The impact of the development of artificial intelligence on the cybersecurity of entities in the financial market

4 May 2026
Ref.: 2605006

Circular no.: 16/2026
To supervised entities

Subject: The impact of the development of artificial intelligence on the cybersecurity of entities in the financial market

In recent months, the rapid development of artificial intelligence, especially large language models, has affected the nature of cyber threats. Attackers have already begun using artificial intelligence to find vulnerabilities in systems and automate attacks.

The latest models, which have not yet been made accessible to the public, have demonstrated that it is possible to identify and exploit serious vulnerabilities in software with much greater speed and automation than previously known. Such models can in some cases find a number of previously unknown vulnerabilities, so-called zero-day vulnerabilities, and at the same time automatically link them together into complex attack chains.

This means that attackers can, with the assistance of artificial intelligence, move faster from finding a vulnerability to exploiting it in actual attacks. At the same time, artificial intelligence can reduce the need for specialized knowledge to carry out attacks, which can lead to an increased number of attacks and greater breadth in the methods used.

The consequence of this is that the time available to respond to new vulnerabilities is significantly shortened and in some cases can be very limited or non-existent. Traditional processes for analyzing and remediating vulnerabilities still play a key role but need to be faster to meet the changed risk environment.

It should be emphasized that this development is recent and still at a formative stage and it is not fully certain that it will fully materialize in the manner described here. Should the development continue in this direction, a temporary situation may be expected in which a mismatch can arise between the ability of attackers to identify and exploit vulnerabilities on the one hand and the ability of entities to identify and remediate them on the other. Such a mismatch could lead to increased risk over a defined period in which new vulnerabilities are exploited before appropriate mitigation measures have been implemented.

It may be pointed out that Regulation (EU) 2022/2554, on digital operational resilience in the financial market (DORA), which recently entered into force in this country with Act no. 78/2025, on digital operational resilience of the financial market,1 provides a good basis for responding to this development. In view of the foregoing, it is important that supervised entities regularly review their risk assessment and take the following measures in their operations:

• Maintain good basic security practices, including timely security updates for operating systems and other software in use, secure access control and regular review of access permissions.2

[1] https://sedlabanki.is/fjarmalaeftirlit/stafraenn-vidnamsthrottur-a-fjarmalamarkadi-dora/

[2] See further in Article 9 of Regulation (EU) 2022/2554 and Articles 10, 20 and 21 of Delegated Regulation (EU) 2024/1774

• Ensure that oversight of information and communication technology systems and their exposure is clear and up to date, with the aim of reducing unnecessary risk, closing unnecessary access surfaces and further tightening security on those access surfaces that need to be accessible.3

• Strengthen monitoring and analysis of system operations to be able to identify deviations and respond at an earlier stage than before. Shorten response time to new vulnerabilities as much as possible, including by prioritizing remediations and using automation where applicable.4

• Ensure that response processes are clear, documented and tested regularly.5

• Consider risk related to service providers and other third parties, including the use of external technology solutions, ensure regular assessment and oversight of such parties and ensure that third parties are aware of this threat and are responding to it.6

Furthermore, it is important that supervised entities assess themselves or seek advice from companies with specialized knowledge in these matters how new technology, including artificial intelligence, can be used to support their own security work, for example in analyzing vulnerabilities in source code that is under internal development, configuration of systems, monitoring of abnormal activity in systems and automation of responses. The development indicates that artificial intelligence will play an increasingly larger role both for attackers and in defense, and therefore it is important that entities are prepared to use artificial intelligence in an efficient and responsible manner. It is important that supervised entities establish clear rules on the use of artificial intelligence in their operations, including with regard to data processing and information security.

It is urgent to strengthen the education and awareness of employees about new types of cyber threats, including fraud and social engineering, which use artificial intelligence to imitate the sound and image of individuals for fraudulent purposes.

Finally, it is important that supervised entities carry out operational impact analyses for different scenarios that may materialize, adapt their security measures with regard to them and monitor developments in this field.

Entities that do not possess sufficient specialized knowledge to assess the above points are encouraged to seek appropriate professional assistance, including from service providers, in order to ensure the correct response.

Yours faithfully,
CENTRAL BANK OF ICELAND

[3] See further in Article 8 of Regulation (EU) 2022/2554 and Articles 4 and 13 of Delegated Regulation (EU) 2024/1774

[4] See further in Articles 10 and 17 of Regulation (EU) 2022/2554 and Articles 10, 12 and 23 of Delegated Regulation (EU) 2024/1774

[5] See further in Articles 11 and 17 of Regulation (EU) 2022/2554 and Articles 22, 24-26 of Delegated Regulation (EU) 2024/1774

[6] See further in Articles 28 and 30 of Regulation (EU) 2022/2554 and Articles 5-6 and 9 of Delegated Regulation (EU) 2024/1773

Gísli Óttarsson
Executive Director
Prudential Supervision

Ólafur Hlynsson
Specialist
Prudential Supervision