Two of the world's most closely watched financial regulators have delivered the same message within days of each other: artificial intelligence is no longer a future risk to the financial system. It's a current one, and it's accelerating.
The Federal Reserve's Spring 2026 Financial Stability Report found that 50% of the market participants it surveyed cited AI as a salient risk to US financial stability, up sharply from 30% just six months earlier in the fall 2025 survey. Then, earlier today, Bank of England governor Andrew Bailey went further in his own letter to G20 finance ministers, written in his capacity as chair of the international Financial Stability Board (FSB), naming frontier AI's impact on cyber risk as the single most immediate threat to the global financial system.
Two regulators on two continents, arriving at the same conclusion in the same fortnight. For carriers and brokers writing cyber in the US, that timing is hard to treat as a coincidence.
The Fed's survey, run by New York Fed staff among roughly 20 market contacts including bank, broker-dealer and investment fund professionals, wasn't just about AI valuations. Respondents connected AI risk to elevated equity prices, debt-financed capital spending on data centers, and, increasingly, cyber.
It wasn't the top-ranked risk (geopolitical tension and an oil shock ranked higher), but the jump from 30% to 50% in a single survey cycle is one of the sharpest moves in the report's risk rankings.
Bailey's FSB letter, published today, spells out the mechanism the Fed survey only gestures at. Frontier AI models are gaining autonomy and problem-solving ability fast enough to change "the speed, scale and economics" of a cyber attack, he wrote, undermining confidence in a financial system that leans heavily on a small number of dominant cloud and technology providers. That's a concentration-risk argument US cyber underwriters already know well from ransomware and cloud-outage aggregation exposure: a handful of shared providers sitting underneath a huge share of the market.
The timing lines up with a real incident. In July, OpenAI disclosed that two of its own models broke out of a sealed testing environment during an internal evaluation, gained unauthorized access to the internet, and exploited a security flaw to reach systems belonging to Hugging Face, all in an effort to find the answers to a cybersecurity benchmark they were being scored on. No person directed the breach. OpenAI called it an unprecedented cyber incident.
Adrien Robinson, head of global specialty at The Hartford, has told Insurance Business that cyber rates look "a little disconnected" from the underlying trajectory of risk, comparing the gap to how slowly natural-catastrophe pricing caught up with climate science. Ed Chadwick, AVP and professional lines lead broker at Jencap, has separately warned that AI is shifting claims "from traditional IT failures to more algorithmic risks in general." That shift is pushing exposure into territory that legacy cyber wording was never built to cover, particularly around contingent business interruption when the failure originates at a third-party AI provider rather than the policyholder's own systems.
Both regulators are pointing at the same underlying problem: institutions and insurers have adopted AI faster than they've built the governance, third-party oversight and incident-response capacity to match it. For US carriers, the practical questions are becoming concrete: how affirmative AI coverage is worded, whether contingent business interruption extends to a shared AI provider's failure, and how portfolios are stress-tested against a scenario where one compromised vendor produces correlated losses across hundreds of insureds at once.
