What did the ECB say about AI operational resilience?

In a June 2026 speech, the ECB identified AI as an operational-resilience and cyber-risk concern and said it planned targeted supervisory follow-up. The speech supports preparing evidence for AI traffic, third-party dependencies, and resilience controls; it does not substantiate a public July letter to 110 banks or an October filing deadline.

Is this a new regulation?

No. The ECB speech is not a legislative instrument. DORA and the EU AI Act remain the applicable legal frameworks; any later supervisory request needs to be assessed from its final text and scope.

Which operational-resilience evidence can a policy gateway provide?

A request-layer control can evidence which provider processed a request, which data class was involved, which identity was authorised, and what policy decision was made. It does not replace patch management, legacy-technology remediation, incident management, or the broader DORA control set.

How is this different from DORA compliance?

DORA is a binding EU operational-resilience framework with its own ICT third-party register, exit-strategy, and concentration-risk requirements. ECB supervisory attention to AI can inform what a supervisor may inspect, but it does not replace or create a separate DORA filing deadline based on the June speech alone.

What evidence is useful for AI operational-resilience supervision?

For AI traffic, maintain per-request evidence rather than policy statements alone: the authorising identity, provider, relevant data class, policy decision, and an independent record of that decision. This supports focused questions about AI-provider governance and monitoring while leaving the broader resilience controls to the teams that own them.

ECB Operational Resilience and AI: What Bank Supervisors May Inspect

TL;DR

An AI policy gateway supports only two of the ECB’s five workstreams: third-party technology oversight and monitoring and detection.
It records the model provider, data classification, and authorizing identity for each AI request.
It creates an independent, signed decision log that supervisors can inspect without relying on application self-attestation.
Patch management, legacy modernization, and crisis management require separate evidence and controls beyond the gateway.

In a June 3, 2026 speech, ECB Executive Board member Frank Elderson described frontier AI as a structural shift in the cyber threat lThe ECB framed frontier AI models as a long-term shift in the threat landscape and urged banks to act early rather than wait for an incident.The ECB speech highlighted faster patching, stronger monitoring and detection, scrutiny of third-party dependencies, legacy modernisation, and crisis-management preparedness.The speech did not set a public October filing deadline or publish a bank-specific plan requirement. It framed frontier AI as a long-term shift in the threat landscape and described the resilience areas supervisors may examine as they follow up.

This article maps the resilience themes in the ECB speech and the limited part that AI request evidence can support. I will be direct about which asks a gateway has nothing to do with, and which ones it produces the exact evidence a supervisor will ask to see.

The supervisory signal

The ECB directly supervises roughly 110 significant institutions across the eurozone under the Single Supervisory Mechanism. The public speech is supervisory context rather than a new regulation or public October filing requirement; it signals the controls supervisors may examine as they follow up.The June 3 speech said the ECB intended to send all banks a “dear CEO” letter and follow up with individual banks in a targeted way. It is supervisory context rather than a new regulation. Banks should use the final text of any later communication to determine its recipients, scope, and requested evidence.

The June 3, 2026 ECB speech, "Strengthening operational resilience for the age of AI," is the source for this supervisory emphasis. The speech covers faster vulnerability and patch management, stronger monitoring and detection, closer scrutiny of third-party technology providers and supply-chain risk, modernisation of legacy technology, and better crisis-management and information-sharing. That is five workstreams. Only two of them sit anywhere near AI request traffic.

The asks a gateway has nothing to do with

I will name these plainly so the rest of the article stays honest. Three of the ECB's five asks are outside the boundary of an AI policy gateway.

Faster vulnerability and patch management is a cadence and tooling problem across your whole estate. A proxy on AI traffic does not shorten your patch window. Legacy technology modernization is a multi-year architecture program that has nothing to do with LLM calls. Crisis management and information-sharing is an organizational capability built on runbooks, ISAC membership, and tabletop exercises. A bank should not claim that an AI gateway addresses these three areas; those controls need their own evidence and owners.

Say what each control actually covers. When a supervisory response addresses patch management, it should describe patch management. Padding those sections with AI-gateway language would obscure the control boundary.

The two areas where AI request evidence helps

Two themes from the ECB speech land on the AI request layer.

The first is scrutiny of third-party technology providers and supply-chain risk. Every large bank in the eurozone now routes some inference through OpenAI, Anthropic, Azure OpenAI, or Amazon Bedrock, often more than one at once. Those are third-party technology providers whose use should be governed and evidenced under the bank's applicable resilience controls. Supervisors will want to know which model providers process what categories of data, under what contractual terms, and with what evidence that the bank supervises the relationship continuously rather than at procurement time. This connects directly to the ICT third-party register work that DORA already requires of EU banks.

The second is monitoring and detection. The ECB wants to see that a bank can observe what its systems are doing, and AI request traffic is a data channel most monitoring stacks are blind to. Network DLP inspects encrypted web traffic and cannot read the prompt. A gateway that terminates the AI request and records who sent what to which model closes that specific observability gap.

What supervisors may inspect

Supervisory follow-up tests a bank's resilience claims against operational reality, so the control description needs inspectable evidence.

For the third-party provider ask, the inspectable artifact is a record, per AI request, of the model provider called, the data classification involved, and the identity that authorized the call. For the monitoring ask, the inspectable artifact is a decision log a supervisor can read without trusting the application that generated it. The self-attestation problem applies here with full force: a record written by the system under review is weaker evidence than a record written by an independent decision point. A bank that can produce a signed, identity-bound record for every model call has answered the monitoring and third-party asks with evidence rather than narrative. This aligns with the EU AI Act Article 12 traceability requirement the same banks are already mapping.

DeepInspect

This is the gap DeepInspect closes for the two in-boundary asks. DeepInspect is a stateless proxy at the AI request boundary. It binds every model call to the natural-person or agent identity the application supplies, classifies the prompt content against the regulated categories a bank recognizes, applies per-route and per-role policy, and commits a signed per-decision audit record before the response returns.

For supervisory review, that produces two inspectable artifacts a Joint Supervisory Team can request. The third-party provider record names which model provider handled which class of data under which identity, on a continuous basis rather than at contract signing. The monitoring record is an independent decision log the bank does not have to reconstruct after the fact. Neither of these addresses patching, legacy modernization, or crisis management, and any supervisory materials should be explicit about that division so the AI section remains precise rather than oversold.

If you are a eurozone bank strengthening AI-specific operational-resilience evidence, let's talk today.