Washington Rebrands AI While Europe Tells Banks To Buckle Up

On September 29, President Trump signed an Executive Order renaming AI “Super Intelligence”, requiring US federal agencies to drop the term ‘artificial intelligence’. The order came hours after he met tech leaders at the White House and signed a voluntary accord on safety controls. Meanwhile, European authorities increasingly view frontier models such as Anthropic’s Claude Mythos Preview as a risk banks must manage now – and the first deadline is weeks away. European financial risk leaders need to recalibrate their risk appetite for this technology and understand their exposure. Otherwise, they risk AI-enabled cyber attacks and the resulting regulatory scrutiny, as with Shinhan Bank’s breach in early October.

The European Central Bank (ECB) views frontier AI as a threat to banks’ operational resilience

While over 85% of ECB-supervised banks already use AI, Supervisory Board Vice-Chair Frank Elderson warned in a June speech that tools such as Mythos can find and exploit vulnerabilities faster than ever, cutting the cost of attack. He called it a “firm-wide strategic challenge” that boards must own, not just an IT issue. The European Systemic Risk Board (ESRB) notes that exploits that once took experts weeks now take hours, collapsing the time banks have to patch safely.

Other European counterparts also acknowledge these risks; the European Securities and Markets Authority (ESMA) sees the threat spreading to markets. Its September risk report names Mythos and warns of a “defensive access gap”. Few organizations have been able to gain early access to Mythos to test their defences; European authorities have struggled to get access, with Germany’s Bundesbank urging the EU to request that the technology be shared.

Global financial authorities in Basel take a wider view

The Financial Stability Board (FSB) has proposed 12 non-binding sound practices on AI governance but acknowledges the technology is outpacing its guidance. Though not written for frontier AI, implementing them would help banks manage its risks. Meanwhile, the Bank for International Settlements (BIS) flagged two risks in a September speech: that AI tilts cyber risk towards attackers, and that an AI investment boom funded by debt and ‘circular financing’ could turn into a bust.

What will the authorities do next?

By October 31, 2026, every bank the ECB directly supervises must submit an action plan on AI-enabled cyber threats, with named owners and resources. The ECB will benchmark plans across the sector, and laggards will face targeted follow-up. Smaller banks should expect similar demands from national supervisors, often with far thinner budgets.

The FSB publishes its final report in October, and the ESRB will review frontier AI quarterly. Expect the next wave of guidance to focus on AI stress-testing and model explainability, with a widening gap between large and small banks.

How should financial risk leaders respond?

Rather than waiting for the rulebook, financial risk leaders should prioritize:

• Adding frontier AI to the enterprise risk register, with board ownership, a clear risk appetite and a dedicated budget.
• Mapping every AI model and third-party AI dependency, so concentration and model risk are measured, not assumed.
• Replacing periodic patching with continuous, AI-assisted testing that assumes attacks now arrive in hours, not weeks.

The ECB’s message is clear: banks cannot afford to fall behind the tools that could be turned against them. As the BIS warns, attackers need only one weakness. Risk leaders who act before the October 31 deadline will help shape the rules, rather than react to them.

For more risk management content, check out Verdantix insights.