ESRB Warns AI Model Concentration Could Amplify Systemic Bank Shocks

What happened

Why it matters

• ·Banks that have catalogued AI systems by business function rather than by underlying model or vendor may be underreporting their true concentration exposure to regulators. The Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) expects model inventories to capture dependency chains, not just use cases.
• ·The EU Digital Operational Resilience Act already requires financial entities to identify and manage concentration risk from critical information and communications technology providers. AI vendors running models used across multiple business lines now fall squarely in scope of those requirements.
• ·The ESRB warning is a regulatory signal, not a binding rule, but it raises the evidentiary bar for what supervisors will expect banks to demonstrate in examinations. Boards that have not documented their AI concentration risk appetite may face hard questions about whether existing stress-testing scenarios cover an AI-driven correlated failure.

Governance controls affected

What to do now

• ☐Ask your model risk or technology risk team to re-run your AI model inventory grouped by underlying provider and model, not by business use case, to identify how many systems depend on the same vendor or model family.
• ☐Check whether your DORA third-party concentration risk assessment explicitly covers AI model providers as critical technology vendors, and update it if they are not yet included.
• ☐Confirm that your October 31, 2026 ECB AI cyber action plan submission addresses the scenario where your primary AI model provider experiences an outage or delivers a materially wrong output across multiple business lines simultaneously.
• ☐Ask your stress-testing team to design at least one scenario where a shared AI model produces correlated errors across credit, trading, or risk functions, and document how the firm would detect and respond.
• ☐Bring the ESRB advisory to your board risk committee and record whether the board considers AI vendor concentration a material risk within the firm's documented risk appetite.

What to watch next

European banking supervisors are likely to reference the ESRB advisory in upcoming examination cycles. This is especially true as the October 31, 2026 ECB AI cyber action plan deadline passes and supervisors review submissions for adequacy. Compliance teams should monitor whether the European Banking Authority issues follow-on guidance. Such guidance would translate the ESRB's systemic-risk framing into specific operational resilience or model risk expectations under EU Digital Operational Resilience Act. Whether AI provider concentration requires the same supervisory treatment as cloud provider concentration is an open question. It is likely to surface in the Basel Committee and Financial Stability Board work programs in 2027.