Europe’s banks are on the front line of the digital transition. AI, cloud and other emerging technologies offer powerful tools to combat fraud, tackle money laundering and strengthen cybersecurity. Yet adoption remains slower than Europe’s ambitions.
Only 10% of banks were exploring the use of general-purpose AI in areas like anti-money laundering at the end of 2024.
Learn more about DIGITALEUROPE’s Finance Executive Council
For a sector where technology can deliver immediate efficiency gains, resilience and security, that figure should be a wake-up call. The challenge is not access to innovation but creating the conditions for innovation to scale. Unlocking this potential requires a simpler EU rulebook and stronger focus on the competitiveness of Europe’s financial services sector.
Three priorities stand out: investment in cloud and AI, cyber resilience and regulatory simplification.
Accelerating investment in cloud and AI infrastructure
Cloud computing has become the backbone of modern financial services. Today, banks rely on cloud infrastructure to scale operations, adapt to changing customer needs, and use advanced tools like AI. Access to world-class cloud services is increasingly critical to remaining competitive and resilient in an interconnected global economy.
The Cloud and AI Development Act (CADA) offers a chance to expand Europe’s cloud ecosystem. With banks running various workloads with different technical and risk requirements, the objective should be to support a wider range of models and providers, allowing financial institutions to choose from a spectrum of options.
The challenge is not access to innovation but creating the conditions for innovation to scale
This means combining access to high-quality services with stronger development of European capabilities in both advanced cloud services and AI models, including through joint procurement, tax incentives and simpler rules across the EU.
Strengthening cyber resilience through coordination, not complexity
Cyber threats are becoming more frequent, more sophisticated and increasingly powered by frontier AI. Competitiveness and resilience are two sides of the same coin. Without trust and security, digital transformation will stall.
The Digital Operational Resilience Act (DORA) marked important progress. However, banks still face multiple ICT incident reporting requirements across Member States with different thresholds, timelines and formats. This duplication adds costs without necessarily improving security.
Streamlining reporting and ensuring consistent implementation is essential. Furthermore, a single EU reporting channel for cyber incidents would reduce unnecessary bureaucracy and free up resources to tackle real threats.
Fragmented and overly complex rules slow down real transformation. A simpler and more coherent rulebook would give banks the clarity
As cyberattacks evolve, resilience can no longer be built organisation by organisation or country by country. The rapid development of AI is reshaping the threat landscape, while attacks increasingly target essential services and critical infrastructure.
Europe needs a more coordinated approach that brings together governments, industry and network operators to anticipate risks, share expertise and respond more effectively when attacks occur. In cybersecurity, as in competitiveness, Europe will be stronger if it acts together.
Simplifying the interaction between AI, data and financial legislation
AI is fostering the sector’s digital transformation, with applications ranging from credit scoring to fraud detection. However, AI will only scale in finance if rules are clear, aligned and proportionate, and implemented consistently across the Union.
The AI Act introduces necessary safeguards, but its effectiveness will depend on how it interacts with existing financial and data protection frameworks. Requirements for high-risk AI systems should apply only once technical standards are in place.
Europe’s challenge is no longer inventing the future. It is deploying it
Otherwise, institutions are left navigating obligations without operational guidance. Transparent and explainable models used by banks for credit scoring, such as linear and logistic regression, should not be classified as high-risk, as doing so would increase the industry’s administrative burden without providing additional consumer protection.
AI-related incident reporting should be integrated into existing frameworks to avoid parallel regimes, while data processing rules should be aligned with GDPR to provide greater legal certainty. Simplification should also address the patchwork of national rules and inconsistent enforcement across Member States, which increase complexity and compliance costs.
This is particularly challenging for banks, which are expected to minimise personal data collection under GDPR while processing extensive data to meet obligations such as anti-money laundering, instant payments and payment services rules.
Clear and aligned expectations from supervisors are essential to ensure consistent implementation across the single market.
Learn more about DIGITALEUROPE’s Finance Executive Council
Fragmented and overly complex rules slow down real transformation. A simpler and more coherent rulebook would give banks the clarity and consistency they need to scale and turn technology into tangible results.
This would not weaken Europe’s ambitions. It would strengthen them.
Europe’s challenge is no longer inventing the future. It is deploying it. In an increasingly digital economy, competitiveness will belong to those who can scale innovation fastest, turn technology into productivity and transform ambition into growth.
This article is a joint contribution from Cecilia Bonefeld-Dahl (left), Director General at DIGITALEUROPE, and Daniele Tonella (right), Chief Technology Officer at ING and Chair of DIGITALEUROPE’s Finance Executive Council
Sign up to The Parliament’s weekly newsletter
Every Friday our editorial team goes behind the headlines to offer insight and analysis on the key stories driving the EU agenda. Subscribe for free here.