The ECB wants your AI cyber action plan by 31 October 2026.
On 7 July 2026, the ECB wrote to the CEO of every bank it supervises directly: AI models now find software vulnerabilities and build working exploits faster, so banks need a plan to keep up. The letter lists six focus areas. Here is what each one asks, what it means for your mobile apps and their APIs, and where Ostorlab helps you deliver the application part of the plan.
- Finds exploitable issues in your mobile apps and the APIs behind them
- Tests every release, so remediation keeps pace with new findings
- Backs each AI-agent finding with a working exploit you can replay
- Runs the AI on your own provider key, with every validation step open to review
- Who it applies to
- Significant institutions, the banks the ECB supervises directly
- What is due
- An action plan with measures, resources, owners and timelines
- Deadline
- 31 October 2026, to your Joint Supervisory Team
- Reference
- Letter SSM-2026-0301 of 7 July 2026
From the letter to supervisory follow-up
The ECB set a short deadline and a follow-up process. These are the dates in the letter and in the guidance it points to.
- 21 April 2026
CERT-EU guidance
CERT-EU publishes the guidance the letter references. It advises remediating critical vulnerabilities on exposed assets within days, not weeks.
- 7 July 2026
Letter to bank CEOs
Letter SSM-2026-0301 asks significant institutions for an action plan. The ESRB warning on systemic cyber risks from frontier AI models is published the same day.
- 31 October 2026
Action plan due
The plan goes to your Joint Supervisory Team, with concrete measures, resources, roles and implementation timelines.
- After submission
Follow-up and horizontal analysis
The Joint Supervisory Team discusses the plan with the bank and monitors its progress. The ECB analyses all submitted plans and shares its conclusions with significant institutions.
- February 2027
IT Risk Questionnaire
To free up resources, the ECB moved the annual IT Risk Questionnaire collection from September 2026 to February 2027.
The ECB letter, focus area by focus area
The letter is not a new regulation. It builds on DORA and asks each bank to assess the new threat without delay and act on it. For each part: what the letter says, what it means for your mobile apps, how Ostorlab helps, and what stays with your team.
- ECB letter SSM-2026-0301, pages 1 and 2
Build a comprehensive action plan and submit it on time
What the letter says
Assess the impact of AI-enabled threats without delay and develop a comprehensive action plan with concrete measures, the necessary resources, clear roles and responsibilities, and implementation timelines. The plan builds on your existing cyber-risk strategy, covers short-term priorities and longer-term structural measures, and goes to your Joint Supervisory Team by 31 October 2026.
What it means for your mobile apps
The plan needs an application security workstream with named owners, resources and dates, not a statement of intent. Supervisors will monitor progress against it.
How Ostorlab helps
Ostorlab gives the application workstream measurable content: a baseline of findings for each app, remediation tracked as tickets, and retest results you can report as progress.
What stays with you
The plan itself, its governance, budget and resourcing decisions, and the dialogue with your Joint Supervisory Team.
- ECB letter SSM-2026-0301, page 1
Close open supervisory findings without delay
What the letter says
Address open supervisory findings and measures in the ICT areas in focus, and security risks already identified in on-site inspections, targeted reviews and the 2024 cyber-resilience stress test. Weaknesses left unresolved may become increasingly material as threats accelerate.
What it means for your mobile apps
If an earlier inspection or pentest flagged issues in your digital channels, the plan should show them closed or on a dated path to closure.
How Ostorlab helps
Retest the app and API findings from earlier reviews to show which ones are fixed, with evidence for each result.
What stays with you
Tracking supervisory findings and reporting their closure to your supervisors.
- Annex 1, focus area 1
Prioritise the protection of your attack surface
What the letter says
Identify ICT assets, including third-party software and open-source components, to prioritise remediation. Minimise and continuously monitor all internet-facing and externally exposed assets, and prioritise perimeter technologies in remediation.
Source:Annex 1, focus area 1
What it means for your mobile apps
Your mobile apps, the APIs they call and the SDKs they embed are externally exposed, and each app release changes that surface.
How Ostorlab helps
Ostorlab tests the build your customers download and the APIs it calls, lists the SDKs and native libraries in each release, and finds hardcoded secrets such as API keys and tokens before they ship. Attack surface discovery helps you find the apps and assets you expose.
What stays with you
Perimeter devices, VPNs, cloud environments and the rest of your external estate.
- Annex 1, focus area 2
Accelerate vulnerability and patch management at scale
What the letter says
Prioritised vulnerability scanning may help institutions cope with the increasing speed and volume of vulnerability discovery. Prepare for more frequent, higher-volume patching, including of internally developed software, with change management that enables rapid, risk-based remediation while keeping operations stable.
Source:Annex 1, focus area 2
What it means for your mobile apps
In-house mobile apps are internally developed software: expect more fixes, more often, and plan testing that keeps up with every release.
How Ostorlab helps
Scans run on every release. The AI-agent pentest backs each AI-agent finding with a working exploit you can replay, and false positives stay under 5%, so the queue is ordered by what can actually be exploited.
What stays with you
Patch deadlines, change management and the staffing of your ICT function.
- Annex 1, focus areas 2 and 5
Use AI-based tools with safeguards and human oversight
What the letter says
AI-based tools could complement vulnerability scanning, provided their deployment is preceded by a thorough assessment of benefits and risks and remains subject to adequate safeguards, human oversight and robust risk management. AI-assisted defensive tools can help banks keep pace, provided they are deployed with appropriate governance, validation and human oversight.
Source:Annex 1, focus areas 2 and 5
What it means for your mobile apps
If you add an AI testing tool to the plan, document the assessment: what the tool can access, where the data goes, how results are validated and who reviews them.
How Ostorlab helps
You can inspect each validation path, including the decisions, tool outputs and steps taken. With BYOK, the AI runs on your own model provider account, with your credentials, your choice of model and a spend cap per scan. Ostorlab is SOC 2 Type II audited, and on-premises scanning is available.
What stays with you
The risk assessment and approval of the tool under your own AI and ICT risk policies.
- Annex 1, focus area 3
Enhance monitoring and detection
What the letter says
Strengthen monitoring of application and access logs, network traffic and other indicators to detect indicators of compromise and attempted exploitation, especially across internet-facing applications, cloud repositories and critical internal systems.
Source:Annex 1, focus area 3
What it means for your mobile apps
Detection is a runtime operations capability, separate from testing the app before and after release.
How Ostorlab helps
This area is outside Ostorlab's scope. Ostorlab tests your apps and APIs; it does not monitor production logs or traffic.
What stays with you
Security monitoring, detection engineering and your security operations centre.
- Annex 1, focus area 4
Strengthen governance, funding and supply chain assurance
What the letter says
Management bodies should check that ICT budgets, staffing, tooling and change capacity are sufficient. Banks remain fully accountable for outsourced ICT services and need to understand their providers' readiness for accelerated disclosure and patching. Risk appetite frameworks should be reviewed, including metrics and tolerance thresholds for more frequent patching.
Source:Annex 1, focus area 4
What it means for your mobile apps
The SDK vendors inside your app and your security tooling vendors are part of that supply chain, and metrics such as time to fix critical app findings belong in the risk appetite framework.
How Ostorlab helps
SCA shows which third-party components each release ships, maps them to known vulnerabilities and tracks their closure from release to release. Ostorlab's own controls are in the Trust Center, and its SOC 2 Type II report is available on request.
What stays with you
Budgets, training, vendor assessments and the risk appetite metrics themselves.
- Annex 1, focus area 5
Reinforce defence-in-depth and build security in
What the letter says
Assume perimeter defences will be breached. Apply zero-trust principles, including continuous verification of users, devices, applications, APIs and service accounts; keep strong baseline controls such as multi-factor authentication; use security-by-design development to reduce vulnerabilities before deployment; and replace or protect legacy technologies.
Source:Annex 1, focus area 5
What it means for your mobile apps
For a banking app, every API call should be authorised on the server, the app should protect itself on compromised devices, and security checks should run before each release, not after an incident.
How Ostorlab helps
Ostorlab tests broken access checks behind the app (BOLA, BFLA, IDOR), MFA enforcement and session handling, and whether shielding such as root and jailbreak detection, anti-tampering and TLS pinning holds at runtime. Static and dynamic tests in the release pipeline support security by design.
What stays with you
Network segmentation, identity architecture and legacy replacement.
- Annex 1, focus area 6
Improve operational resilience and information sharing
What the letter says
Regularly test crisis management, incident response, backup, failover and recovery arrangements in line with DORA, including exercises with high-speed, high-volume attack scenarios and supply chain disruption, and use trusted arrangements to share threat and vulnerability information.
Source:Annex 1, focus area 6
What it means for your mobile apps
These exercises test how your organisation responds, not the app's code.
How Ostorlab helps
This area is outside Ostorlab's scope, although a replayable exploit from a real finding can make an exercise scenario concrete.
What stays with you
Crisis management, backup and recovery testing, and information sharing.
Summary of ECB letter SSM-2026-0301 of 7 July 2026 and its Annex 1. This page is not legal advice.
The application part of your plan, focus area by focus area
Where Ostorlab supports your mobile apps and their APIs, and the evidence you can attach to the plan and its follow-up.
| What the letter asks | How Ostorlab helps | Evidence you keep |
|---|---|---|
| Concrete measures with owners and timelinesLetter, pages 1 and 2 | A baseline of findings for each app, remediation tracked as tickets, and retests. | Open findings per app over time, and remediation status |
| Close earlier findingsLetter, page 1 | Retests app and API findings from earlier reviews. Details | Retest result for each finding |
| Exposed assets and third-party componentsAnnex 1, area 1 | Tests the store build and its APIs, lists SDKs and native libraries, and finds hardcoded secrets. Details | Components per release, with versions and mapped vulnerabilities |
| Prioritised vulnerability scanning at scaleAnnex 1, area 2 | Scans on every release, with exploit-backed findings and false positives under 5%. Details | Risk rating and a replayable exploit for each AI-agent finding |
| AI tools with safeguards and human oversightAnnex 1, areas 2 and 5 | Inspectable validation paths, BYOK with a spend cap per scan, on-premises scanning. Details | Validation path per finding, and the SOC 2 Type II report |
| Continuous verification of applications and APIsAnnex 1, area 5 | Logged-in testing that follows the app into its APIs to test authorization, sessions and MFA enforcement. Details | Request and response logs and reproduction steps for each finding |
| Security by design before deploymentAnnex 1, area 5 | Mobile SAST and DAST in the release pipeline, before the app reaches the store. Details | Scan results for each build |
| Supply chain assuranceAnnex 1, area 4 | SCA across releases, and Ostorlab's own SOC 2 Type II audit for your vendor review. Details | Mapped component vulnerabilities, and Ostorlab's vendor documents |
Monitoring and detection (focus area 3) and crisis management and recovery (focus area 6) are outside Ostorlab's scope.
An application security workstream for your plan
One way to structure the application part of the plan before 31 October 2026. The ECB does not prescribe this format.
Inventory exposed apps and APIs
List every customer-facing mobile app, the APIs it calls and the SDKs it embeds, each with an owner.
Take a baseline
Scan each app to measure open findings today. A free store scan takes minutes, and full scans usually take 15 to 45 minutes.
Close what is already known
Start with open supervisory findings and exploitable issues, then retest to confirm the fixes.
Set remediation targets
Agree fix deadlines by severity. CERT-EU, cited in the letter, advises fixing critical vulnerabilities on exposed assets within days, not weeks.
Assess the AI tool
Document the benefits, risks, data flows, safeguards and human review of any AI testing tool, as the letter asks.
Test every release
Put static, dynamic and AI-agent testing into the release pipeline, so new code does not reopen the gap.
Choose the metrics you will report
For example, open critical findings per app, time to fix and retest pass rate, so your supervisors can see progress.
Name owners and dates
Give each measure an owner, resources and a timeline: the elements the letter asks for.
Example only: the ECB does not prescribe a template. This is not legal advice.
The capabilities behind this page
Each one has its own page with the details.
- Mobile Agentic Deep ScanAI agents pentest the store build on every release, with a working exploit you can replay for each AI-agent finding.Learn more
- Authenticated testingTest login, one-time codes and step-up flows with your test accounts.Learn more
- API and backend testingIntercept app traffic even with TLS pinning, then test the APIs and backends behind accounts and payments.Learn more
- Mobile SASTBinary-based static analysis of APK, AAB and IPA files, with taint analysis across the app and its embedded SDKs.Learn more
- SCA and SBOMFind vulnerable dependencies, including statically compiled native libraries, and track their closure release after release.Learn more
- Mobile Shielding ScanTest root and jailbreak detection, anti-tampering and pinning at runtime, and see which protections held and which were bypassed.Learn more
- Bring your own AI keyRun AI-agent scans on your own AI provider key with a spend cap per scan, so usage follows your internal policies.Learn more
- On-premises scanningScan staging apps, APIs and repositories behind your firewall or VPN, on infrastructure you control.Learn more
Trusted by banks and fintechs, including
Sources
The official texts this page is based on, checked on 27 September 2026.
- ECB Banking Supervision: Addressing AI-enabled cybersecurity threats (PDF)Letter SSM-2026-0301 from Claudia Buch, Chair of the Supervisory Board, to the CEOs of significant institutions, 7 July 2026, with Annex 1 (focus areas) and Annex 2 (international guidance)
- Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA)Official Journal of the European Union, the regulation the ECB letter builds on
- CERT-EU: AI is changing the economics of vulnerability discovery. Defenders should adapt nowGuidance of 21 April 2026, referenced in the ECB letter
- ESRB warning on systemic cyber risks stemming from frontier artificial intelligence models (PDF)Warning ESRB/2026/3 of 25 June 2026, referenced in the ECB letter
- ECB Banking Supervision: Letters to banksAll supervisory letters published by the ECB
Frequently asked questions
Straight answers on coverage, setup, and how results reach your team.
Can't find your answer? Book a demo or contact us.
Start on the application part of your plan today
Scan one of your apps from the store for free to see the findings you would get, or book a demo to plan testing across your releases before 31 October.