Analysis
The statement shows two financial supervisors turning general concern about advanced AI into a list of what they will look for at the firms they oversee. By stressing basic cyber controls and board visibility, it frames the new technology as an extension of existing resilience duties.
What was announced
On October 15 the Reserve Bank of New Zealand and the Financial Markets Authority jointly outlined their supervisory expectations on cyber risks linked to frontier AI, meaning the most advanced AI models. They did so at an industry roundtable also hosted by the Department of the Prime Minister and Cabinet and the National Cyber Security Centre [1].
The regulators identified three areas of risk: heightened cyber risk, evolving governance and oversight challenges, and growing third-party and concentration risk. They said the expectations build on existing prudential, conduct, cyber and operational resilience obligations [1].
In the regulators' words
Angus McGregor, the Reserve Bank's Assistant Governor for Financial Stability, said the core message was simple: advances in AI are changing the operating environment for financial institutions [1].
Louise Unger, the Financial Markets Authority's Executive Director for Response and Enforcement, said boards and senior management need to know where AI is being used in their business [1].
What the remarks set out
The text of McGregor's and Unger's joint remarks sets out expectations under each risk area. On cyber risk, it points to strong foundational controls such as identity and access management and timely patching, faster vulnerability remediation, and testing of severe but plausible scenarios, including high-speed attacks and supplier outages [2].
On governance, it says boards and senior management should set risk appetite and clear accountabilities and track where AI is used across the business. On third parties, it points to contracts requiring timely notice of material changes and incidents, and states that accountability for managing operational risks remains with regulated entities [2].
What remains uncertain
The announcement and the remarks state no deadlines, and the regulators describe the expectations as based on existing obligations, so how they will be applied in supervision of individual firms has not been set out.
Sources
- Reserve Bank of New Zealand: RBNZ and FMA outline supervisory expectations on cyber and AI risks, October 15, 2026 ↗Source
- Reserve Bank of New Zealand and Financial Markets Authority: Supervisory expectations on cyber risk associated with frontier AI, remarks by Angus McGregor and Louise Unger, October 15, 2026 (PDF) ↗Source · PDF