In October 2025 the G7 Cyber Expert Group issued a statement on artificial intelligence and cybersecurity. It addresses cyber risk arising from advanced AI technologies including generative and agentic AI, and sets out concrete measures for the financial sector.
Three risk categories identified
Attackers using AI. AI lowers the barrier to attack — automated phishing, deepfake voice, AI-assisted malware generation — changing the cost and speed of attacks.
AI systems as targets. Model poisoning, training data contamination and abuse of inference interfaces are new attack surfaces. When a model is a core business asset, an attack on the model is an attack on the business.
AI supply chain risk. Models depend on upstream pre-trained weights, open source components, data and compute services. Contamination at any link propagates downstream.
AI SBOM: managing the supply chain
Among the measures recommended for the financial sector, the “AI software bill of materials” (AI SBOM) stands out. SBOM practice in traditional software supply chain governance is to itemise software components so that, when a vulnerability appears, the affected scope can be located quickly.
Extending that idea to AI means models and AI systems need an “ingredients list”: which pre-trained models, datasets and third-party components were used. For AI companies, this is not only a compliance requirement but risk management infrastructure.
Why the financial sector leads
Financial services adopt AI quickly, handle sensitive data and face dense supervision, making the sector a front runner in AI cyber governance. This echoes the sustained attention of international bodies such as the Financial Stability Board to financial AI risk. See our note on financial AI security guidance.
For companies supplying AI to financial institutions, client security requirements translate directly into vendor admission conditions. AI SBOM, risk assessment and supply chain management may become hard thresholds in bids.
How companies should respond
First, build itemised inventories of models and components, bringing pre-trained models, datasets and open source dependencies into an asset ledger.
Second, fold AI security into the cybersecurity governance framework rather than treating it as a standalone AI compliance matter. See our notes on the AI clause in the revised Cybersecurity Law and network data security risk assessment.
Third, prepare a supply chain incident response process, defining how the impact of an upstream component problem is assessed and how alternatives are found. See our multi-jurisdiction service.
Connecting AI with cybersecurity governance is a notable trend in international AI governance in 2025: AI risk is no longer discussed in isolation but embedded in existing cybersecurity and supply chain governance.
This article is based on the G7 Cyber Expert Group statement on artificial intelligence and cybersecurity and on public information. It is for general reference only and does not constitute legal advice.