From Permitted to Expected. When Frontier Technology Becomes the Standard of Care
By Marcin Waszak PhD, Head of the Crypto Practice, Jacek Szczytko, Associate, and Jakub Mazur, Associate, Dudkowiak & Putyra
Two recent events capture where European finance stands. In July, the Chair of the European Central Bank (ECB) Supervisory Board, Claudia Buch, wrote to the chief executives of the banks under the ECB’s direct supervision, asking for action plans, due by 31 October 2026, to address the cyber risks that artificial intelligence amplifies. On 21 September, the Eurosystem launched Pontes, which allows wholesale transactions in tokenised assets to be settled in central bank money.
In EU financial law, frontier technology rarely becomes obligatory by statute. It becomes expected, through standards of care that move with the market.
Neither event made a new technology mandatory. Both illustrate a quieter shift. In EU financial law, frontier technology rarely becomes obligatory by statute. It becomes expected, through standards of care that move with the market. For AI, that shift is under way, for blockchain, the legal infrastructure is ready before the market is.
AI: the market moved first
According to the European Banking Authority, 92% of EU banks are deploying AI, and 55% of surveyed banks use general-purpose or agentic AI in consumer-facing processes. Days earlier, Claudia Buch had told the European Parliament that more than 85% of banks under European banking supervision use AI tools and that management bodies must take clear ownership of the cyber risks posed by new AI models.
Legislation has slowed down. The AI Omnibus postponed the AI Act’s obligations for stand-alone high-risk systems, including credit scoring, to 2 December 2027. For AI-related cyber risk, however, the expectation rests on statute, since the Digital Operational Resilience Act (DORA) places ultimate responsibility for ICT risk on the management body.
Blockchain: the law moved first
For distributed ledgers, the sequence is reversed. Under the amended eIDAS Regulation, an electronic ledger cannot be denied legal effect or admissibility as evidence solely because it is electronic, and records in a qualified ledger are presumed to be in unique and accurate chronological order and to have retained their integrity. The DLT Pilot Regime has applied since 2023.
Market uptake has been slower, the DLT Pilot Regime counts six authorised infrastructures across the EU, and tokenisation is far from a market standard. For blockchain, the open question is not legality but adoption. Crypto-asset service providers, as financial entities under DORA, already operate under the same resilience framework as banks, applied proportionately.
As monitoring at scale increasingly relies on AI-based tools, a technology choice becomes a liability question.
Nor does EU law stand still once written. The Markets in Crypto-Assets Regulation (MiCA) was built to be revisited, in May 2026, less than eighteen months after it began to apply in full, the Commission opened its review, reaching into DeFi, staking and lending. Whatever direction that review takes, a legislator willing to revise its own rules this quickly is good news for the market.
How the standard of care moves without new law
The mechanism needs no new statute. DORA requires financial entities, bar the smallest, to monitor technological developments continuously, including their impact on ICT security, and to update their cryptography as cryptanalysis advances. The ECB’s July letter told banks that the adoption of post-quantum cryptography “must start now”. The AI Act ties high-risk systems to the generally acknowledged state of the art. The GDPR does the same for security measures, and the Court of Justice has placed on the controller the burden of proving that those measures were appropriate (Case C-340/21, Natsionalna agentsia za prihodite).
Liability rules reinforce the effect. Under the agreed text of the Payment Services Regulation, a payment service provider that does not carry out the required transaction monitoring bears liability for the payer’s loss, and the burden of proving compliance lies with the provider. As monitoring at scale increasingly relies on AI-based tools, a technology choice becomes a liability question.
The standard also moves the other way, marking where technology alone is not enough. From 20 November 2026, consumers whose creditworthiness is assessed by automated means can request human intervention under national rules implementing the revised Consumer Credit Directive and, since the Court’s Schufa judgment (C-634/21), a credit score can itself be an automated decision under the GDPR where the lender draws strongly on it.
What firms should do now
Financial institutions and crypto-asset service providers should:
document decisions not to adopt a technology as carefully as decisions to adopt it,
keep accountability with the management body and reflect it in vendor contracts: data access and termination rights throughout, audit rights and exit arrangements for critical or important functions,
build a cryptographic inventory and migration plan now, starting from the certificate register DORA requires and prioritising keys that protect client assets,
for automated credit decisions, have the explanation and human-review path in place before 20 November,
in tokenisation projects, separate what is legally settled from open questions such as the private-law status of tokens.
For blockchain, the open question is not legality but adoption.
Looking ahead
None of this makes a firm negligent today merely for not deploying AI or a distributed ledger; we are not aware of any European court holding so. But the direction of travel is visible. Over the next decade, the regulatory question for financial institutions will rarely be whether technology is allowed. More often, it will be whether they can justify not having it, and show that the technology they do have is used lawfully, explainably and securely.
Sources
Supervisory and market sources
European Central Bank, Banking Supervision, Letter SSM-2026-0301 to the CEOs of significant institutions, “Addressing AI-enabled cybersecurity threats”, 7 July 2026.
C. Buch, Introductory statement at the hearing of the ECON Committee of the European Parliament, Brussels, 2 July 2026.
European Central Bank, press release “Eurosystem brings central bank money to tokenised finance”, 21 September 2026.
European Banking Authority, Rising application of AI in EU banking and payments sector (factsheet, 25 September 2025).
ESMA, List of authorised DLT market infrastructures (January 2026).
European Commission, targeted consultation on the review of Regulation (EU) 2023/1114 (MiCA), 20 May – 30 September 2026.
Legislation
Regulation (EU) 2016/679 of 27 April 2016 (GDPR) (OJ L 119, 4.5.2016, p. 1), Article 32(1).
Regulation (EU) No 910/2014 of 23 July 2014 (eIDAS) (OJ L 257, 28.8.2014, p. 73), as amended by Regulation (EU) 2024/1183 of 11 April 2024 (OJ L, 2024/1183, 30.4.2024), Articles 45k and 45l.
Regulation (EU) 2022/858 of 30 May 2022 on a pilot regime for market infrastructures based on distributed ledger technology (OJ L 151, 2.6.2022, p. 1).
Regulation (EU) 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector (DORA) (OJ L 333, 27.12.2022, p. 1), Articles 2(1)(f), 4, 5(2), 13(7), 28 and 30.
Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 (OJ L, 2024/1774, 25.6.2024), Articles 6(4) and 7(4).
Regulation (EU) 2023/1114 of 31 May 2023 on markets in crypto-assets (MiCA) (OJ L 150, 9.6.2023, p. 40).
Directive (EU) 2023/2225 of 18 October 2023 on credit agreements for consumers (OJ L, 2023/2225, 30.10.2023), Article 18(8).
Regulation (EU) 2024/1689 of 13 June 2024 (AI Act) (OJ L, 2024/1689, 12.7.2024), as amended by Regulation (EU) 2026/1744 of 8 July 2026 (OJ L, 2026/1744, 24.7.2026), Article 8(1), Article 113(c) and Annex III, point 5(b).
Council of the EU, doc. ST 8221/26 of 17 April 2026, final compromise text of the Payment Services Regulation (confirmed by Coreper on 22 April 2026; not yet published in the Official Journal), Article 83(1a).
Case law
CJEU, judgment of 14 December 2023, VB v Natsionalna agentsia za prihodite, C-340/21, EU:C:2023:986.
CJEU, judgment of 7 December 2023, OQ v Land Hessen (SCHUFA Holding (Scoring)), C-634/21, EU:C:2023:957.
