Alessia Gilardi
Regional Product Compliance Consultant
Alessia Gilardi is a GRC manager with extensive international experience in compliance, data protection, audit, and risk management. She specializes in turning complex legal requirements into practical solutions that support the business. She is certified by the International Compliance Association (ICA).
Key takeaways:
On 17 July 2026, the Bank of Italy published a communication on digital operational resilience and advanced AI models. The latest models can find software vulnerabilities and generate ways to exploit them in very little time, without specialist skills.
Less significant banks and banking groups, payment and e-money institutions, investment firms, crypto-asset service providers, fund managers, crowdfunding service providers and Article 106 financial intermediaries must each send a Report with a work plan by 31 December 2026.
The Report covers six areas: governance, cyber hygiene, ICT assets and exposure, vulnerabilities and patches, monitoring and defense, and testing. For each one, it describes current exposure, the adequacy of safeguards, the main gaps and the priorities.
The work plan sets out actions, timelines and investments, and how the board will check progress. Each entity also names a point of responsibility, such as its second-level ICT risk control function.
DORA remains the reference framework. The Bank of Italy asks intermediaries to apply it with new speed and depth, in line with similar requests from the ECB and IVASS.
This isn't just another compliance exercise. The communication confirms that artificial intelligence (AI) is more than a technology to adopt for more efficient processes and new services. It's a strategic risk factor that boards have to govern. The Bank of Italy isn't alone in saying so: the ECB asked the significant banks it supervises for action plans by 31 October, IVASS sent insurers a parallel communication on the same day, and the European Supervisory Authorities followed with a joint statement at the end of July. Governance is now what separates the organizations that will be overtaken by this change from those that will manage it.
When the attack arrives before the patch
The latest AI models can identify vulnerabilities in software and, at the same time, generate the means to exploit them. They do it very quickly and without specific technical skills. As a result, the time between discovering a flaw and exploiting it shrinks sharply. The Bank of Italy puts it plainly: these technologies could widen the asymmetry between attackers and defenders, to the defenders' disadvantage.
In this context, digital operational resilience stops being only a compliance topic. The communication calls it an essential condition for business continuity and for the ability to offer reliable financial services. It also states that the requirements of DORA keep their full validity. What changes is the speed and depth with which intermediaries are expected to apply them.
Who has to submit the Report?
The communication is addressed to the entities supervised directly by the Bank of Italy's Banking and Financial Supervision Department:
less significant banks and banking groups, including BancoPosta
payment institutions and electronic money institutions (IMELs)
investment firms (SIMs)
crypto-asset service providers
alternative investment fund managers and asset management companies (SGRs)
crowdfunding service providers
financial intermediaries under Article 106 of the Italian Banking Act (TUB)
At a seminar on 9 October 2026, which for the first time brought financial sector associations and ICT providers together, the Bank of Italy clarified several practical points:
Groups send a single Report on a consolidated basis, covering the Italian entities it supervises directly within the prudential consolidation perimeter. Foreign subsidiaries and insurance components are excluded, but the Report should highlight the specific features of the subsidiaries it includes. Groups name one point of responsibility.
Exemptions: trust companies and sub-threshold alternative investment fund managers don't have to submit a Report, but still apply the communication proportionately.
Submission: the Report goes to the certified email (PEC) address of the competent supervisory unit, with a copy to Supervisione_rischio_ICT@pec.bancaditalia.it.
Significant banks are supervised directly by the ECB, which asked them in a letter of 7 July 2026 for an action plan by 31 October 2026. Insurers received a parallel communication from IVASS on 17 July 2026, with the same 31 December deadline.
Governance comes before technology
A well-designed AI system doesn't start with the technology. It starts with governance that defines how the technology should be used. That idea runs through the whole communication, and governance is the first of the six areas it lists. The Bank of Italy asks boards and management bodies to:
Revise the risk appetite framework (RAF): include the risks of frontier technologies, consistent with strategic decisions such as ICT investments and resource allocation.
Assign clear responsibilities: strengthen governance and control systems, and allocate responsibilities precisely, including for data management and security.
Govern external ICT providers: set contractual requirements on the provider's security monitoring and patch management, and rigorous criteria for assessing and selecting providers in advance.
Build skills at board level: include members with adequate technology skills, including in AI, and budget for their continuous training.
One passage deserves particular attention. Where intermediaries use AI-based tools for defense, their use must be consistent with the organization's AI strategy, backed by an assessment of the risks specific to those tools, and accompanied by safeguards such as performance and degradation monitoring and human oversight. Adopting the right tool isn't enough. Boards need to know why it's used, how it works and who checks it. Without that design upfront, even the most advanced solution becomes a new weak point.
The six areas and the question to ask today
For each area, the Report has to describe exposure, the adequacy of existing safeguards, the gaps and the priorities. The question in the right column is a quick way to see where your organization stands.
Area | What the Bank of Italy asks for | The question to ask today |
|---|---|---|
Governance | A RAF updated for the risks of frontier technologies, clear responsibilities, safeguards on ICT providers, technology and AI skills on the board | Can our board assess the risks of AI? |
Cyber hygiene | Defense in depth, strict authentication and authorization, granular access management, constant monitoring of activity, network segmentation | Would a compromise stay contained? |
ICT assets and exposure | Complete, current and reliable inventories, classification by criticality that accounts for internet exposure and cloud use, replacement or updating of legacy technology | Do we know what is exposed to the internet or runs in the cloud? |
Vulnerabilities and patches | Faster detection through better scanning, with AI where appropriate, quicker remediation of the most critical issues, priority for open-source software and systems reachable from outside | How much time passes between discovery and fix? |
Monitoring and defense | Stronger monitoring of applications, access and network traffic, including traffic to and from ICT providers, kept in sync with the asset inventory and its criticality ratings | How quickly would we spot an anomaly on a critical system? |
Testing | Stronger resilience, response and recovery testing, including crisis management, with realistic and increasingly complex scenarios in line with DORA | Have we ever simulated an AI-assisted attack? |
One theme cuts across all six areas: the supply chain. Supply chains with several tiers that depend on a few providers can turn a local problem into a wide-reaching one. The Bank of Italy expects ICT providers to support intermediaries' efforts, because they carry the same responsibility for safeguarding systems and keeping them running. For providers, this comes on top of what DORA already asks of them through their clients' contracts, which our article on DORA for ICT providers covers in detail.
What the Report and work plan must contain
The Bank of Italy expects the board of directors to examine the communication in a joint session with the board of statutory auditors, and to start work on the Report in that same session. For each of the six areas separately, the Report must:
describe the current level of risk exposure
assess whether existing safeguards are adequate
identify the main gaps and the priorities for action
The attached work plan sets out the actions, timelines and investments needed, proportionate to the intermediary's risk profile, the complexity of its services and its operations. It also defines how the board will monitor progress. In addition, each entity names a specific point of corporate responsibility, such as the second-level ICT risk control function, and communicates it to the supervisor. The Report and work plan are due by 31 December 2026.
31 December 2026: time is already short
At the time of writing, about eight weeks remain, and the work isn't short. Teams that start now still have time for a serious analysis. Teams that wait risk sending a formal document without the substance the supervisor expects to find.
The real challenge isn't writing the Report. It's reaching it with an orderly picture: where you stand, what's missing and in which order to act. That takes a structured method that turns the supervisor's requests into concrete checks, area by area:
Launch the work formally: hold the joint session of the board and the board of statutory auditors, if it hasn't happened yet, and minute the start of the Report.
Name the point of responsibility: choose the function, communicate it to the supervisor and give it a mandate.
Take stock area by area: reuse your DORA work, such as the ICT risk management framework, asset inventories, test results, supplier assessments and the Register of Information.
Rate adequacy honestly: record where safeguards are missing, weak or unproven, and rank the gaps.
Turn gaps into a work plan: give every action an owner, a deadline and an estimated investment.
Agree how the board tracks progress: decide what it sees, how often and who reports to it.
How Formalize helps you prepare the Report
That's the approach we've taken at Formalize. We've built a dedicated checklist on the content of the communication and its requirements, designed to support boards, boards of statutory auditors and control functions as they prepare the Report. It starts with a snapshot of current safeguards and a critical look at the gaps and the areas that need stronger or more effective safeguards. The goal is a work plan you can defend in front of the supervisor.
The checklist is a starting point. Every intermediary has a different risk profile, operational complexity and level of maturity, so the Formalize platform offers more:
Assess each area in one place: link exposure, safeguards and gaps to the controls, ICT risks and suppliers you already manage for DORA.
Turn gaps into a work plan: every action gets an owner, a deadline and evidence, and the board follows progress from the same data.
Govern your ICT providers: assess suppliers by criticality in Third-Party Management and keep contracts and security requirements with each one.
Plan resilience tests: schedule tests, including TLPT where it applies, as recurring tasks with evidence.
Govern AI, including AI used for defense: register your AI systems and assess their risks with the AI Act and ISO 42001 Blueprints.
Formalize doesn't replace your vulnerability scanners or security monitoring tools, and the assessment stays with your teams and your board. What it gives the Report is a structure, and a record of the evidence behind each answer.
This article is for information only and doesn't constitute legal advice.
Preparing your Report for the Bank of Italy?
We'll walk you through the checklist and show you how to turn the gaps you find into a work plan your board can follow.
