FI is checking how Swedish banks defend against AI-powered attacks

FI wants to know how banks are getting ready

Finansinspektionen (FI), Sweden's financial supervisory authority, is examining how banks, insurance companies and financial infrastructure firms are preparing their defences against cyberattacks powered by AI ^[1]. The review is part of FI's supervision under DORA, the EU regulation on digital operational resilience for the financial sector, which has applied since 17 January 2025 ^[2].

According to Breakit, FI sent a questionnaire to a range of financial firms in late 2024, asking how they are addressing the risks that AI tools pose in the hands of attackers ^[1]. The firms were asked to reply in early 2025.

Think of it like this: a burglar alarm tells you when a door opens. A log tells you which door, when and whether the person who opened it had a key. DORA wants both the alarm and the log, and it wants the log to stay reliable even if the person who keeps it could change it.

What DORA says about logs

DORA itself requires financial firms to have mechanisms to detect anomalies and cyber threats in good time ^[2]. The technical standard that implements DORA goes into detail about logging. Article 12(2)(d) of Commission Delegated Regulation (EU) 2024/1774 says logging procedures must protect log systems and log information against tampering, deletion and unauthorised access, and detect failures in logging ^[3].

The rule applies to banks, credit institutions, payment institutions, securities firms, insurance companies and other entities within DORA's scope ^[3].

That requirement doesn't tell firms exactly how to protect their logs, but it does say what has to hold up: the logs themselves. Access controls and monitoring are the foundation. The harder question is what happens when the person who could change a log has the access rights to do it.

Why AI makes the question sharper

AI tools give attackers new ways in. They can automate reconnaissance, write more convincing phishing messages and adapt faster to defences ^[1]. For a bank, that means incidents can move faster and logs matter more, because the log is what tells you what happened during an incident or an audit.

It isn't enough that the logs exist. People have to be able to trust them. When an incident is investigated months later, or when a supervisor asks for records, the question is whether the log is the one written on the day, or whether someone has quietly edited it since.

That's the evidence question: how do you show a supervisor, an auditor or a court that a log hasn't changed, when you're the one keeping it?

A digital witness for logs

Here, the thing to seal is log segments at short intervals, for example every few minutes. Sealing takes a fingerprint of each segment, not the data itself, so the logs never leave your systems. Your system sends the fingerprint to WitniumChain through the REST API, the SDK or the MCP server, and gets a witness ID back.

To check, internal audit, supervisors or incident responders calculate the fingerprint again and compare it with the sealed one. If it matches, the segment hasn't changed since it was sealed, even by someone with administrator rights. Change a single character and the fingerprint won't match.

What it doesn't do: it doesn't replace access control, monitoring or backups. It doesn't show that the log is complete. What it does is make a change visible, even when it's made by someone who is supposed to have access.

The first 2,000 witnesses a month are free.

What this means for you

If you work with ICT risk or operational resilience in a financial firm, here are three questions worth asking:

• Could we show a supervisor that our access logs, audit trails and incident logs haven't been altered, even by someone with administrator rights?
• How quickly would we know if logging failed, and do we have a way to detect gaps?
• When AI tools are used in attacks, how do our current defences and logging cope with faster, more automated threats?

FI's review suggests these questions are on the supervisor's mind as well.

What to watch

FI is expected to publish findings from the review later in 2025. DORA's technical standards on ICT risk management are already in force, and national supervisors across the EU are examining how firms are implementing them ^[3].

For firms preparing for the next audit or incident review, the time to decide how to protect logs is before someone asks to see them.