The ECB's deadline is 31st October. Your action plan starts here
On 7 July 2026, the ECB gave every supervised bank four months to submit an action plan against AI-enabled cyberattacks. We've built the framework: a guide plus a fill-in Word template ready for the Board and your JST.
Get the Guide and Book a Consultation With Our Team
What the ECB Now Requires
Everything You Need to Build a Credible Plan
A concise walkthrough of the mandate:
- What the letter says
- Who's in scope
- How supervisors will test your plan
- The six fundamentals-first workstreams that satisfy every requirement
A fill-in .docx structured for JST submission:
- 12 workstreams covering every ECB expectation
- Named-accountability blocks, action tables and KPI tables with baselines and dated targets
- Exploitability-driven patching SLAs ready to adopt
- AI-speed crisis exercise scenarios and DORA notification runbooks
- Third-party assessment framework with concentration-risk analysis
- AI governance controls: prompt-injection testing, human-in-the-loop gates
- Guidance notes on every section, written to be deleted, leaving your plan
The Road to 31st October
The Operational Core of the Mandate, Delivered as a Service
Results Our Clients Can Put in Front of a Board
319%
50%
4.8/5
Questions the Board Will Ask
Who does the ECB letter apply to?
All significant institutions directly supervised by the ECB, including the largest euro-area banks and the euro-area subsidiaries of international groups such as US banks. If a Joint Supervisory Team oversees you, the 31 October deadline applies.
What exactly must be submitted by 31 October 2026?
A formal action plan against AI-enabled cyberattacks: concrete immediate and longer-term measures, named accountability, and Board-level direction, submitted to your Joint Supervisory Team.
Is this connected to DORA?
It builds on the same resilience agenda. Our template cross-references DORA obligations, including incident reporting timelines, the Register of Information and threat-led testing, so one control set satisfies both.
Is the template really free?
Yes. We ask for your business details so we can send you the files and relevant updates, including the ECB’s announced follow-up on quantum-computing risk. Unsubscribe anytime.
We’re not ECB-supervised. Is this still relevant?
Yes. Regulators in the UK and US are signalling the same expectations. The ECB letter is simply the first with a date attached. The framework works as a readiness baseline for any financial institution.