability and patch management at scale. The other two are enhancing monitoring, detection, and AI-enabled defensive capabilities, and strengthening governance, funding, awareness training, and supply chain assurance.
The ECB named two longer-term areas. The first is reinforcing defense in depth and cyber hygiene, and modernizing infrastructure. The second is operational resilience, which the ECB defined as response and recovery and grouped with crisis management and information-sharing arrangements.
Buch wrote that the requirements of the EU’s Digital Operational Resilience Act (DORA) “remain highly relevant and valid.” She stressed the importance of addressing, without delay, open supervisory findings on information and communication technology (ICT) and on security risks identified in earlier supervisory work.
To let banks focus their resources on these areas, the ECB said it would extend the deadline for its annual IT Risk Questionnaire from September 2026 to February 2027. It said it would consider adjustments to other supervisory work, such as on-site inspections or deep dives, case by case.
The paragraph on quantum computing
Buch’s one paragraph on quantum computing was the last in the letter before her sign-off. In it, she wrote that progress toward practical quantum computing will have a significant effect on cybersecurity.
The adoption of post-quantum cryptography may involve a longer time frame, but must start now and necessitates sustained, strategic investment over time. The ECB will address the emerging risk to traditional encryption methods posed by advances in quantum computing in a separate letter in due course.
The ECB did not ask banks to address quantum risk in the October 31 plans. It mentioned quantum computing, cryptography, and encryption only in that paragraph and in neither of the letter’s two annexes. The ECB gave no date for the separate letter it said would follow.
Same-day statements from EU bodies
On July 7, the European Systemic Risk Board (ESRB), which monitors risks to the EU financial system as a whole, published a warning dated June 25 on systemic cyber risks from frontier AI models. The ESRB said its General Board had raised its assessment of systemic cyber risk to severe in June, after a lower rating in March. In the same release, the ESRB said it welcomed the ECB’s letter.
The three European Supervisory Authorities, the EU-level regulators for banking, insurance, and securities markets, backed the ESRB warning in a joint statement on July 7. They urged financial entities “to make appropriate arrangements to adapt their cybersecurity capabilities.” Neither the ESRB, in its warning, nor the three authorities mentioned quantum computing.
Update, November 13, 2026: By November 13, the ECB had added no separate letter on quantum risk to its letters-to-banks page. On September 23, the three European Supervisory Authorities wrote in a joint autumn risk update that “an advanced quantum computer could undermine some cryptography systems.” They added that information gathered now could be decrypted in the future, a risk they called “harvest now, decrypt later.”
