Question to the HM Treasury:

To ask His Majesty's Government what steps they are taking to ensure that UK financial services firms have sufficient cyber security and engineering capacity to address vulnerabilities identified by increasingly capable artificial intelligence systems.

The Government recognises that increasingly capable artificial intelligence systems present both opportunities and risks for the financial sector.

As noted in July’s Financial Stability Report, frontier AI may materially increase the flow of vulnerabilities requiring assessment and remediation by firms, which could itself become a source of systemic risk, even if cyber-attacks were not to increase. A materially higher volume of identified vulnerabilities would require firms and suppliers to patch and validate changes at much greater speed and frequency, increasing the risk of errors, outages, and disruption across interconnected systems.

In May 2026 the National Cyber Security Centre issued guidance to firms encouraging them to prepare for a wave of software updates that will need to be applied across the technology stack to address the disclosure of new vulnerabilities.

The UK financial authorities have made clear that firms should maintain effective protective, detective, threat containment and cyber response capabilities, and should be able to identify, assess and remediate vulnerabilities more quickly and at greater scale as AI capabilities develop. Firms are responsible for ensuring they have the skills, expertise and resources necessary to manage risks appropriately, including cyber security and engineering capacity.

The Government supports this through technical advice and guidance from the NCSC and ongoing engagement with industry and regulators, including through the Cross Market Operational Resilience Group (CMORG).