ESRB Warning: Frontier AI Reclassified from "High" to "Severe" Risk

On June 25, 2026, the European Systemic Risk Board (ESRB) adopted, and on July 7 officially published, Warning ESRB/2026/3. The warning raises the classification of the systemic cyber risk associated with frontier AI models from "high" to "severe"—the highest alert level used by the institution.

The reclassification reflects the rapid evolution of the offensive capabilities of frontier AI models. According to the document, these systems are already capable of autonomously discovering vulnerabilities in critical infrastructure, generating functional exploits, and carrying out complete cyberattacks at a speed, scale, and level of precision far beyond anything previously observed. The ESRB considers this technological leap a genuine turning point for cybersecurity.

The Board also summarized its key findings in a press release published alongside the warning. Experts from the National Bank of Romania participated in the technical analysis that underpinned the warning.

The ESRB also highlighted an additional structural risk: the concentration of leading frontier AI model providers outside the European Union. According to the Board, this exposes the EU to strategic dependence and geopolitical risks that cannot be effectively addressed through internal regulation alone. As a result, the European Central Bank has already instructed the institutions under its direct supervision to assess the impact of this new threat landscape without delay and to prepare concrete action plans by October 31, 2026.

The European Supervisory Authorities (EBA, ESMA and EIOPA) have also endorsed the ESRB warning. They stressed that, while the existing regulatory framework—including the Digital Operational Resilience Act (DORA) and the Artificial Intelligence Act (AI Act)—provides a solid foundation, the speed and scale of frontier AI capabilities nevertheless raise legitimate concerns about the operational resilience of the financial sector.

NBR's Response: Continuous Monitoring, No Cause for Panic

The NBR's statement aims to place the European warning in its proper context. According to the central bank, the ESRB warning is a preventive macroprudential policy instrument. It does not signal that an incident has occurred, nor does it suggest that a systemic disruption of Romania's financial sector is imminent.

The Bank also stresses that these concerns are not new. It continuously monitors operational and cyber vulnerabilities through the supervision of credit institutions and financial market infrastructures, the analysis of reported incidents, on-site assessment missions, questionnaires, and thematic reviews focusing on digitalization and the use of artificial intelligence within the banking sector.

The NBR further notes that its supervisory toolkit includes dedicated cyber stress-testing exercises for the banking sector, as well as advanced cyber resilience tests regularly conducted since 2024 by systemically important credit institutions and financial market infrastructures. These exercises are designed to simulate the techniques employed by sophisticated threat actors. According to the central bank, the most recent exercise did not reveal any significant operational vulnerabilities, and the institutions involved generally demonstrated that they were prepared to activate their business continuity plans and crisis management procedures.

Why AI Is Bringing Cash Back into the Spotlight

Perhaps surprisingly, the NBR's statement places particular emphasis on cash. The central bank reiterates that cash remains an essential component of the monetary system and that ensuring access to physical money for both individuals and businesses is a constant priority. Beyond supporting day-to-day economic activity, cash also plays an important role in promoting financial inclusion, particularly in areas with limited banking infrastructure.

Beyond the normal functioning of the economy, however, cash becomes especially valuable during times of crisis. As cyber risks intensify against the backdrop of today's geopolitical environment, this argument gains additional weight. In a special section on access to cash published in its December 2024 Financial Stability Report (https://www.bnr.ro/Raport-asupra-stabilitatii-financiare-2024-29608.aspx), the NBR reported that currency in circulation had reached RON 120.3 billion, while cash availability stood at 98%.

At the same time, the central bank is careful to avoid misinterpretation. Cash and digital financial services should be viewed as complementary, not as mutually exclusive alternatives. Keeping a reasonable amount of cash on hand can help ensure the continuity of essential payments during exceptional circumstances. However, holding large sums outside the banking system carries its own risks—including theft, loss, or destruction—which are difficult to justify given the proven stability of Romania's banking sector. Eligible deposits also remain protected under the national deposit guarantee scheme, up to €100,000 per depositor, per bank.

The NBR therefore stresses that a prudent assessment of cyber risks should not be interpreted as a recommendation to withdraw bank deposits or abandon digital financial services.

Implications: Frontier AI Officially Enters the Category of Systemic Risks

For the first time, a European financial supervisory authority has officially classified frontier AI models as a source of systemic risk in their own right, rather than merely as tools that criminals may occasionally exploit—a perspective that has largely dominated public discussion until now.

According to the ESRB, frontier AI models now represent a technological category capable of fundamentally reshaping the nature of cyber threats across the European Union's financial architecture.

The fact that the warning was issued only a few months after the risk had been classified as "high" rather than "severe" also illustrates how rapidly institutional assessments of these models' offensive capabilities are evolving. It comes at a time when existing regulatory frameworks—from DORA to the AI Act—are increasingly being challenged by a pace of technological progress that regulators can no longer easily anticipate.

From this perspective, the NBR's statement is more than a response to a European warning. It is one of the first clear signals that central banks are beginning to treat frontier AI as a factor capable of directly affecting financial stability.

Sources