ECB Intensifies Scrutiny of Banks' AI Sector Exposure

- The European Central Bank has formally designated the supervision of how banks use AI applications as a priority for the years 2026-2028. - A key concern for regulators is the concentration of risk and systemic threats arising from the banking sector's reliance on a small number of foreign technology giants for essential AI infrastructure and cloud services. - The scrutiny extends to operational resilience, with the ECB specifically questioning banks on their contingency plans, including data recovery and backups, should a critical third-party cloud or data center provider suddenly become unavailable. - Banks are being compelled to conduct complex mapping of their financial exposure, which goes beyond direct loans to AI companies to include indirect links, such as the financing of data centers and their electricity suppliers. - This supervisory focus is aligned with the broader EU AI Act, which classifies AI systems used for credit scoring and fraud detection as "high-risk," imposing strict requirements for risk management, data governance, and human oversight. - The ECB's updated guide on internal models now mandates that a comprehensive model risk management framework must apply to *all* models, including AI and machine learning applications, not just those used for regulatory capital calculations. - The increased oversight follows a massive wave of investment, with banks and private credit firms globally having already funneled trillions of dollars into the AI sector's build-out, spanning development companies, data centers, and energy supply. - In workshops with 13 banks, the ECB found that while many were updating governance frameworks, more work was needed to close accountability gaps and adapt data governance standards specifically for the requirements of AI models.