On October 13, banking supervisors in the United States, the United Kingdom and Europe stepped up questions about how lenders control advanced artificial intelligence, including agents that can act with limited human supervision.

The inquiries seek evidence of oversight, not compliance with new binding rules. But they come as the European Central Bank has set a separate deadline for banks to submit plans addressing AI-enabled cyber threats by the end of October.

The immediate test is whether banks can track, limit and stop AI systems, then recover if a cyberattack disrupts their operations.

What US regulators want to know

Reuters reported that the Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation are asking banks about advanced AI models, including Chinese-developed systems, and the use of AI agents in cyber defence.

Supervisors want to know whether banks can:

  • Keep an agent within its authority.
  • Monitor and audit its decisions.
  • Maintain human involvement in key choices.
  • Shut the system down when needed.

In practical terms, banks must be able to show that an agent’s actions can be traced and interrupted, not just that the bank has adopted the technology.

Europe’s focus: recovery if defences fail

In Europe, the European Central Bank and the Bank of England are pressing lenders on recovery planning. Reuters reported that the European Central Bank set an end-of-October deadline for banks to submit action plans addressing AI-enabled cyber threats.

British supervisors are encouraging the largest banks to examine “bare metal” recovery. This means restoring operations using systems separate from a bank’s main technology environment.

A June 3 speech by the European Central Bank adds context. It said more than 85% of banks under European banking supervision use AI. It also warned that advanced models could help attackers find and exploit software vulnerabilities faster.

The European Central Bank said its suggested good practices do not create new legally binding requirements. That makes the distinction clear: supervisors are pressing banks for preparation and evidence, while the inquiries themselves do not impose new rules.

What changes for customers?

No new rule in these inquiries requires banks to stop using AI. The immediate pressure is to demonstrate oversight and a credible recovery plan. That matters to customers because cyber disruption can affect banking services and payments.

Bank leaders may need to explain who can approve an agent’s actions, how its decisions are recorded and what happens when the system needs to be switched off. The European Central Bank’s end-of-October deadline is a concrete next step; the wider information-gathering effort has not produced new binding standards.