October 31, 2026. That's the date the European Central Bank set for the banks it directly supervises to submit action plans on AI-enabled cyber threats.
Behind the deadline is a simple imbalance. Finding problems got faster. Fixing them didn't.
What supervisors are seeing
On September 2, 2026, the UK Financial Conduct Authority published a multi-firm review of frontier AI and cyber resilience. Its headline observation: "Vulnerability discovery is accelerating faster than firms' ability to respond." Firms described constraints in validation capacity, engineering resource, patch testing, emergency change control and evidence of closure. Some are moving beyond severity scores to weigh exploitability and the impact on business services. The FCA stresses that human oversight remains central to validating findings and making risk decisions, and says the review introduces no new rules or expectations.1
The ECB's July letter goes further for the banks it supervises. It asks boards to review budgets, staffing and risk appetite frameworks, including patching-frequency controls, and says open findings and known security weaknesses should be addressed without delay.2
If finding outpaces fixing, the backlog grows. A growing backlog is a stack of risk decisions that nobody has made.
The queue is a decision
Every unpatched vulnerability sitting in a queue is a risk being accepted. When the queue was short, the order barely mattered. When AI fills it faster than teams can drain it, the order is the risk decision.
Automated scanners produced a smaller version of this flood years ago. AI makes it bigger and faster. The question it raises is the same: who decided what could wait?
The FCA's observation about prioritization helps. Severity alone produces a long list of urgent items. Exploitability and business-service impact produce a shorter list that a person can defend.
Put names on the waiting
Finding: [ID]
Business service exposed: [service]
Exploitability: [actively exploited, plausible, theoretical]
Fix by: [date], or accepted until [date] by [name, authority level]
Compensating control in the meantime: [control]
Set the authority levels in advance. Who can accept a risk on a critical service for 30 days? For 90? Who can accept one that's being actively exploited, if anyone? Without those tiers, acceptance happens by default, at whatever level the queue happens to stop. Write the tiers into the risk appetite statement, where the board already approves thresholds.
Give the board the tail of the list, not the total: the oldest accepted items on the most important services, and who accepted each one. A total tells the board the queue is large. The tail tells it which decisions to question.
Smaller firms face the same arithmetic with fewer people. That makes the tiers more important, not less.
Finding faster is progress only if deciding keeps up.
Related Reading
Read False Green in Disaster Recovery: Why the Finding Determines the Fix for why the nature of a finding should shape the fix that follows.
