Bank of England warns frontier AI threatens global financial stability

Bailey, who chairs the Financial Stability Board, said frontier AI “may have the ability materially to alter the speed, scale and economics of cyber risk, which could undermine market confidence system-wide, especially due to highly concentrated third-party service providers.” He also noted that many jurisdictions lack protocols to manage the development, release and deployment of advanced frontier AI models, heightening risks for the financial sector and beyond. Financial institutions and technology providers would need to improve vulnerability management, response and recovery, he said, and prepare for severe scenarios involving simultaneous disruption across multiple firms or shared technology dependencies.

The letter added to a series of warnings after high-profile incidents in which flagship AI models from Anthropic and OpenAI breached testing safeguards. Bailey also cited fragilities in sovereign debt markets, growing use of debt by investors in equity markets and stretched asset valuations, particularly AI-related investments, among his concerns. The United States is hosting the G20 summit in North Carolina this week.

The warnings coincided with fresh concerns over “shadow AI” in business. According to TechRadar, research by BlackFog found that nearly half of employees at larger enterprises regularly feed corporate data into AI tools that no IT department has approved or governs. More strikingly, 85% of employees continue doing so even when company-sanctioned tools are available, pointing to a governance failure. The EU AI Act, which took effect in phases, has turned this into a legal issue: as of 2 August 2026, organizations classified as general deployers of AI face new inventory, data governance, audit logging and transparency obligations. High-risk uses, such as recruitment, credit scoring and biometric categorization, come under controls from 2 December 2027, and AI embedded in regulated products is covered from 2 August 2028. The AI literacy obligation under Article 4 has been enforceable since February 2025. Penalties for high-risk breaches can reach up to €15 million or 3% of global annual turnover.

BlackFog CEO and founder, writing on TechRadar, said existing security stacks cannot detect shadow AI because CASBs and secure web gateways cannot decrypt conversational data flowing to legitimate LLM domains over HTTPS; browser extensions are limited to managed endpoints; and API gateways miss consumer-grade tools. Endpoint-native detection, he argued, can intercept sensitive data at the point of movement.

Separately, European policymakers are weighing changes that could help the continent’s defence industry. A campaign known as EU Inc., or the “28th regime,” proposes a new EU-wide company entity to cut red tape. According to a Sifted opinion piece, this could reduce friction for defence tech companies, especially drone makers, by allowing a single entity to operate across the EU rather than navigating 27 legal systems and more than 60 national company forms. In defence, intellectual property is crucial, but publishing patents is often not wise because most drone technology is based on civilian components, and innovation cycles shift every two to three months. A single EU-level legal form would also help overcome local registration requirements in government tenders, which can take months to fulfil.

The same Sifted piece noted that Ukraine’s defence tech industry, with more than 800 manufacturers in a $6.8bn domestic market, could benefit from EU Inc. as European countries seek to access Ukrainian technology but have struggled due to distrust of Ukrainian jurisdiction.

Separately, Sifted reported that defence startups are looking to the Danish model to support Ukraine’s war effort, describing it as a “win-win.” Ukrainian entrepreneur V’yacheslav Shvaydak met Sifted at the startup hub Matrikel1 in Copenhagen, and some believe Denmark could become an important base for Europe’s defence against Russian hostilities.