The autumn 2026 risk update broadens board attention from direct exposures to technology providers, interconnected finance and emerging operational threats.
A joint warning across European finance
The European Banking Authority, EIOPA and ESMA have called on financial institutions and supervisors to remain vigilant about external dependencies, cyber threats and private credit. Their autumn 2026 update published in September 2026 points to geopolitical uncertainty, rapid technological change and cross-border financial links as sources of vulnerability. The recommendations apply across banking, insurance, pensions and securities, encouraging boards to examine connections that conventional risk reporting may not capture.
Non-European dependencies require active management
The authorities highlight reliance on service providers outside the EU and EEA, including critical technology and cloud infrastructure. Concentration can create a common point of failure across many institutions even when each contract appears manageable in isolation. DORA has increased attention to operational resilience, but the supervisory message goes further: firms should know where services, data, subcontractors and recovery capabilities actually sit, and should prepare credible alternatives rather than treating exit plans as contractual formalities.
Private credit creates indirect as well as direct exposures
The update also asks institutions to monitor exposures to non-EEA entities, particularly those linked to private credit. For insurers, the issue is not confined to assets labelled private debt. Connections can arise through funds, collateral, banks, reinsurers, counterparties and policyholders whose financing depends on less transparent markets. Valuation frequency, leverage, liquidity and data gaps can obscure deterioration until refinancing or a stressed sale is required.
Cyber risk is amplified by AI and concentration
Supervisors are concerned about cyberattacks enhanced by artificial intelligence and about the future implications of quantum computing. AI may increase the speed, personalisation and scale of attacks, while common service providers can turn a single incident into market-wide disruption. Institutions therefore need scenario tests that combine a technology outage, compromised credentials, data integrity problems and third-party failure rather than testing each risk separately.
What insurance boards should request
Boards should receive a map of critical services, non-EU providers, material subcontractors, recoverables, private-credit channels and concentration points. Reporting should show the maximum tolerable outage, tested recovery time, data portability and the practical steps needed to switch provider. For investments, the board should see look-through exposures, valuation lags, covenant quality, refinancing needs and liquidity under stress. For reinsurance, it should understand both counterparty strength and operational dependence.
A governance agenda for GBKxAI
The same logic applies to specialised AI services such as GBKxAI. Model providers, hosting, connectors and data sources form a supply chain. A defensible architecture needs named owners, least-privilege access, source provenance, fallback models, exportable data and an exit plan tested before a crisis. The supervisory update is therefore not merely a compliance signal. It is a practical reminder that resilience depends on understanding the full chain of dependencies behind a service, investment or risk transfer.
Turning the warning into a board work programme
A practical response can begin with three linked reviews.
The first is a dependency inventory covering critical processes, providers, locations, fourth parties, data flows and contractual exit rights.
The second is a financial look-through that identifies private-credit and non-EEA exposures across funds, collateral, reinsurers and major counterparties rather than relying on accounting labels.
The third is a combined resilience exercise in which a cyber incident affects a concentrated provider during a period of market stress. Management should demonstrate how it would restore service, obtain reliable valuations, meet collateral or liquidity needs and communicate with customers and supervisors. Remediation should have named owners and deadlines.
This editor notes that insurers and reinsurers already face requirements to assess critical provider dependencies, plan for incident remediation and manage asset liquidity under Solvency II, DORA, GDPR and other regulations. The joint risk update therefore offers a guide to where national regulators are likely to focus in the near future, rather than identifying new areas for insurers to address.
What to watch next
The supervisory agenda will evolve as firms disclose more about private assets, critical providers and AI-related incidents. Institutions should avoid waiting for a detailed rule on every dependency. The immediate task is to identify where information is insufficient, decide which concentrations are tolerable and demonstrate that recovery or substitution works in practice. Those capabilities will remain useful even if individual regulatory priorities change.
Share this:
- More [2]
