CySEC Circular C786: frontier AI models and cybersecurity risks under DORA

What it is

Circular C786 is a CySEC circular dated 17 June 2026, titled Frontier Artificial Intelligence Models and Cybersecurity Risks under the Digital Operational Resilience Act (DORA). It draws regulated entities’ attention to the rising cybersecurity risk from frontier AI models capable of identifying and exploiting software vulnerabilities at unprecedented speed and scale.

CySEC’s point is that advanced AI cuts both ways. It can strengthen cyber defence, and it can also speed up the cycle of finding and exploiting vulnerabilities, raising the sophistication, frequency and scale of attacks on financial entities and their ICT third-party service providers.

Who it applies to

The circular is addressed to Cyprus investment firms, central securities depositories, trading venues, crypto-asset service providers, alternative investment fund managers and UCITS management companies. These are the CySEC-supervised entities that fall within DORA, Regulation (EU) 2022/2554.

It does not apply to banks or payment institutions, which the Central Bank of Cyprus and the ECB supervise, although they face the same DORA obligations.

What it requires

CySEC expects entities, proportionate to their size, nature, scale and complexity, to assess whether their ICT risk management arrangements remain adequate and to strengthen controls where needed. It lists five areas to consider.

• Identification and vulnerability management. Better identification and assessment of ICT vulnerabilities, including through threat intelligence and monitoring, and a review of how quickly vulnerabilities are remediated and patched, especially in critical and legacy systems.
• Protection and prevention. Security and resilience by design, a reassessment of identity and access management, and an evaluation of the preparedness of ICT third-party providers and supply-chain dependencies.
• Detection. Stronger monitoring and detection, and greater use of automation and security orchestration to improve response times.
• Response and recovery. Backup, restoration and disaster recovery that work under severe scenarios, with backups segregated and tested under realistic conditions.
• Governance and continuous improvement. AI-related cyber risks reflected in ICT risk assessments, governance arrangements and operational resilience planning, with processes for learning from incidents, testing and new threat intelligence.

The circular restates the core DORA duties. Entities must protect ICT systems against unauthorised access, detect anomalies and incidents, maintain business continuity and restoration, test their systems and assess vulnerabilities, and manage ICT third-party risk.

What it means for AI governance

Read alongside DORA’s third-party rules, the governance expectation has a practical consequence. A firm cannot reflect AI-related risk in its ICT risk assessment without knowing which AI systems and models it runs, which providers sit behind them and which critical functions depend on them. An AI system register that records providers, and vendor AI risk management that covers model providers, give that picture.

The circular also points to testing. Adversarial testing of the AI systems a firm exposes, such as client-facing chatbots and agents with tool access, is part of knowing where its vulnerabilities are. The AI red teaming guide covers how to run it.

How it relates to other frameworks

Circular C786 sits under DORA, which is the binding law. The EU AI Act adds separate duties for AI systems themselves, including accuracy, robustness and cybersecurity requirements for high-risk systems, supervised in Cyprus as described on the Cyprus AI Act governance page. Firms structuring their AI risk work often use the NIST AI RMF or ISO/IEC 42001 alongside their DORA framework.

A note on this page

This is Aicura’s summary of CySEC Circular C786. It is not the circular itself and it is not legal advice. Read the circular on CySEC’s website and take advice on how DORA applies to your entity.