cyber defence that allows different authorities to work together effectively. in this context, governments have a natural role as coordinators. attacks are getting more sophisticated. some involve resourceful actors, such as nation - states and terrorist organisations. the financial sector remains a prime target, and we cannot effectively mitigate the risk by simply mandating supervised entities to follow good practices. complex attacks can be deployed via obscure tools. even large financial institutions with excellent ( and expensive ) defence systems can be lost in the face of cutting - edge threats ; they can, of course, work out some of the technical details, but they might miss some of the broader, systemic elements, simply because they ignore relevant information : precedents that affected other sectors ; attacker tactics ; and effective defences adopted elsewhere. this kind of information is generally available only to intelligence agencies and the military. cross - sector, nationwide as well as international cooperation is therefore essential. 1 / 2 bis central bankers'speeches there needs to be a mechanism within each country that allows appropriate public bodies to coordinate and jointly support, each within its own mandate, the victims of a cyber campaign. in the european union, the network and information security ( nis ) directive takes this course. second, cooperation must extend beyond borders given the nature of many of the attacks and the interconnectedness of the financial system. this will always be a challenge because disclosing vulnerabilities to entities from another jurisdiction might endanger national security. nonetheless, we need to find feasible solutions to this problem, since this kind of infosharing might prove crucial in order to respond to some attacks. the g7, as a group of like - minded countries, remains the most favourable context for international cooperation – the many achievements of the g7 cyber expert group ( ceg ) provide a good example of what can be done. the ceg was established in 2015 under the german presidency, and it went on to deliver results during the presidencies of four other countries – japan, italy, canada, and now france. we need to persevere on this route. one area that is ripe for more cooperation is the establishment of common security standards for hardware and software, which also covers the growing market for financial technology apps. in the european union, we have a tradition of very strict safety, physical health and environmental protection standards. we require a conformite europeenne certification – the ce mark that you see on labels – for any product in certain commodity sectors that enters our markets.

certification mechanisms are not exclusive to the eu – think of the fda approval process for pharmaceuticals in the us. in the eu, a new regulation ( currently under approval ) will introduce a mechanism of cybersecurity certification for many products, too. this is an important step, but it would be more effective if g7 countries could converge at least on a subset of requirements. if a service is not safe according to our own laws, it should not be on the market – and there should be a reasonable degree of convergence between laws in like - minded jurisdictions. i would like to conclude by posing two questions. first, i would be very interested to hear from my co - panelists as to what their perspective is on the state of cooperation between authorities and the private sector, especially when it comes to vital infrastructure like clearing and settlement systems. are regulators in this room happy with what we have achieved so far? what do private institutions think should be improved and how? second, are we leveraging technology strongly enough? artificial intelligence ( ai ) is emerging as a pervasive game changer in our economies. it introduces new possibilities in all sectors, and cybersecurity is no exception. ai facilitates the detection and the exploitation of vulnerabilities – attackers know this, so they are starting to deploy machine learning to analyse and penetrate target systems. cybersecurity companies use the same ai analytic tools, with the goal of fixing the weak spots. by the same token, authorities could employ ai, let us say, to ascertain whether supervised entities are meeting mandated security standards on a continuous basis. 2 / 2 bis central bankers'speeches