EBA Board Addresses AI Cyber Risk, 2027 Stress Test, and Work Program Priorities

Key Takeaways

• The EBA Board of Supervisors' June 2026 minutes reveal heightened supervisory focus on frontier AI-related cyber risk, NBFI interlinkages, and approval of the 2027 EU-wide stress test methodology, including a new climate risk module.
• These discussions signal upcoming supervisory actions and reporting expectations that compliance teams at EU banks should begin preparing for now.

Deep Dive

This meeting record provides important forward-looking signals for compliance and risk functions at EU/EEA credit institutions. The Board of Supervisors discussed emerging systemic risks—particularly cyber threats linked to frontier AI models, legacy system vulnerabilities, and growing interconnections between banks and non-bank financial institutions (NBFIs), including private credit. While no formal rule was issued, Members called for coordinated supervisory approaches across the European Supervisory Authorities (ESAs) and indicated that forthcoming requests for bank action plans on legacy systems and cyber resilience should be expected. Compliance teams should anticipate increased supervisory inquiries regarding AI governance, cyber incident reporting, and third-party/critical service provider dependencies under DORA.

A central agenda item was the approval of the 2027 EU-wide stress test methodological package, which includes a new climate risk module (covering both transition and physical risk) and a streamlined sample of 63 banks (47 euro area). The package will be published for a two-month consultation ending around end-August 2026, with an early industry workshop scheduled for late June 2026 and further engagement in September. Banks within the sample should begin internal readiness assessments now, particularly around integration of stress testing with supervisory reporting (notably credit risk and NII data) and new climate risk estimation requirements for real estate exposures based on energy consumption.

The EBA's 2027 Work Programme, still in draft form, outlines a shift toward three strategic "drivers"—fostering resilience, improving efficiency, and supporting transformation—replacing the original three-pillar framework. Supervisory convergence priorities have been narrowed to seven areas: liquidity, DORA incident reporting, SREP, technological capacity, consumer protection, geopolitical risk, and DORA/MiCA oversight capacity. Resolution priorities for 2027 emphasize geopolitical risk assessment, crisis preparedness, cybersecurity, and fraud monitoring, with AI risk frameworks flagged for strengthening despite not being a standalone priority. The Work Programme must be finalized and submitted to EU institutions by September 2026.

For compliance professionals, recommended actions include: (1) monitoring EBA/ESA output on AI-related cyber risk coordination and preparing to respond to anticipated information-sharing requests or workshops; (2) engaging early with the 2027 stress test consultation process if within scope, particularly regarding climate risk data and methodology changes; (3) reviewing NBFI exposure monitoring and reporting capabilities ahead of expected convergence work; and (4) tracking the finalized 2027 Work Programme publication in September for updated supervisory priorities affecting SREP, DORA, and consumer protection obligations. The overall risk implication is a continued tightening of supervisory expectations around technology-driven risks (AI, cyber, quantum computing) and macro-financial vulnerabilities (CRE, SME credit quality, geopolitical exposure), requiring proactive governance and documentation from financial institutions.

Source: European Banking Authority