CEE Perspective Weekly Digest - Issue 9

ESAs call for faster cyber resilience as frontier AI reshapes ICT risk

The European Supervisory Authorities (EBA, EIOPA and ESMA) issued a joint statement urging financial institutions to strengthen their cyber resilience in response to the growing risks posed by frontier artificial intelligence models. While recognising AI's significant benefits for cybersecurity, the ESAs warn that increasingly capable AI systems can also enable malicious actors to identify vulnerabilities, exploit shared infrastructure and launch attacks at unprecedented speed, potentially creating systemic risks for the financial sector. The statement builds on the European Commission's recent Action Plan on Cybersecurity and Artificial Intelligence and complements existing warnings from the European Systemic Risk Board (ESRB) and ENISA. 

Rather than proposing new regulatory requirements, the ESAs stress that the existing frameworks under DORA and the AI Act already provide a solid basis for managing these risks. Instead, supervisors encourage financial entities to act proactively by adapting their ICT risk management frameworks to reflect the faster pace of AI-enabled cyber threats. Any measures should remain proportionate, considering an institution's size, business model and overall risk profile. 

The statement identifies three priority areas for action. First, financial entities should strengthen prevention by maintaining comprehensive ICT asset inventories, embedding security-by-design principles, improving patch management and reducing vulnerabilities across supply chains. Second, they should enhance detection through continuous monitoring, more frequent vulnerability scanning and stronger behavioural analytics capable of identifying AI-assisted attacks. Finally, institutions should reinforce operational resilience by updating governance arrangements, incident response plans, business continuity frameworks and resilience testing to reflect AI-driven cyber scenarios, while ensuring management bodies remain actively engaged in overseeing these evolving risks. 

What it means for CEE markets

The statement is particularly relevant for financial institutions across Central and Eastern Europe as they continue implementing DORA and expanding their use of AI-enabled technologies. Although the ESAs do not introduce new compliance obligations, the document signals the direction of future supervisory expectations by encouraging firms to review whether existing ICT risk management, cyber resilience and governance arrangements remain adequate in an AI-driven threat environment. 

For many CEE financial institutions, particularly smaller banks, insurers and pension providers with limited cybersecurity resources, the emphasis on proportionate but more dynamic risk management is likely to accelerate investment in continuous monitoring, vulnerability management and operational resilience capabilities. The statement also highlights that supervisors are increasingly viewing frontier AI as a cross-sector operational resilience issue, suggesting that institutions should expect greater scrutiny of AI-related cyber risks as DORA implementation matures and supervisory practices become more consistent across the EU. 

EBA ESG dashboard shows stable climate risk exposures and improving data quality

The European Banking Authority (EBA) published its latest ESG Risk Dashboard, providing an overview of climate-related risks in the EU/EEA banking sector based on banks' disclosures for the second half of 2025. Overall, the findings point to a relatively stable climate-risk profile. Banks' exposures to sectors highly contributing to climate change remained broadly unchanged at 62% of total corporate exposures, while physical climate-risk indicators also showed little change compared with the first half of the year. 

At the same time, the dashboard highlights an important structural improvement: the quality of climate-related data continues to increase. Banks reported a further decline in mortgage exposures without energy performance information, together with a reduction in estimated energy performance scores. Although these changes may appear incremental, they improve the reliability of climate-risk assessments and strengthen banks' ability to integrate environmental risks into lending, portfolio management and supervisory reporting. 

What it means for CEE markets

One of the most relevant findings for Central and Eastern Europe is the relatively wide dispersion of physical climate-risk exposures across banks. While the regional median remains broadly comparable to other parts of Europe, CEE displays substantially greater variation between institutions than Western and Northern Europe. 

Figure 1. Share of exposures sensitive to physical climate risk – Total (dispersion across banks, by region). Source: European Banking Authority (EBA), ESG Risk Dashboard, published 6 August 2026 (based on December 2025 ESG disclosure data). 

This illustrates that climate-related risks cannot be viewed as a single regional phenomenon; banks' exposure profiles continue to depend heavily on geography, economic structure, sectoral lending patterns and portfolio composition. 

For investors and supervisors, this underlines the importance of institution-specific rather than country-level analysis. Banks operating in markets with higher exposure to floods, droughts or other physical climate hazards will face different risk-management challenges from peers whose portfolios are concentrated in less climate-sensitive sectors or regions.

Figure 2. Share of mortgage exposures across energy-efficiency categories by country. Source: European Banking Authority (EBA), ESG Risk Dashboard, published 6 August 2026 (based on December 2025 ESG disclosure data). 

The dashboard also demonstrates that climate-risk management is becoming increasingly data-driven. Across the EU/EEA, banks continue to improve the availability of energy-performance information for residential mortgage portfolios, reducing reliance on estimated energy ratings. Better-quality data allow banks to assess transition risks more accurately, improve internal risk models and respond more effectively to evolving supervisory expectations. 

For Central and Eastern Europe, this development may prove just as significant as changes in underlying climate-risk exposures. As ESG disclosures mature, banks with stronger data governance, more complete energy-performance information and better climate-risk capabilities are likely to be better positioned to meet supervisory expectations, attract sustainable investment and strengthen their long-term competitiveness. 

Looking ahead, the dashboard suggests that climate risk is becoming an increasingly integrated component of prudential supervision rather than a standalone sustainability exercise. For CEE banks, competitive advantage will depend not only on reducing climate-related exposures over time, but also on demonstrating robust governance, reliable data and effective climate-risk management as supervisory scrutiny continues to increase. 

Digital Omnibus: Parliament begins shaping the next phase of EU digital simplification

The European Parliament has started substantive discussions on the Digital Omnibus proposal, marking the beginning of the legislative phase that will determine how far the EU is prepared to simplify its digital rulebook without weakening existing protections. While the first batches of amendments have now been published, they cover only a limited part of the proposal - primarily the new Single-Entry Point (SEP) for incident reporting. Broader political compromises on GDPR, the Data Act, ePrivacy, cookies, data access and AI-related provisions are expected to emerge after the summer as negotiations intensify. 

The initial parliamentary debate suggests broad agreement on the overall objective of reducing unnecessary administrative burdens and improving Europe's digital competitiveness. However, MEPs remain divided over how simplification should be achieved. Centre-right groups favour a more risk-based approach to GDPR implementation, greater legal certainty for businesses and improved access to data for innovation and AI development. Centre-left, Greens and other groups broadly support simplification but oppose reopening core principles of the GDPR, weakening data-subject rights or removing existing safeguards for consumers and SMEs. Several political groups have also questioned the Commission's decision to reopen politically sensitive legislation without a full impact assessment. 

The first published amendments illustrate this emerging direction of travel. Most focus on redesigning the proposed Single-Entry Point for cybersecurity incident reporting rather than rejecting simplification itself. Several amendments seek to replace a centrally managed EU reporting portal with interoperable national reporting hubs connected through common technical standards. Others propose harmonised reporting templates, aligned reporting deadlines and stronger interoperability between NIS2, DORA, the Cyber Resilience Act, GDPR and other reporting frameworks. While approaches differ, the common objective is to reduce duplicate reporting obligations while preserving Member States' supervisory responsibilities. 

What it means for CEE markets

For Central and Eastern Europe, the Digital Omnibus is becoming less about deregulation and more about regulatory efficiency. Many financial institutions, telecom operators, manufacturers and digital businesses across the region must already comply simultaneously with GDPR, DORA, NIS2, the AI Act and sector-specific reporting obligations. If Parliament ultimately delivers more harmonised reporting templates, aligned reporting timelines and interoperable reporting systems, compliance costs could fall without materially reducing supervisory oversight. 

The debate also highlights a broader strategic trend. Rather than fundamentally rewriting the EU's digital rulebook, Parliament appears to be searching for targeted simplifications that preserve legal certainty while making existing legislation easier to implement. This approach is particularly relevant for CEE economies, where many companies operate with smaller compliance teams and more limited administrative resources than larger Western European firms. Simplification that genuinely reduces duplication could therefore improve competitiveness while allowing businesses to focus more resources on investment, innovation and digital transformation. 

Looking ahead, the most politically sensitive negotiations are still to come. Parliament is expected to publish additional compromise amendments after the summer covering GDPR, pseudonymisation, cookie rules, data access, AI-related processing and the future architecture of the EU data framework. These discussions will provide a much clearer indication of whether the Digital Omnibus remains a targeted simplification exercise or evolves into a broader reconsideration of Europe's digital regulatory framework. 

Irish Presidency pushes MISP towards October Council agreement

The Irish Presidency is accelerating work on the Market Integration and Supervision Package (MISP), with the objective of securing a Council general approach by October 2026. Following discussions at the July ECOFIN meeting, technical negotiations are expected to intensify over the coming months as Member States seek compromises on the package's most politically sensitive elements. While there is broad support for deeper and more integrated EU capital markets, significant differences remain over how supervisory responsibilities should be divided between the European Securities and Markets Authority (ESMA), national competent authorities (NCAs) and central banks. 

The main outstanding issues closely mirror the debates emerging in the European Parliament. These include the scope of ESMA's direct supervision over large cross-border asset managers, trading venues and market infrastructures, the governance of ESMA's proposed Executive Board, the criteria for determining which entities should fall under direct EU supervision, and the respective roles of ESMA, national supervisors and central banks. Although political positions differ, the emerging direction suggests that negotiations are converging around a compromise combining stronger supervisory convergence with targeted EU-level supervision of the most systemic entities, while preserving a significant role for national authorities. 

What it means for CEE markets

For Central and Eastern Europe, the outcome of the MISP negotiations will be particularly significant. Most CEE capital markets remain smaller and less integrated than those of Western Europe, with national supervisors continuing to play a central role in overseeing domestic financial institutions and market infrastructures. Any transfer of supervisory responsibilities to ESMA will therefore need to balance the objective of greater market integration with the importance of preserving local market expertise and ensuring proportionate supervision. 

At the same time, deeper supervisory convergence could make CEE markets more attractive to international investors by reducing regulatory fragmentation and improving confidence in cross-border investment. However, supervisory reform alone will not create a genuine Savings and Investments Union. As several parliamentary amendments also recognise, achieving deeper capital markets will require parallel progress on broader structural barriers, including insolvency frameworks, company law, securities law and investor protection. 

The coming months are therefore likely to determine not only the future architecture of EU financial supervision but also the pace at which Central and Eastern European capital markets become more closely integrated into the wider European financial system.

Romania's rebalancing continues as EU-funded investment supports the economy

Romania's economy is entering the second half of 2026 with weaker growth but clearer signs of macroeconomic rebalancing, according to ING's latest Romania Monitor. The bank expects GDP to contract by 0.5% in 2026 before recovering to 2.3% in 2027, as subdued private consumption and fiscal consolidation continue to weigh on activity.

Figure 3. Romania's GDP growth and sectoral contributions (2024–2026 forecast).

Source: ING Think, Monitoring Romania: The last-mile RRF push meets a weak economy, August 2026. Data: National Institute of Statistics (NSI), ING.

At the same time, Romania's external imbalances have begun to improve, with the current account deficit expected to fall below 7% of GDP this year, while stronger fiscal execution has increased confidence that the budget deficit could be reduced to around 6% of GDP. Perhaps most importantly, ING expects 2026 to mark a record year for EU funds absorption, with the fifth and sixth Recovery and Resilience Facility (RRF) payment requests scheduled for August and September.

Figure 4. Romania's cash budget deficit (% of GDP), 2014–2026 forecast.

Source: ING Think, Monitoring Romania: The last-mile RRF push meets a weak economy, August 2026. Data: Romanian Ministry of Finance (MFin), ING. 

Although domestic demand remains weak, investment continues to provide an important source of resilience. Construction activity has remained robust, supported by transport infrastructure, energy projects and other investments financed through the National Recovery and Resilience Plan. ING argues that these projects are not only cushioning the current slowdown but also improving Romania's long-term productive capacity through better transport links, energy infrastructure and stronger integration into European supply chains. The report also highlights the country's strategic position within emerging European industrial, defence and nearshoring initiatives, suggesting that infrastructure investment could strengthen Romania's role as a regional manufacturing and logistics hub over the coming years. 

Romania's experience illustrates a broader trend across Central and Eastern Europe: investment is increasingly becoming the main driver of economic resilience while consumption slows under tighter fiscal conditions. As governments across the region seek to restore fiscal sustainability, EU-funded investment is playing a growing role in supporting infrastructure, industrial modernisation and long-term competitiveness. For investors, the message is that short-term economic weakness does not necessarily imply weaker medium-term fundamentals. Countries that continue implementing structural reforms, absorb EU funds effectively and strengthen productive capacity are likely to be better positioned to attract long-term investment once regional growth recovers. 

Romanian ASF highlights structural reforms behind Bucharest Stock Exchange growth

Romania's capital market continues to benefit from years of structural reforms, according to Alexandru Petrescu, President of the Financial Supervisory Authority (ASF). Speaking on the recent performance of the Bucharest Stock Exchange (BVB), Petrescu said the market's growth reflects not only strong corporate results, attractive dividend policies and increasing retail investor participation, but also sustained efforts to strengthen Romania's capital-market infrastructure. He highlighted the authorisation of Romania's Central Counterparty (CCP), the implementation of the National Strategy for the Development of the Capital Market 2023–2026, and the country's alignment with OECD standards as key reforms supporting greater market transparency, liquidity and investor confidence. Looking ahead, Petrescu noted that Romania's future OECD accession could further strengthen its attractiveness for long-term international investment. 

The comments underline that Romania's recent capital-market growth is increasingly being supported by structural improvements rather than short-term market conditions, reinforcing the country's ambition to become a more mature and attractive regional investment destination. 

Inflation ticks higher as CNB maintains cautious policy stance

The Czech National Bank (CNB) held its latest monetary-policy meeting on 6 August, following its June decision to increase the two-week repo rate to 3.75%. The meeting came shortly after the Czech Statistical Office's flash estimate showed annual inflation rising to 1.7% in July, up from 1.5% in June, driven primarily by stronger services inflation, while food prices remained in deflation. Although headline inflation continues to sit below the CNB's 2% target, the persistence of underlying price pressures supports the central bank's cautious approach. 

The combination of subdued headline inflation and resilient domestic demand reinforces one of the defining themes across Central and Eastern Europe this year: monetary policy is becoming increasingly country-specific. While Hungary has already entered a gradual easing cycle, Czechia appears prepared to keep monetary conditions relatively restrictive until there is greater confidence that inflation will remain sustainably under control. Investors are now looking ahead to the publication of the CNB meeting minutes and future inflation data for further indications of the Bank Board's policy direction. 

Czechia's cautious stance contrasts with the easing cycle underway in Hungary and highlights the increasingly divergent financing conditions emerging across CEE. As inflation, wage growth and domestic demand evolve differently across the region, businesses and investors should expect monetary policy - and borrowing costs - to become increasingly country-specific.

PKO Bank Polski highlights strength of Polish banking sector through record dividend

PKO Bank Polski, Poland's largest lender, reached an important milestone this week as 5 August marked the dividend record date for its PLN 7.675 billion shareholder distribution approved earlier this year. The dividend, equal to PLN 6.14 per share, represents almost 75% of the bank's 2025 net profit, underlining the institution's strong capital position and sustained profitability. Payment is scheduled for 13 August. 

Although the dividend itself was approved previously, the record date highlights the continued resilience of Poland's banking sector despite a more challenging operating environment characterised by slower economic growth, evolving monetary-policy expectations and ongoing regulatory pressures. Strong profitability has enabled leading Polish banks to maintain attractive shareholder returns while continuing to support lending activity and absorb higher capital requirements. The development also reinforces the importance of the banking sector within the Warsaw Stock Exchange, where financial institutions remain among the market's largest listed companies. 

Poland activates a new model for strategic public investment

Poland’s Security and Defence Fund became operational in July, allowing local authorities and companies to apply for financing. The fund has a total value of approximately PLN 23 billion and is financed through Poland’s Recovery and Resilience Plan. It is intended to support civil protection, dual-use infrastructure, cybersecurity, critical services and the development of Polish industrial and defence capacity. 

Around half of the funding is intended for local-government projects, including shelters, road infrastructure and cybersecurity. The remaining resources will be divided between loans and equity financing available to companies in defence, technology, industry, transport and energy. BGK will manage the lending component, while the special-purpose vehicle Chrobry S.A. will be responsible for equity investment. 

Figure 5. Indicative allocation of Poland’s Security and Defence Fund
Civil protection infrastructure receives approximately PLN 9.9 billion, followed by dual-use infrastructure at PLN 6.4 billion, enterprise modernisation and R&D at PLN 4.1 billion, and cybersecurity at PLN 2.5 billion.
Source: Polish Ministry of Funds and Regional Policy, FBiO Budget Increased to PLN 23 Billion, 16 June 2026.
Note: Components total PLN 22.9 billion due to rounding. 

The fund is notable because it integrates regional development, public security and industrial policy within one financing structure. Rather than relying solely on traditional public procurement, Poland is using loans and equity instruments to create longer-term financing capacity. This approach may have wider relevance across CEE. The region faces large investment requirements but limited fiscal space. Using public capital to reduce risk and mobilise private finance can extend the impact of public resources, particularly in sectors where commercial investors may consider project timelines or technological risks too high.

This August, CEE Perspective Academy is launching Conversation with Experts, a new series bringing our community closer to the specialists behind important research on Central, Eastern and South-Eastern Europe. 

The first session, What the 2026 CESEE Bank Lending Survey Reveals, will feature Matteo Ferrazzi, Principal Advisor and Senior Economist at the European Investment Bank and coordinator of the latest EIB CESEE Bank Lending Survey. 

The findings present a mixed but broadly positive picture. Credit demand remains strong, funding conditions are favourable and more than three-quarters of the international banking groups surveyed plan to expand in CESEE. At the same time, banks expect credit supply to weaken slightly and remain cautious about the outlook for credit quality. 

Matteo Ferrazzi will take us behind the headline figures and discuss what these trends mean for banks, borrowers and growth across the region. 

Wednesday, 26 August 2026 | 10:00 CEST | Online 

Participation is free. Register here: https://ceeperspective.eu/events/conversations-with-experts

• AI Act transparency obligations now apply: From 2 August, new transparency requirements under the AI Act have become applicable across the EU. Providers of certain AI systems must clearly inform users when they interact with AI, while AI-generated or manipulated content, including deepfakes, must be appropriately labelled. The European AI Office and national authorities have also begun enforcing the first set of AI Act obligations. This marks the start of the Act's operational implementation phase for many businesses.

• Romania's banking sector finances major renewable investment: Banca Transilvania announced €71.4 million in financing for the Eco Sun Niculești photovoltaic project, highlighting the growing role of domestic banks in financing strategic infrastructure and energy-transition investments.

• ESAs propose simpler bilateral margin rules: The European Supervisory Authorities (EBA, EIOPA and ESMA) published final draft Regulatory Technical Standards (RTS) proposing targeted amendments to the bilateral margin requirements under Delegated Regulation (EU) 2016/2251. The proposals aim to simplify the framework, improve proportionality and reduce operational complexity for firms trading non-centrally cleared derivatives while preserving financial stability safeguards. The draft RTS have now been submitted to the European Commission for endorsement.

• EBA issues no-action letter on FRTB implementation: The EBA published a no-action letter and accompanying technical considerations to facilitate the implementation of the revised market risk framework under the Fundamental Review of the Trading Book (FRTB). The guidance clarifies the treatment of the boundary between the banking book and trading book and supports a harmonised application of the revised capital requirements across the EU while the Commission finalises the Delegated Act.

• EBA consults on ISDA SIMM reporting framework: The EBA launched a consultation on a new reporting framework supporting the validation and ongoing monitoring of the International Swaps and Derivatives Association's (ISDA) Standard Initial Margin Model (SIMM). The proposed framework will support the EBA's role as the central validator of pro forma models under EMIR while adopting a proportionate reporting approach. The consultation remains open until 2 November 2026.