What happened
On November 4, 2026, the Dutch Authority for the Financial Markets (AFM) published a report detailing the current state of the financial services sector, specifically addressing the rapid integration of artificial intelligence and the resulting implications for cyber resilience. The regulator observed that financial service providers are increasingly adopting AI due to competitive pressures. The AFM clarified that firms must maintain rigorous control over these systems, emphasizing that the legal responsibility for service quality and compliance remains with the financial institution, even when systems are developed or managed by third-party vendors.
The AFM report identifies that financial service providers are under significant pressure to implement AI to remain competitive. However, the regulator warns that this adoption must be balanced with clear internal policies, reliable data sourcing, and transparency toward clients.
A central pillar of the AFM's update is the insistence on accountability. The regulator explicitly stated that financial firms are responsible for the diligent provision of services, regardless of whether the AI systems are built in-house or provided by external software vendors.
The report also addresses the rising threat of AI-enabled cybercrime. The AFM noted that many financial service providers currently have limited internal staffing dedicated to IT security, often relying heavily on outsourced services. The regulator is now requiring firms to identify and mitigate cyber risks associated with these outsourcing arrangements.
To address these risks, the AFM recommends that firms establish formal contractual agreements with IT providers. These contracts should mandate the conduct of risk assessments, the implementation of specific control measures, and clear protocols for incident management.
Source details: regulationtomorrow.com
Why it matters
The AFM’s report highlights a critical tension in the modern financial sector: the drive to innovate through AI versus the mandatory requirement for operational stability and security. As financial firms increasingly outsource IT and AI infrastructure, the regulator is signaling that 'vendor reliance' is not a valid defense for systemic failures or security breaches. By mandating that firms document their monitoring of outsourced services and ensure third-party compliance with existing legal frameworks like the Act on the Financial Supervision, the AFM is forcing a shift toward more robust, transparent, and accountable . This guidance is essential for firms to avoid regulatory penalties and maintain client trust in an era where AI-powered cyber threats are on the rise.
The guidance serves as a formal warning that the 'black box' nature of some AI systems does not exempt financial institutions from their regulatory obligations. By linking AI adoption directly to cyber resilience, the AFM is framing AI as a potential vulnerability that requires active, ongoing management rather than a 'set-and-forget' technology.
The emphasis on third-party accountability is particularly significant for smaller financial firms that rely on off-the-shelf AI solutions. These firms must now ensure their vendors meet the same legal standards as the financial institutions themselves, which may increase the cost and complexity of AI procurement.
The report underscores the necessity of staff training, noting that firms must ensure their employees possess sufficient knowledge to manage and oversee AI systems effectively. This requirement aims to prevent the risks posed by systems that are not adequately managed or understood by the human operators responsible for them.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
Why can ethical evaluation not be reduced to one model score?
What to watch next
Financial institutions operating in the Netherlands should monitor for further enforcement actions or specific supervisory audits related to these guidelines. The AFM explicitly noted that larger firms may be subject to the Digital Operational Resilience Act (DORA), which imposes stricter requirements on IT risk management. Firms should watch for how the AFM interprets 'undue dependencies' on third-party software vendors, as this will likely dictate future procurement and risk assessment strategies for AI tools. Additionally, the industry should track whether other European regulators adopt similar, more stringent stances on the accountability of AI-driven financial services.
The AFM has directed firms to the full report, which provides further context on the sector's current state. Firms should review their existing IT risk management frameworks against these new expectations.
The potential application of the Digital Operational Resilience Act (DORA) for larger firms remains a key area of focus. Compliance with DORA will likely become the for how the AFM evaluates the cyber resilience of major financial institutions.
The regulator's focus on 'undue dependencies' suggests that firms may need to diversify their technology providers or develop contingency plans for when third-party AI systems fail or are compromised.