Frontier AI, Cybersecurity and Financial Stability Risks for Malta

The core message for Malta-licensed firms is that the same AI capabilities driving efficiency gains, fraud detection and defensive cyber tooling are also lowering the barrier to entry for sophisticated threat actors — enabling faster, more convincing social engineering, automated vulnerability discovery and scalable polymorphic malware. For compliance and risk teams, this reframes AI governance as an operational resilience issue, not merely a data protection or conduct question. Firms should expect supervisory attention on how AI adoption is mapped into ICT and cyber risk frameworks, third-party and model-supply-chain oversight, and board-level accountability for AI-driven threats.

Practical next steps include: refreshing cyber risk assessments to explicitly address adversarial AI use cases; extending due diligence and contractual controls over AI vendors and third-party models; testing incident response and detection scenarios involving AI-enabled attacks; and aligning AI governance with DORA, NIS2 and the EU AI Act timelines. Smaller firms with limited in-house capability should prioritise awareness training and reliance on shared sector guidance. The publication signals that AI-related cyber risk will feature in supervisory dialogue and thematic reviews, so early documentation of controls offers a defensive advantage.

Malta's cross-border licensing model means group-level AI and cyber policies will need local validation and evidence trails.