ESAs Flag Non-EU ICT Reliance and AI-Driven Cyber Risk

On 23 September 2026, the EBA, EIOPA, and ESMA (the ESAs), acting through their Joint Committee, published their Autumn 2026 risk update (reference JC 2026 29), naming reliance on non-EU ICT providers and infrastructures, cyber risk amplified by increasingly capable AI models, and the rapid, opaque growth of private credit as the three vulnerabilities supervisors should watch most closely. For DORA compliance teams, the first two land squarely on the third-party risk and ICT risk-management pillars.

What the ESAs flagged

The update's central warning is about external dependency: the financial sector's reliance on ICT service providers based outside the European Economic Area could amplify the impact of geopolitical shocks and operational disruptions, a concern that sits directly on top of the concentration risk assessment DORA already requires under Article 29 before outsourcing a critical or important function. Alongside it, the ESAs point to growing cyber risk linked to increasingly capable AI models, and note that data from DORA's own incident reporting regime shows system failures, not attacks, still account for most ICT incidents, even as cyberattack volumes remain high.

Private credit is the third flagged vulnerability, but it is a market-growth and financial-stability concern rather than an ICT or operational one, so it sits outside DORA's scope and outside this site's coverage.

Why the ESAs say DORA is not enough on its own

The update frames DORA and the EU AI Act as providing "a solid foundation" for managing these risks, but is explicit that the rulebook alone will not close the gap: firms still need stronger cybersecurity controls, contingency planning, better software development practices, and newer defensive techniques, including AI-assisted security testing, to keep pace with AI-accelerated attack methods. That reading points back to two existing obligations rather than any new rule:

• Third-party risk (Articles 28-29): entities relying on non-EU ICT third-party providers, and especially critical ICT third-party providers, should revisit their concentration-risk assessment with the geopolitical dimension the ESAs describe in mind, not just operational redundancy.
• ICT risk management (Article 6): the framework's cryptographic and detection controls need to reflect DORA's own requirement to adopt state-of-the-art cryptographic techniques against emerging threats, and the management body should be able to show it has considered AI-accelerated attack timelines specifically, echoing the ESRB's own warning on this from July 2026.

What to do now

• Re-run your concentration-risk assessment with a geography lens. If a critical or important function depends on a provider based outside the EEA, document that dependency explicitly rather than folding it into a generic vendor-risk rating.
• Check your register of information tags non-EU providers clearly. Our TPP register generator builds a first-draft register in the EBA's own structure, provider by provider, which makes this kind of geography filter straightforward to run later.
• Confirm AI-accelerated threats are a named line item, not a footnote, in both the ICT risk-management framework and the resilience-testing programme, consistent with the ESRB warning and ECB follow-up already covered on this site.
• Benchmark where you stand with the DORA Readiness Score, which scores third-party risk and ICT risk management alongside the other three pillars.

Sources

• ESMA (on behalf of the EBA, EIOPA, and ESMA), ESAs call for vigilance over external dependencies, cyber threats and private credit risks, 23 September 2026.
• EBA, ESAs call for vigilance over external dependencies, cyber threats and private credit risks, 23 September 2026.
• Joint Committee of the ESAs, Joint Committee Update on Risks and Vulnerabilities in the EU Financial System, Autumn 2026 (JC 2026 29), 23 September 2026.
• Regulation (EU) 2022/2554 (DORA), Articles 6, 28-29, EUR-Lex.

Last updated: 27 September 2026.