Reserve Bank of New Zealand Assistant Governor for Financial Stability Angus McGregor and Financial Markets Authority Executive Director for Response and Enforcement Louise Unger outlined joint supervisory expectations for managing cyber risks associated with frontier artificial intelligence at an industry roundtable. Building on existing prudential, conduct, cyber and operational resilience obligations, the expectations address stronger cyber defenses, governance and oversight, third party and concentration risk, and incident preparedness. Regulated entities should strengthen identity and access management, asset lifecycle management, vulnerability detection and timely patching, while managing the operational risks of accelerated remediation. Cybersecurity and AI risk frameworks should reflect each entity’s business profile, risk appetite and resilience objectives. Boards and senior management should understand where AI is used, maintain visibility of material risks and dependencies, assign clear accountability and have the capability to challenge management effectively. Entities should assess how AI and cloud providers could introduce or amplify threats, particularly where reliance is concentrated among a small number of suppliers. Supplier resilience, contractual incident notifications and shared responsibilities require effective oversight, but accountability for operational risk remains with the regulated entity. Firms should assume incidents will occur and test response and recovery arrangements against severe but plausible scenarios, including high speed attacks, model failures and third party outages.

Original source