A senior policy advisor from a European central bank warns that financial institutions relying on generative AI providers based outside Europe may be courting systemic risk. As firms scramble to define responsible AI use, he argues true resilience will re
From my position as a policy advisor on technology strategy at a European central bank, I see AI’s third-party risk not just as a compliance or IT concern – but as a growing macroprudential hazard.
When financial institutions depend heavily on non-European vendors to deliver critical AI infrastructure, we are no longer just talking about innovation. We are talking about strategic dependency.
That’s not to say that AI doesn’t have an exciting and significant role to play in how we manage risk in financial services now and in the future – the technology offers great opportunities the financial sector shouldn't miss out on, and any organization that doesn’t take advantage of those is going to find it hard to keep up with its competitors.
For me, the question isn’t so much what are the dangers, it’s how do we ensure that we leverage the benefits of AI and have the freedom to innovate whilst at the same time not leaving us – and our customers – entirely dependent on it?
I posed this question during a panel discussion at CeFPro’s recent Vendor Risk Europe conference event:
What happens if geopolitical tensions escalate and the transatlantic trust underpinning our digital infrastructure falters?
My answer is that the reality is stark. Most of our vendors and most of our financial sector will be vulnerable to big risks - risks that are not hypothetical, but structural and growing.
The dominance of a few large, non-European AI providers introduces concentration risk into the heart of our financial system.
And this is not simply a matter of switching cloud providers, because when institutions build customer-facing products or operational infrastructure atop black-box models from powerful overseas players, exit plans become impractical to the point of being illusory.
Building European AI alternatives is no longer a luxury – it’s a financial stability imperative.
With that in mind, we need to be clear-eyed about what we’re dealing with – not just in terms of the practical applications of AI technology – which have the potential to reinvent how we approach risk management – but also the compliance and governance considerations.
When we talk about AI governance, many firms default to lists of principles or tick-box compliance regimes.
But regulation, particularly the EU AI Act, should not become a tool to freeze definitions or hinder adaptive responses.
As I said in the discussion, we are in an AI transformation. That, on one level, is a good thing – it allows us to be more expansive in our thinking.
But there’s also a danger here that some organizations may be so wary of the complexities involved that they try to freeze any definition or prescribed model – which in essence means we’re freezing time. And that’s bad supervision.
