New Zealand Regulators Raise Expectations for AI Governance and Cyber Resilience

Key takeaways

AI governance is becoming a regulatory supervision issue. New Zealand’s financial regulators expect boards and senior management to understand material AI risks, maintain appropriate oversight and ensure existing cyber and operational resilience controls remain effective.
Third-party AI dependencies require closer attention. Organisations need to understand how AI and cloud providers could expose them to security incidents, service interruptions, model failures and concentration risk.
Incident preparedness must reflect AI-enabled threats. Regulators expect financial institutions to prepare for faster cyberattacks, AI-enabled fraud and supplier disruptions through realistic testing of response and recovery arrangements.

On 15 October 2026, the Reserve Bank of New Zealand (RBNZ) and Financial Markets Authority (FMA) jointly outlined their supervisory expectations for managing cyber risks associated with frontier artificial intelligence.The announcement followed an Auckland industry roundtable involving financial sector leaders, the Department of the Prime Minister and Cabinet and the National Cyber Security Centre. The regulators identified three areas requiring particular attention: increasing cyber risk, evolving governance and oversight challenges, and growing third-party and concentration risk.

Although the expectations are directed at regulated financial entities, the underlying issues are relevant to professional services firms increasingly dependent on AI-enabled technology and external providers.

AI risk is now part of operational resilience

The announcement does not introduce a new AI law or separate regulatory framework. Instead, the RBNZ and FMA are making clear that existing prudential, conduct, cyber security and operational resilience obligations must remain effective as AI capabilities advance. This distinction matters. Organisations cannot assume that established controls remain adequate simply because their policies and frameworks have not changed.

Frontier AI is increasing the speed and accessibility of capabilities that can identify and potentially exploit security weaknesses. The regulators are particularly concerned about organisations operating legacy or unsupported technology, where vulnerabilities may be more difficult to remediate.

The RBNZ has encouraged regulated entities to review whether their vulnerability management, monitoring and response capabilities can keep pace with these developments. This includes considering whether predominantly manual security processes remain appropriate or whether carefully governed automation could improve detection and response.

Boards need visibility of AI risk

The FMA’s contribution focused on governance, risk management and accountability. Boards and senior management are expected to understand where AI is being used, how it affects their organisation’s risk profile and whether existing controls remain effective. This goes beyond approving an AI policy.

Organisations need sufficient information to assess material risks, establish appropriate risk appetite, assign accountability and challenge management decisions. Boards should also have access to the skills and expertise necessary to understand emerging AI risks. The regulators specifically identified investment research, portfolio management, client communications and financial advice as areas where AI adoption is likely to expand.

For professional services firms, similar considerations arise when AI contributes to legal analysis, accounting, consulting, client reporting or other professional work.

The governance question is whether leadership understands the consequences of AI use, including what could happen if a system produces unreliable information, becomes unavailable or operates outside its intended boundaries.

Third-party AI risk deserves greater attention

One of the most significant elements of the announcement concerns reliance on external providers. The FMA highlighted the growing dependence of financial institutions on a relatively small number of AI and cloud service providers. A disruption affecting one provider could potentially affect multiple organisations simultaneously. Model failures, service outages, security incidents or changes to a supplier’s operating environment may create risks beyond an individual firm’s control.

The regulators expect financial institutions to assess these dependencies and understand how suppliers’ use of AI may affect their own exposure. This includes reviewing supplier resilience, clarifying responsibilities and establishing contractual arrangements for timely notification of material changes, vulnerabilities and incidents. Importantly, outsourcing a service does not transfer accountability for managing operational risk.

For New Zealand professional services firms, the same principle provides a useful governance benchmark. An organisation may rely on an external AI platform, but it remains responsible for managing the consequences of how that technology is used within its business.

Incident response must account for AI-enabled threats

The regulators also placed considerable emphasis on incident preparedness. Financial institutions are expected to prepare for AI-enabled fraud and scams, including deepfake impersonation, synthetic identities and increasingly sophisticated social engineering. These threats create challenges for traditional verification processes. A convincing voice or video message may no longer provide sufficient assurance that a request genuinely comes from an authorised person.

The FMA also encouraged organisations to test severe but plausible disruption scenarios, including high-speed cyberattacks, zero-day vulnerabilities, model failures and third-party outages. Testing should examine whether manual workarounds, backups, failover arrangements and recovery procedures operate effectively when needed. Where critical suppliers are involved, the regulators suggested including them in exercises where appropriate.

For professional services firms, this raises an important question: could the organisation continue delivering essential client services if a major AI or cloud provider suddenly became unavailable?

The implications extend beyond financial services

The RBNZ and FMA’s supervisory expectations apply within their respective regulatory mandates. They should not be interpreted as imposing identical obligations on every New Zealand business. Nevertheless, the announcement provides a useful indication of how established governance and operational resilience principles are being applied to AI.

Law firms, accounting practices, consultancies and other professional services organisations often manage confidential client information and depend on technology for critical business activities. An AI-related incident could affect the availability of client records, confidentiality of information, reliability of professional advice or ability to meet contractual commitments.

Firms providing services to regulated financial institutions may also face greater scrutiny of their own AI use and resilience arrangements through supplier assessments and contractual requirements.

The practical lesson is that AI governance should be connected to existing enterprise risk management, cyber security and business continuity processes rather than treated as a separate technology initiative.

What this means for your organisation

1. Establish visibility of material AI use. Maintain an inventory identifying important AI systems, their business purposes, owners, information access and external dependencies. Prioritise systems that support critical services or handle sensitive client information.

2. Review board and management oversight. Confirm that material AI risks are included in existing risk reporting and that responsibility for managing them is clearly assigned. Ensure leadership receives enough information to challenge decisions and assess whether controls remain effective.

3. Assess AI supplier concentration. Identify critical services dependent on the same AI, cloud or technology providers. Review contractual protections, incident notification arrangements, recovery capabilities and practical alternatives if a supplier becomes unavailable.

4. Update cyber security priorities. Review identity management, vulnerability remediation, unsupported technology and security monitoring against the changing threat environment. Consider whether existing processes can identify and respond to faster attacks without introducing unacceptable operational risk.

5. Test AI-related incident scenarios. Include deepfake fraud, AI-enabled social engineering, model failure and major supplier outages in incident response and business continuity exercises. Test actual decision-making, communications, manual workarounds and recovery rather than relying solely on documented plans.

6. Document assurance and improvement. Record material AI risks, control assessments, exercise findings and agreed remediation actions. Reassess arrangements when systems, suppliers, capabilities or business dependencies change.

From AI governance to operational readiness

The joint announcement represents an important development in New Zealand’s approach to AI risk. Rather than establishing a separate set of AI-specific rules, the regulators are emphasising that organisations must adapt their existing governance, security and resilience arrangements to a changing operating environment.

For professional services firms, this provides a practical direction. Effective AI governance requires leadership visibility, clear accountability, appropriate supplier oversight and evidence that the organisation can respond when technology or controls fail.

The objective is not to eliminate every AI-related risk. It is to understand material exposures, maintain proportionate controls and ensure the organisation can continue operating when disruptions occur.