FSB chair flags frontier AI as a cyber-risk channel

Andrew Bailey, writing as chair of the Financial Stability Board, told G20 finance ministers and central bank governors that frontier AI's most immediate concern for the financial system is its impact on cyber risk. The letter dated 28 August went out ahead of their meetings on 31 August and 1 September. Bailey holds both the Bank of England governorship and the FSB chair, and this document is the FSB one: a chair's letter and a set of asks, not a Bank of England rate decision, a PRA rule, or a new FSB standard.

The letter runs on two tracks. The first is market vulnerability: Bailey warns the system is still absorbing the Middle East supply shock and could be exposed to a disorderly correction, citing sovereign-debt fragilities, private-credit opacity, stretched valuations "particularly artificial intelligence-related investments," and rising equity-market leverage interacting with "the increasing cross-investment between artificial intelligence (AI) companies and hyper scalers."

The second track is frontier AI itself. "For the financial system, the most immediate concern is the potential impact of frontier AI on cyber risk," Bailey wrote. He added that frontier AI "may have the ability materially to alter the speed, scale and economics of cyber risk," made worse by highly concentrated third-party providers. That is a cyber-resilience warning, not a call that an AI bubble breaks this week. Outlets that led with a coming downturn stretched the letter past what Bailey actually pinned down.

The letter also hands supervisors and firms concrete work. Bailey expects a higher volume of vulnerabilities and a faster patching pace, and notes that pace can itself stress change, testing and recovery processes. He calls for the ability to restore critical systems and data "from bare metal" after a significant cyber incident, and for resilience among the critical third-party technology providers the system leans on.

He flags that the FSB is exploring the safe deployment of frontier models for cyber defense by financial firms, so the letter is not only about the threat side. He warns that many jurisdictions "do not have the protocols in place" to manage the development, release and deployment of advanced frontier models, adding that "safe and responsible model release and deployment on a global basis should in my view be a priority." Supervisors are already framing adjacent AI and cyber questions, including in the OpenAI collective cyber-defense letter.

Some offers on this page may be paid placements or contain affiliate links.