What changed
Financial Stability Board Chair Andrew Bailey told G20 finance ministers and central-bank governors that frontier AI could materially change the speed, scale and economics of cyber attacks. The letter links this risk to concentrated technology providers and calls for safer model release, stronger vulnerability management, response and recovery, and resilience among critical third parties.
Why it matters
A global financial regulator is moving the discussion from isolated model incidents to correlated operational risk. Shared models, clouds and service providers can turn one capability or control failure into a system-wide confidence problem.
What to do
Map every critical AI and cloud dependency, assign recovery objectives and alternate providers, rehearse credential compromise and provider outage, measure patch and restoration time, and require evidence that backups and manual fallbacks work without the affected AI service.
Caveat
The letter is a supervisory warning, not a binding rule or completed resilience standard. It does not quantify incident probability, prescribe one control baseline, or prove that current provider concentration will cause a systemic event.