When Claudia Buch, who chairs the European Central Bank’s supervisory board, sat before the European Parliament’s economic affairs committee this week, the theme was deceptively technical: bank resilience in an era of geopolitical and AI-related risks. Behind the dry phrasing lies a question that supervisors have not had to confront so directly since the last financial crisis. Can a banking system built to withstand credit losses and liquidity runs also absorb shocks that originate outside finance altogether, in wars, sanctions, and the machinery of artificial intelligence?
The ECB’s answer, set out in its supervisory priorities for 2026 to 2028, is to stop treating geopolitics as background noise. The centrepiece is a thematic stress test that inverts the usual exercise. Rather than handing banks a common adverse scenario, supervisors will ask each institution to design its own. In this reverse stress test every bank must identify the specific geopolitical rupture that could threaten its solvency, whether that is a client base concentrated in a sanctioned jurisdiction, collateral exposed to a commodity shock, or funding that evaporates when cross-border tensions rise. The design is revealing. Supervisors are conceding that they cannot anticipate every fault line, so they are forcing banks to map their own.
The harder frontier is artificial intelligence. European lenders are racing to fold generative models into fraud detection, credit scoring, and customer service, and the productivity case is real. But the supply chain behind those models is startlingly narrow. The most capable systems are trained and hosted by a small cluster of non-EU providers, and the cloud infrastructure they run on is scarcely less concentrated. A bank that outsources judgement to such a stack inherits two exposures at once. The first is operational: an outage or a corrupted update at a single vendor could ripple through dozens of institutions simultaneously. The second is geopolitical: the same dependency becomes a pressure point if relations with the provider’s home government sour. The ECB has begun mapping these third-party links, with particular attention to concentration among critical service providers, precisely because a vulnerability shared across the system is no longer a private risk.
What makes this supervisory turn intellectually significant is that it blurs the line between prudential and operational oversight. Capital buffers, the traditional shock absorber, offer little defence against a model that hallucinates a credit decision or a cloud region that goes dark. Resilience here is measured in redundancy, exit plans, and the ability to fall back on human judgement, not in ratios. That shift asks supervisors to develop competencies closer to those of a technology regulator, and it asks banks to treat their vendor contracts as matters of financial stability rather than procurement.
There is a tension the committee is likely to keep probing. Europe wants its banks to innovate and to narrow the efficiency gap with larger American and Asian rivals, yet the tools that promise those gains deepen reliance on infrastructure Europe does not control. Buch’s supervisors cannot resolve that contradiction on their own; it feeds into the wider debate over European digital sovereignty and the slow effort to build home-grown cloud and computing capacity. For now the supervisory response is disciplined rather than restrictive. Banks are not being told to abandon AI or to retreat from exposed markets. They are being told to know, in granular detail, where their own breaking points lie, and to prove they have a plan for the day one of them is tested.
The value of the exercise will not be visible in a headline number, because reverse stress tests do not produce one. It will show in whether boards start asking sharper questions about the concentration hidden inside their technology and their trading books. In a decade defined less by interest-rate cycles than by the fragility of global connections, that quieter form of vigilance may prove the more durable safeguard.
