Communication to the market on digital operational resilience and advanced artificial intelligence models

Emerging technologies, and artificial intelligence (AI) systems in particular, are transforming the cybersecurity landscape and creating new challenges due to their potential implications for the confidentiality, integrity and resilience of information systems and the information they manage, including in the financial sector.

The most advanced generation of AI models can identify software vulnerabilities and simultaneously generate methods for exploiting them, within extremely short timeframes and without the need for specific technical expertise. This significantly reduces the time interval between the discovery of vulnerabilities and their exploitation, thereby increasing the risk of successful cyberattacks.

New AI technologies may therefore widen the asymmetry between attackers and defenders, to the detriment of the latter, requiring rapid adaptation by financial entities (1). In this new environment, strengthening digital operational resilience is not merely a compliance requirement but an essential condition for ensuring business continuity and the ability to provide reliable financial services.

In light of these developments, Banca d'Italia - in line with the European banking supervision approach and taking into account the requirements of the Digital Operational Resilience Act (DORA), which remain highly relevant in this context - calls on financial entities to promptly identify and implement the measures needed to enhance the security processes and controls protecting their systems, with the aim of strengthening their operational and cyber resilience.

(1) This communication is addressed to the following entities directly supervised by Banca d'Italia's Directorate General for Financial Supervision and Regulation: less significant banks and banking groups (including BancoPosta), payment institutions, electronic money institutions, investment firms, managers of alternative investment funds, management companies, crypto-asset service providers, issuers of asset-referenced tokens, crowdfunding service providers and financial intermediaries under Article 106.

Sezione di approfondimento