AI governance for CySEC-regulated firms

Why this matters for Cyprus

Cyprus is home to a large sector of investment firms, crypto-asset service providers and fund managers supervised by the Cyprus Securities and Exchange Commission. The uses of AI ESMA lists for these firms, from client support and fraud detection to risk management and compliance, are as relevant to Cypriot firms as anywhere in the EU. The draft National AI Strategy 2032 names financial services as a priority sector and singles out AI for fraud detection and anti-money laundering in the CySEC-regulated ecosystem.

There is no single Cypriot AI rule for these firms. Instead, four sets of obligations that already apply each reach the AI a firm runs. Governing AI well means meeting them together rather than one at a time.

DORA and CySEC Circular C786

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. It requires an ICT risk management framework, incident handling and reporting, resilience testing and management of ICT third-party risk. AI systems are ICT systems, and AI model providers are ICT third-party providers.

CySEC made the link explicit in Circular C786 on 17 June 2026. Addressed to Cyprus investment firms, central securities depositories, trading venues, CASPs, AIFMs and UCITS management companies, it warns that frontier AI models can find and exploit vulnerabilities at unprecedented speed and scale. CySEC expects each entity to assess whether its ICT risk arrangements remain adequate and to strengthen them where needed. Under governance, it asks that AI-related cyber risks be reflected in ICT risk assessments, governance arrangements and operational resilience planning.

In practice, that asks three things of a firm’s AI governance.

• Know what you run. You cannot assess AI-related risk without an inventory of AI systems and agents, the models behind them, the providers and the business functions that depend on them.
• Treat model providers as ICT third parties. Concentration on a single model provider, and what happens if it fails or changes terms, belong in the third-party risk assessment and exit planning DORA already requires.
• Test the AI you expose. Client-facing chatbots and agents with access to tools and data are part of the attack surface. Adversarial testing shows where they can be manipulated.

MiFID II, as ESMA reads it for AI

ESMA’s Public Statement on the use of AI in the provision of retail investment services, published on 30 May 2024, says firms using AI must still meet MiFID II requirements on organisational arrangements, conduct of business and acting in clients’ best interests. It covers AI used for customer support, fraud detection, risk management, compliance and support for investment advice and portfolio management.

Three expectations stand out. Decisions remain the responsibility of the management body whether people or AI tools take them. Firms should be transparent with clients about how AI is used in investment services, including when clients are dealing with a chatbot. And the statement reaches staff use of third-party tools such as general-purpose chatbots, whether or not senior management approved them. That last point makes shadow AI a conduct issue as well as a security one.

The EU AI Act

The EU AI Act applies directly in Cyprus, supervised by the Commissioner of Communications and, for some uses, the Commissioner for Personal Data Protection. The Cyprus AI Act governance page sets out who does what.

For a typical CySEC-regulated firm acting as a deployer, three parts matter now or soon.

• AI literacy (Article 4). Since 2 February 2025, providers and deployers take measures to support the AI literacy of staff who operate AI on their behalf.
• Transparency (Article 50). Since 2 August 2026, chatbots must tell people they are interacting with AI unless it is obvious, and deployers of deepfakes must disclose them.
• High-risk uses. Most investment-service AI is not on the Annex III list. Uses that are include AI for recruitment, promotion and staff evaluation, and AI for creditworthiness assessment of individuals. These obligations apply from 2 December 2027, and a deployer must then follow instructions for use, assign human oversight, monitor the system and keep logs.

The GDPR

AI that profiles clients or staff engages the GDPR, supervised in Cyprus by the Commissioner for Personal Data Protection. Where a decision with legal or similarly significant effects is taken solely by automated means, such as an automated onboarding rejection, Article 22 applies, with its right to human intervention and to contest the decision.

Putting it together

The four layers ask for overlapping evidence, so one programme can serve all of them.

1. Build a single AI system register covering in-house systems, vendor AI and staff tools, with each system’s provider, the functions that depend on it and its AI Act classification.
2. Assess each system for ICT, conduct and data protection risk together, and record who in the business owns it.
3. Fold model providers into DORA third-party risk management, with substitution and exit plans for critical functions.
4. Test client-facing AI adversarially, and set guardrails on what it can say and do.
5. Monitor systems in production and report AI risk to the management body, which stays accountable under both DORA and MiFID II.

Aicura supports each step, from the register and assessments to guardrails, security testing and monitoring. The judgements and the accountability stay with the firm.