The Reserve Bank of New Zealand (RBNZ) and the Financial Markets Authority (FMA) have outlined supervisory expectations on cyber risks associated with frontier AI.
Cyber risk has long been recognised as a significant operational risk for regulated entities and a focus for both the RBNZ through its financial stability mandate and the FMA through its conduct mandate.
According to RBNZ Assistant Governor Financial Stability Angus McGregor, regulators expect entities to maintain cyber security strategies and frameworks that adequately address the cyber threats they face.
The supervisory expectations focus on how entities should be responding to three key risks arising from frontier AI developments:
- Increased cyber risk
- Evolving governance and oversight challenges.
- Growing third-party and concentration risk.
In the face of this dynamic risk landscape, the RBNZ and FMA expect regulated entities to maintain strong foundational cyber controls and security posture, meaning there should be a focus on “getting the basics right” Mr McGregor said.
FMA Executive Director, Response and Enforcement, Louise Unger also noted that while AI can bring benefits for entities and their customers, it also changes the risks they face.
“Boards and senior management need to know where AI is being used in their business, understand the risks it brings and be clear about who is accountable for managing them,” said Ms Unger.
Mr McGregor also further explained that operational resilience remains a supervisory focus for the RBNZ and the FMA, who will continue engaging with regulated entities to ensure these risks are managed appropriately.