The ECB has asked lenders to deliver a plan by 31 October 2026, turning AI-driven cyber risk into a supervisory deadline rather than a distant warning.