Managing AI-specific cybersecurity risks in financial services

Financial services is the sector where AI governance stops being voluntary. Banks, insurers and investment firms already operate under model risk management, operational resilience, third-party oversight and fair-treatment rules, and those rules apply to AI systems whether or not a regulator has issued AI-specific guidance. Increasingly, regulators have issued it: as of October 2026, OSFI's E-23, Québec's AMF AI guideline, DORA and the EU AI Act all name AI directly.

What the US Treasury report identified, and what changed since

The US Treasury report on AI-specific cybersecurity risks in the financial services sector (March 2024) names the technical risks: data poisoning, model theft, adversarial manipulation and AI-enabled fraud. It also makes four broader points:

• Security belongs across the lifecycle, from development through deployment to maintenance, not at a pre-launch gate.
• Monitoring must be continuous, because model behaviour drifts after deployment in a way conventional software does not.
• The sector needs shared standards, developed between regulators, institutions and technology providers, rather than each firm inventing its own.
• Capability has to be resourced: people who understand both the technology and the risk, which is the scarcest input.

As of 2026, the threats the report described are established in practice: deepfake-enabled payment fraud, synthetic identities and AI-written phishing are routine. See AI identity fraud. What changed is the regulatory frame around it, which now differs sharply by jurisdiction.

Financial services starts from an advantage — model risk management

The sector has a head start. Banks have run model risk management programs for more than a decade, requiring models to be inventoried, independently validated and monitored, with a named owner for each. That is substantially the same discipline the NIST AI RMF now asks of AI generally.

The practical implication: a firm with a functioning model risk framework should extend it to AI rather than build a parallel program. The inventory exists, validation exists, ownership exists. What AI adds is a set of failure modes the framework was not designed for: prompt injection, hallucination, training-data provenance, emergent behaviour in agentic systems, and third-party models nobody outside the vendor can see.

Canada's regulators have written exactly this approach down. OSFI's E-23 defines a model as an application of "theoretical, empirical, judgmental assumptions or statistical techniques, including AI/ML methods", and requires that "the extensive use of advanced AI/ML techniques should have correspondingly mature governance and oversight" (OSFI E-23).

What regulators expect, by jurisdiction

The status of each instrument below is as of October 2026.

Canada

• OSFI Guideline E-23 — Model Risk Management (2027). Final version published 11 September 2025, effective 1 May 2027 (not yet in effect as of October 2026). It now applies to all federally regulated financial institutions, including insurers and foreign bank and insurance branches; the previous version covered deposit-takers only. It is built around three outcomes: model risk understood enterprise-wide, managed on a risk basis, and governed across the whole lifecycle. Expectations include an enterprise model inventory covering vendor and third-party models; a model risk rating using quantitative factors and qualitative ones such as "model complexity or level of autonomy" and "customer impacts"; documented model rationale that addresses explainability, "black box" controls, bias, privacy and ethics; data that is accurate, representative, compliant, traceable and timely; independent review; monitoring; and decommissioning. Senior management must report model risk to the board.
• OSFI B-13 — Technology and Cyber Risk Management (in effect since 1 January 2024) covers the security of AI systems as technology assets: secure development, identity and access, threat assessment and cyber incident response.
• OSFI B-10 — Third-Party Risk Management governs model and cloud providers. E-23 explicitly cross-refers to it for externally sourced models and data.
• OSFI E-21 — Operational Risk Management and Resilience (2024) requires critical operations to stay within tolerance through disruption, including disruption of an AI dependency.
• OSFI–FCAC risk report on AI uses at federally regulated financial institutions (September 2024). The joint report found adoption accelerating, and identified data governance, model risk, legal and reputational, third-party, operational and cyber, and consumer-treatment risks as the main exposures. It set the direction E-23 formalizes. FCAC's interest is consumer outcomes: disclosure, complaint handling and fair treatment under the Bank Act financial consumer protection framework.
• Québec AMF — Guideline on the Use of Artificial Intelligence. Final decision published 30 March 2026, in force 1 May 2027. It applies to Québec-authorized insurers, financial services cooperatives, deposit institutions and trust companies, on top of the AMF's model risk management guideline. Notable expectations:
• the board stays regularly informed of AI trends, risks and material changes, and its collective competence is sufficient to understand AI risk;
• one member of senior management is accountable for all AI systems;
• a centralized AI register with a risk rating for every system;
• validation triggers for hallucination, bias, IP infringement and "ethical misalignment";
• customers are told when they are interacting with AI, get prompt access to a human on request, and receive clear explanations of AI-assisted decisions;
• AI-generated content carries a prominent notice.
• Securities. CSA Staff Notice and Consultation 11-348 (December 2024) applies existing securities law to AI use by registrants, issuers and marketplaces, including AI-washing.

United States

• Model risk guidance replaced. On 17 April 2026 the Federal Reserve (SR 26-2), OCC (Bulletin 2026-13) and FDIC replaced the 2011 SR 11-7 guidance. The revised guidance:
• narrows "model" to complex quantitative methods, excluding spreadsheets and deterministic rules;
• ties rigour to materiality (model purpose plus exposure);
• removes the "at least annually" validation expectation and streamlines vendor-model validation;
• says it "does not set forth enforceable standards", and that non-compliance alone will not draw supervisory criticism;
• is "expected to be most relevant" to banks above US$30 billion in assets;
• excludes generative and agentic AI, which the agencies plan to address through a request for information.

It still applies to non-generative machine learning models. - What that means in practice. As of October 2026, a US bank's LLM-based assistant, or its agentic workflow, sits outside the only interagency model risk guidance. It is still subject to safety-and-soundness, third-party risk, BSA/AML, fair lending (ECOA/Regulation B adverse-action reasons) and UDAAP.

Practitioner note: Absence of guidance is not absence of liability. Keeping SR 11-7-grade controls on generative and agentic AI while the agencies' request for information is pending is the defensible default. - NYDFS. The October 2024 industry letter on cybersecurity risks arising from AI explains how the Part 500 cybersecurity regulation applies. It covers AI-enabled social engineering and deepfakes, AI-enhanced attacks, exposure of the non-public information AI systems hold, and third-party AI dependencies, and expects risk assessments, access controls (including deepfake-resistant MFA), training and vendor management to address them. NYDFS Insurance Circular Letter No. 7 (July 2024) sets expectations on AI and external data in underwriting and pricing, including testing for unfair discrimination. - Treasury followed its 2024 cybersecurity report with a December 2024 report on uses, opportunities and risks of AI in financial services, drawn from its request for information.

European Union

• DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025. An AI model consumed as a service is an ICT third-party service. Where it supports a critical or important function, it needs an entry in the register of information, contractual provisions, exit strategies and testing, and AI-related outages fall within major ICT incident reporting. On 18 November 2025 the ESAs designated 19 critical ICT third-party providers, including hyperscale cloud providers, for direct EU oversight.
• EU AI Act. Annex III point 5(b) makes AI used to evaluate creditworthiness or establish credit scores of natural persons high-risk, except fraud detection. Point 5(c) does the same for risk assessment and pricing in life and health insurance. After the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026), these obligations apply from 2 December 2027, not the original 2 August 2026. Deployers of 5(b) and 5(c) systems must run a fundamental rights impact assessment (Article 27). The Act lets financial institutions meet some obligations, such as quality management, logging and monitoring, through their existing internal-governance arrangements under EU financial services law, and makes the financial supervisor the market surveillance authority.
• EBA, EIOPA and ESMA. In a letter of 21 November 2025, the EBA mapped AI Act requirements for credit scoring against CRR/CRD, DORA, the Consumer Credit Directive and its Loan Origination and Monitoring Guidelines. It concluded that obligations largely overlap and that banks do not need a parallel compliance universe. EIOPA issued an Opinion on AI governance and risk management in 2025. On 24 March 2026 it wrote to the EU institutions seeking clarification of how the AI Act applies to insurance, including the treatment of traditional generalized linear pricing models (EIOPA). ESMA's May 2024 statement reminded investment firms that MiFID II conduct duties apply in full when AI is used in client services.

United Kingdom

• PRA SS1/23 — Model risk management principles for banks (effective 17 May 2024) applies to banks with internal-model approval and explicitly covers AI and machine-learning models. Its five principles cover model identification and classification, governance, development and use, independent validation, and risk mitigants.
• FCA. As of October 2026, the FCA has not written AI-specific rules. It relies on the Consumer Duty, the Senior Managers and Certification Regime and operational resilience. In January 2026 it launched the Mills Review, published on 6 July 2026. The review concludes the framework "remains sound but is under strain" as AI becomes more autonomous. It recommends clearer guidance on the "reasonable steps" expected of senior managers, scrutiny of the regulatory perimeter for general-purpose AI, an expanded FCA AI Lab, and a trusted framework for AI agents acting for consumers.
• Adoption data. The Bank of England and FCA's 2024 survey found 75% of firms already using AI, with a further 10% planning to within three years. A third of use cases were third-party implementations.

International bodies

• FSB. The Financial Stability Implications of Artificial Intelligence (November 2024) identifies four vulnerabilities: third-party dependencies and service-provider concentration; market correlations from common models and data; cyber risk; and model risk, data quality and governance. It added AI-enabled fraud and disinformation, and followed up in 2025 with work on monitoring AI adoption.
• BIS. The 2024 Annual Economic Report devoted a chapter to AI and its implications for central banks and supervisors. The BIS Financial Stability Institute has published comparative work on supervisory approaches to AI.
• IOSCO published a consultation report on AI use cases, risks and challenges in capital markets in March 2025.

Third-party and foundation models: where validation breaks

Independent validation assumes the model can be inspected. A bought-in foundation model cannot be: nobody outside the vendor sees the weights, the training data or the fine-tuning decisions, and the vendor can change the model without the firm's involvement.

Supervisors acknowledge this limit. E-23 says externally developed models should be "assessed for model risk ratings on a standalone basis". SR 26-2 acknowledges that proprietary vendor components limit validation. The defensible position has five parts:

• Validate the use, not the model. Test fitness for the firm's own purpose with the firm's own data: accuracy on representative cases, hallucination rate, refusal behaviour, robustness to adversarial prompts, and outcome disparity across customer groups.
• Control the wrapper. Retrieval sources, system prompts, guardrails, output filters and human review points belong to the firm, so they can be documented and tested to normal standards.
• Pin versions and monitor drift. Record which model version is in production. Treat a provider model update as a model change that triggers review.
• Buy information rights. Model cards, evaluation results, incident notification and change notice belong in the contract, which DORA and B-10 already expect for critical services.
• Price residual uncertainty into the rating. Where something cannot be validated, record that, and let it raise the risk rating and tighten usage limits.

Concentration risk is the sector-specific problem

Most institutions building on generative AI depend on a small number of model providers, which in turn depend on a small number of cloud providers. That produces a pattern supervisors already recognize from cloud: many regulated firms, one common dependency. A defect, an outage or an abrupt change of terms at one provider does not affect one firm; it affects a slice of the sector at once. The FSB, the Bank of England's Financial Policy Committee and the Mills Review all name it.

The second-order version is correlated behaviour. If many firms use similar models trained on similar data for credit, trading or fraud decisions, errors and herding become correlated too.

In the EU this falls squarely within DORA, which imposes register-keeping, contractual provisions and exit planning on financial entities, and now direct oversight of designated critical providers. In Canada, B-10 and E-21 set the equivalent expectations. Exit planning is the most difficult element: firms are expected to show they could move off a critical provider.

Fair treatment and explainability

Customer-affecting AI carries conduct risk on top of prudential risk.

• Adverse decisions need reasons. US ECOA/Regulation B requires specific reasons for credit denials regardless of model complexity. That requirement is unchanged; the CFPB's Circular 2022-03, which applied it to complex algorithms, was withdrawn (May 2025) pending review. Québec's AMF guideline requires clear explanations of AI-assisted decisions. The EU AI Act gives affected people a right to an explanation for high-risk decisions (Article 86). See explainable AI.
• Bias must be tested, not assumed away. The AMF expects lists of prohibited proxy variables and documented bias monitoring. E-23 requires data whose biases are "understood and managed". See bias in AI systems.
• Human recourse must be real. A reviewer who lacks the information or authority to overturn an automated outcome is not oversight. See human-in-the-loop.

What a regulated firm should be able to show

• An inventory of AI systems, integrated with the model inventory rather than kept beside it, covering vendor and embedded AI, with a named owner for each.
• A risk rating per system, and evidence that customer-affecting systems — credit decisioning, fraud scoring, pricing, underwriting, claims, onboarding — carry proportionate control.
• Validation appropriate to the model type, including a documented position on what can and cannot be validated for third-party and generative models.
• Continuous monitoring for drift, degradation, hallucination and disparate outcomes across customer groups.
• AI security controls mapped to B-13, NYDFS Part 500 or DORA: prompt-injection testing, data-leakage controls, access management and adversarial testing. See AI attacks and the OWASP LLM Top 10.
• Third-party registers, contracts and exit plans covering model providers as critical dependencies.
• Human oversight defined per decision type, with the authority and information to overturn an automated outcome — not a nominal reviewer.
• Incident routes that treat AI failures as reportable operational incidents.
• Board reporting on AI risk that shows movement, not just activity. See AI oversight at board level.

A 2026–2028 compliance calendar

Date	Obligation	Status (October 2026)
17 January 2025	EU DORA applies	In effect
17 April 2026	US SR 26-2 / OCC 2026-13 replace SR 11-7 (generative and agentic AI excluded)	In effect; AI request for information pending
2 August 2026	EU AI Act Article 50 transparency obligations apply	In effect
2 December 2026	EU AI Act machine-readable marking for generative systems already on the market	Upcoming
1 May 2027	OSFI E-23 (2027) and Québec AMF AI guideline take effect	Upcoming (final texts published)
2 December 2027	EU AI Act Annex III high-risk obligations, including credit scoring and life and health insurance pricing	Upcoming (deferred by the Digital Omnibus)
2 August 2028	EU AI Act Annex I (AI in regulated products)	Upcoming (deferred by the Digital Omnibus)

Where this maps: frameworks and standards

E-23, the AMF guideline and SR 26-2 set out what supervisors expect. Frameworks supply the method. ISO/IEC 42001 supplies the certifiable AI management system that procurement teams and supervisors increasingly ask for. The NIST AI RMF and its Generative AI Profile supply the risk method underneath. MITRE ATLAS catalogues the adversarial techniques the Treasury report names. For how assurance functions change, see AI in risk, audit and compliance. For named accountability below the board, see AI accountability.

Related references

Sources and references

• OSFI, Guideline E-23 — Model Risk Management (2027): https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/guideline-e-23-model-risk-management-2027
• OSFI, Guideline B-10 — Third-Party Risk Management: https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/third-party-risk-management-guideline
• AMF, Ligne directrice sur l'utilisation de l'intelligence artificielle (2026): https://lautorite.qc.ca/fileadmin/lautorite/reglementation/lignes-directrices-assurance/LD-utilisation-intelligence-artificielle_fr.pdf
• OCC Bulletin 2026-13, Model Risk Management: Revised Guidance (17 April 2026): https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html
• FDIC, Agencies issue revised model risk guidance (2026): https://www.fdic.gov/news/press-releases/2026/agencies-issue-revised-model-risk-guidance
• US Treasury, Managing AI-Specific Cybersecurity Risks in the Financial Services Sector (March 2024): https://home.treasury.gov/system/files/136/Managing-Artificial-Intelligence-Specific-Cybersecurity-Risks-In-The-Financial-Services-Sector.pdf
• Regulation (EU) 2022/2554 (DORA): https://eur-lex.europa.eu/eli/reg/2022/2554/oj
• ESAs, designation of critical ICT third-party providers (18 November 2025): https://www.eba.europa.eu/publications-and-media/press-releases/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital
• Regulation (EU) 2024/1689 (AI Act): https://eur-lex.europa.eu/eli/reg/2024/1689/oj
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), published in the Official Journal 24 July 2026, in force 27 July 2026
• EIOPA, letter to EU institutions on the AI Act and insurance (March 2026): https://www.eiopa.europa.eu/publications/letter-eu-institutions-ai-act-and-eu-insurance-legislation-proposal-clarifying-application-ai-act_en
• FCA, The Mills Review (6 July 2026): https://www.fca.org.uk/publications/corporate-documents/mills-review
• Bank of England and FCA, AI in UK financial services (2024): https://www.bankofengland.co.uk/report/2024/artificial-intelligence-in-uk-financial-services-2024
• FSB, The Financial Stability Implications of AI (November 2024): https://www.fsb.org/2024/11/the-financial-stability-implications-of-artificial-intelligence/