UK Financial Authorities Issue Joint Statement on Frontier AI Cyber Risks

The Bank of England, Financial Conduct Authority (FCA), and HM Treasury have issued a joint statement urging regulated firms to prepare for cyber threats from frontier AI models. These models already surpass skilled human practitioners in speed, scale, and cost, amplifying risks to safety, customer trust, market integrity, and financial stability. Firms must enhance protective, detective, containment, and response capabilities. Key domains include governance, vulnerability management, third-party risk, protection, and recovery. Boards must understand frontier AI risks; investment should reflect emerging threats, including end-of-life systems. Vulnerability triage must accelerate via automation. Third-party and supply chain risks, including open-source software, require active monitoring. Automated AI defenses are recommended to match attack speeds. The authorities will monitor developments via the Cross Market Operational Resilience Group (CMORG). Firms should consult NCSC guidance, including a webinar on 14 May 2026 and publications on vulnerability patch waves and AI risk mitigation.