The Reserve Bank of New Zealand and Financial Markets Authority have jointly outlined their expectations for how financial institutions should manage the growing cyber security risks associated with advanced artificial intelligence.
The announcement follows an industry roundtable involving the two regulators, the Department of the Prime Minister and Cabinet, and the National Cyber Security Centre.
The regulators identified three areas requiring particular attention: increasingly sophisticated cyber threats, evolving governance responsibilities, and growing dependence on third-party AI providers. They emphasised that existing cyber security and operational resilience obligations remain applicable as AI capabilities advance.
Key facts
- The regulators identified increased cyber risk, governance challenges and third-party concentration as three priority areas.
- Financial institutions are expected to maintain cyber security strategies that address emerging AI threats.
- Boards and senior management must understand where AI is being used and who is accountable.
- Strong foundational cyber controls remain essential.
- Operational resilience and supplier dependencies are continuing supervisory priorities.
- The expectations build on existing regulatory obligations rather than introducing a separate AI regulatory regime.
Our take
This is an important development for AI governance in New Zealand, particularly for banks, insurers, financial advisers and other regulated financial services organisations.
The regulators are making it clear that AI governance cannot be separated from cyber security, operational resilience and board accountability.
The practical starting point is an accurate inventory of AI systems, including tools introduced by employees and external service providers. Organisations should understand what information these systems access, what actions they can perform and how they would respond if an AI system or supplier were compromised.
These expectations also provide useful guidance for organisations outside the financial sector.
