Helpful links

Popular Topics

Managing ICT risks when using artificial intelligence solutions

Artificial intelligence (AI) models in the field of cybersecurity are expected to become more widely available in the near future, with particular attention being paid to the development of general-purpose large language models. Given the capabilities of AI models and their speed in detecting vulnerabilities, significant information and communication technology (ICT) security benefits can be achieved, including the identification of vulnerabilities, the development of security patches, and the management of ICT change processes much faster than has been possible to date.

At the same time, the development of AI models for cybersecurity is not associated solely with risks. These models can also be used preventively to improve the security of ICT assets, including by identifying vulnerabilities that have remained undetected for a long time, supporting secure software development, and strengthening the security of critical information systems.

Latvijas Banka, together with the European Supervisory Authorities (EBA, EIOPA and ESMA[1]), the Joint Committee, and the European Central Bank, monitors the use and development of AI models in the field of cybersecurity and coordinates its work with the European Commission, the ESRB[2], and ENISA[3].

The European Union regulatory framework provides an important foundation for the management of cybersecurity risks, with particular emphasis on the establishment of an ICT risk management system, security and resilience testing, incident and operational recovery management, as well as the management of risks related to third-party ICT service providers.

Regulation (EU) 2022/2554 on digital operational resilience for the financial sector

Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), together with the related Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS), sets out a harmonised set of core requirements across the financial sector regarding ICT protection measures to be implemented by financial market participants. The requirements for ICT risk management in the use of AI include:

  • protection of ICT assets and prevention of unauthorised access (Article 9 of DORA);
  • detection of anomalous activities, including the detection of ICT network performance issues and ICT-related incidents (Article 10 of DORA);
  • ensuring ICT business continuity policies (Article 11 of DORA);
  • ensuring backup policies and recovery procedures (Article 12 of DORA);
  • strengthening organisational capabilities and staff competence for the collection of information on vulnerabilities and cyber threats (Article 13 of DORA);
  • conducting vulnerability assessments within resilience testing frameworks (Article 25 of DORA);
  • ensuring ICT operational security, including vulnerability and patch management.

Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence

Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (the AI Act) establishes a supervisory framework for general-purpose AI models (GPAI) with systemic risk[4]. If, based on a European Commission decision assessing its systemic risk, a general-purpose AI model is classified as a model with systemic risk, additional obligations apply to its provider[5]. These include transparency requirements, the provision of appropriate technical documentation, and obligations related to cybersecurity aspects.

In July 2025, the European Commission published guidelines on the scope of the obligations laid down in the AI Act for providers of general-purpose AI models[6]. The guidelines clarify that providers of general-purpose AI models with systemic risk are expected to cooperate with the AI Office, including by proactively providing essential information on serious incidents and cybersecurity breaches related to the model or its physical infrastructure.

In accordance with Article 89(2) of the AI Act, users of AI models, including financial market participants using AI models in the field of cybersecurity, are entitled to lodge a complaint regarding a possible breach of the AI Act committed by providers of general-purpose AI models.

[1] European Banking Authority, European Insurance and Occupational Pensions Authority, European Securities and Markets Authority

[2] European Systemic Risk Board

[3] European Union Agency for Cybersecurity

[4] Under the AI Act, a general-purpose AI model is defined as “an AI model, including where such an AI model is trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market, and that can be integrated into a variety of downstream systems or applications” (Article 3(63) of the AI Act).

[5] The obligations laid down in the AI Act for providers of general-purpose AI models apply from 2 August 2025, and the European Commission, acting through the AI Office, has been entrusted with the supervision, investigation, enforcement and monitoring of those obligations. The enforcement powers under the AI Act include the European Commission’s power to request information (Article 91 of the AI Act), conduct evaluations of general-purpose AI models (Article 92 of the AI Act), require providers to take measures, including the implementation of risk-mitigation measures and the withdrawal of a model from the EU market (Article 93 of the AI Act), as well as to impose fines from 2 August 2026 (Article 101 of the AI Act).

[6] Guidelines on the scope of obligations for providers of general-purpose AI models under the AI Act | Shaping Europe’s digital future

The identified risks include:

  • an increased risk of vulnerability discovery and exploitation in core operations, legacy and other information systems;
  • greater exposure to risks arising from insufficient cyber hygiene, including inappropriate configurations and excessive access rights;
  • increased risk relating to third-party ICT service providers and ICT concentration risk, where the cybersecurity of software, cloud services, or ICT service providers overall is affected;
  • elevated supply chain risk, including dependence on a limited number of ICT service providers, software vendors, and AI model providers;
  • increased risk of simultaneous or coordinated incidents across the services, sectors, or market infrastructures of multiple financial market participants.

Area

Possible risk mitigation measures

ICT asset management

  • Identify ICT assets that support critical or important functions.

  • Determine the criticality of ICT assets, their owners, and dependencies on third-party service providers.

Access rights management

  • Ensure regular reviews of user access rights.

  • Ensure control and independent oversight of privileged access rights.

  • Ensure that access rights are granted, modified and revoked in accordance with the principle of least privilege.

Configuration management

  • Define secure configuration requirements for infrastructure components, cloud services, applications and databases.

  • Ensure that configuration changes are documented, approved and traceable.

Management of AI tools used by employees

  • Define the AI tools that are permitted and the conditions for their use.

  • Ensure that employees are informed of the limitations on the use of AI tools and the risks associated with them.

Management of risks related to third-party ICT service providers (TPPS)

  • Develop a TPPS management procedure.

  • Assess alternative solutions and ICT concentration risk before selecting a significant TPPS.

  • Maintain an information register covering all contractual arrangements with TPPS.

  • Develop an exit strategy for TPPS supporting critical or important functions.

  • Assign management body responsibility for oversight of contractual arrangements and cooperation with TPPS.

Audit log management

  • Define the scope of audit logs for infrastructure components, applications and databases, as well as their logging frequency and retention periods.

  • Define the minimum set of events to be logged, including authentication, access, privileged activities, configuration changes and security events.

  • Ensure protection of audit logs against tampering, deletion and unauthorised access.

Governance of the use of AI

  • Promote the use of AI models in cybersecurity for vulnerability detection and remediation.

  • Ensure human review and approval before any decision on implementing changes or deploying security patches.

Security testing management

  • Ensure regular testing of ICT systems and applications supporting critical or important functions.

  • Ensure that security testing is performed by independent persons or functions.

  • Introduce a process for prioritising, remediating and validating deficiencies identified during security testing.

  • Update procedures for the emergency deployment of security patches.

  • Define deadlines for vulnerability remediation and an accelerated patch deployment procedure.

  • Ensure rollback procedures and capabilities for timely recovery of operations in cases where patch deployment causes incidents.

Business continuity and data recovery

  • Develop and document backup management policies and procedures.

  • Define backup scope, frequency, retention periods and recovery requirements in accordance with the criticality of ICT systems and the RTO/RPO*.

  • Protect backups against deletion, encryption and unauthorised modification.

  • Test the recovery of critical systems and document the actual recovery time, data loss and identified issues.

Incident management

  • Define procedures for incident identification, classification, escalation and investigation.

  • Maintain an incident register and document the measures taken.

  • Ensure the reporting of major ICT incidents to Latvijas Banka through the prescribed channels and within the prescribed deadlines.

Responsibility of the management body

  • Allocate an appropriate budget to ensure digital operational resilience needs across all types of resources.

  • Ensure sufficient resources and organisational capabilities for monitoring user activities, ICT anomalies and ICT-related incidents.

Communication management
  • Monitor publicly available information on vulnerabilities affecting providers of critical services or widely used software.
  • Test crisis communication processes together with business continuity and disaster recovery tests.
*Recovery Time Objective / Recovery Point Objective.

Additional information

 

 

[1] European Banking Authority, European Insurance and Occupational Pensions Authority, European Securities and Markets Authority

[2] European Systemic Risk Board

[3] European Union Agency for Cybersecurity

How valuable was this information for you?
Not valuable Very valuable
How can we improve your experience in our site

This page is protected by Google’s reCAPTCHA and visitors are subject to Google Terms of Service and Google Privacy Policy