How Swedish financial firms will report cyber threats from advanced AI

Financial supervision meets AI-driven threats

Sweden's financial supervisor, Finansinspektionen (FI), has announced that it will conduct an in-depth analysis of how financial firms protect themselves against cyber threats from advanced AI models ^[1]. The work forms part of FI's supervisory priorities for 2025, under the heading of financial stability.

The timing is deliberate. DORA, the EU regulation on digital operational resilience for the financial sector, has applied since 17 January 2025 ^[2]. One of its technical standards requires logs to be protected against tampering, deletion and unauthorised access ^[3]. At the same time, Sweden's Cybersecurity Act, which implements the NIS2 Directive, requires essential and important entities to report significant incidents within tight deadlines: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month ^[4].

When a cyber incident happens, logs are what tell you what occurred, who did what and when. But if the people who keep the logs could also change them, the incident report rests on trust rather than evidence. That is the question FI's analysis will encounter.

What DORA says about logs

DORA's technical standard on ICT risk management is clear. Article 12(2)(d) of the delegated regulation states that financial entities shall have logging procedures that, among other things, protect log systems and log information against tampering, deletion and unauthorised access, and detect failures in the logging ^[3].

The provision does not say how to protect the logs. Access controls and monitoring are the foundation. But access controls only work until someone with the right access decides to change something. Monitoring can catch some changes, but it depends on the monitoring system itself being trustworthy.

That is where the evidence question arises. When FI or an auditor wants to review what happened during a cyber incident, they need logs they can rely on. If the organisation keeping the logs is also the one under scrutiny, how do they show that nothing has been altered?

The Cybersecurity Act's reporting deadlines

Sweden's Cybersecurity Act, which entered into force on 15 January 2026, applies to essential and important entities in 18 sectors, including energy, transport, healthcare, digital infrastructure and public administration ^[4]. The Act requires them to report significant incidents in three stages.

First, an early warning within 24 hours of becoming aware of the incident. Second, an incident notification within 72 hours, or as soon as the information is available. Third, a final report within one month, including a detailed description, the severity and impact, and measures taken ^[4].

Those deadlines are short. They assume the organisation knows what happened, and can show it. Logs are the usual source for that information. But if the logs can be changed after the fact, the report becomes an assertion rather than a demonstration.

Financial firms face both regimes. DORA applies to banks, credit institutions, payment institutions, securities firms and insurance companies. The Cybersecurity Act applies to many of the same organisations, plus a wider range of essential and important entities. The two sets of rules overlap, and both point to the same practical question: can you show what your systems did, in a way that holds up when someone checks?

How a digital witness changes the conversation

A digital witness is a sealed record that shows something existed at a particular time and has not changed since. The content stays with you. The witness is a fingerprint of that content, sealed on a chain where any later change would show.

Here is how it works in the context of incident logging. Each time a log entry is created, a fingerprint is calculated and sealed. The fingerprint is small and reveals nothing about the content. When the incident is reported, you calculate the fingerprint again. If it matches, nothing has changed. Change a single character and it will not match.

That creates an independent record. It does not prevent someone from changing the log, but it shows if they did. Even if the person making the change has full administrative access, the sealed fingerprint will no longer match.

For a financial firm reporting an incident to FI, that is a short conversation rather than a long one. The logs are there, and the fingerprints show they have not been altered since sealing. The supervisor can check it themselves, without having to trust the firm's word.

Why this matters for AI-driven threats

Advanced AI models can be used to automate attacks, identify vulnerabilities faster, and adapt tactics in real time. That makes incidents harder to detect and harder to trace. Logs become more important, not less.

But logs are also a target. An attacker who gains access might try to cover their tracks by altering or deleting log entries. If they succeed, the incident report will be incomplete, and the firm's understanding of what happened will be incomplete as well.

A digital witness does not stop the attack. It does not prevent the logs from being changed. But it shows if they were changed, and it does so in a way that does not depend on the firm's own assurances. That is what makes it a witness rather than a record.

For FI's analysis of how firms protect themselves against AI-driven threats, that distinction will matter. The question is not only whether firms have logs, but whether those logs can be relied on when something goes wrong.

What this means for you

If you work in risk management, IT security or compliance at a financial firm, here are three questions worth asking now:

First, could you show FI or an auditor that your incident logs have not been altered, even by someone with administrative access?

Second, do your logging procedures include a way to detect if a log entry has been changed or deleted after the fact, as DORA's technical standard requires?

Third, when you report an incident under the Cybersecurity Act's deadlines, will your evidence rest on trust, or can you demonstrate what happened?

Access controls are necessary. Monitoring is necessary. But a digital witness adds a layer that works even when someone with legitimate access decides to change something. It does not replace the other controls. It complements them.

What to watch

FI's analysis of AI-driven cyber threats is ongoing. The supervisor has not published a timeline for its findings, but the work forms part of its 2025 priorities ^[1].

Under DORA, the technical standard on ICT risk management has applied since 17 January 2025 ^[2][3]. Financial firms are expected to have their logging procedures in place.

Sweden's Cybersecurity Act entered into force on 15 January 2026, with the incident reporting requirements now in effect ^[4].

For financial firms, the practical question is straightforward: when the next incident happens, will your logs be evidence, or will they be a story you have to defend?