Home › Guides › AI Cyber Risk

AI Cyber Risk: What NZ Regulators Now Expect of Your Board

In October 2026 the Reserve Bank and the Financial Markets Authority stood up together in Auckland and set out what they expect of financial firms facing AI cyber risk. Much of it was what you would expect from a regulator: keep your security controls current, patch faster, plan for disruption. One part was aimed squarely at the boardroom. Boards and senior management, they said, need to know where AI is being used in the business, understand the risks it creates, and be clear about who is accountable for managing them.

If your organisation is a bank, insurer, fund manager or other regulated entity, that is now a supervisory expectation you will be asked about. If it is not, read it anyway. When two national regulators describe what good oversight of AI cyber risk looks like, they are also describing the standard a reasonable director in any sector will increasingly be measured against.

Not new rules, but a sharper question

The regulators were careful to say these expectations build on obligations that already exist: prudential, conduct, cyber and operational resilience. Nothing new has been legislated, no new rule has been issued and no compliance date has been set. The regulators describe it as an active supervisory focus that will continue. What has changed is the threat, and therefore what "taking reasonable care" means in practice.

Frontier AI shortens the gap between a weakness being discovered and a weakness being exploited. An unpatched system that might once have sat unnoticed for months can now be found and attacked at machine speed. Convincing fakes of voices, faces and writing make old warning signs unreliable. Under the Companies Act 1993 you must bring the care, diligence and skill of a reasonable director in your circumstances. Your circumstances just changed, and the regulators have said so on the record.

Four things your board should be able to show on AI cyber risk

Read the regulators' remarks as a test. If a supervisor, an auditor or a court asked tomorrow, could your board show each of these from its own records?

1. You know where AI is used

Most boards cannot answer this, and the honest reason is that nobody has asked. AI arrives through many doors: tools staff adopt on their own, features switched on inside software you already pay for, and systems your suppliers run on your behalf.

Ask management for a single list. For each use: what it does, what data it touches, who approved it, and who owns it. The first version will be incomplete. That is fine. A board that has an imperfect map and a plan to improve it is in a very different position from a board that has never asked.

2. Accountability has a name

"Management is across it" is not accountability. The regulators expect boards and senior management to set the risk appetite for AI and to assign clear accountability for material AI risks, and clarity means a person, not a department. They also expect the board to have the skills to challenge what it is told, and independent assurance that controls are working as intended.

Decide, and record, who owns AI risk at executive level and which board committee oversees it. If the answer splits across technology, risk and operations, say who holds it together. When something goes wrong at three in the morning, the organisation should not have to work out whose problem it is.

3. You have assumed an incident will happen

The regulators told firms to assume AI enabled incidents will occur and to plan on that basis. That shifts the board's question from "are we protected?" to "how fast do we recover, and have we proved it?"

Ask for a test against a severe but plausible scenario, not a gentle one. A realistic case might be a convincing deepfake call to finance during a busy week, or ransomware that reaches your backups. Ask what was learned and what has changed since. A response plan that has never been exercised is a document. One that has been run, with the gaps fixed, is a capability.

Pay attention to old systems. Software that is out of support no longer receives security fixes, and in a world where weaknesses are found faster, that exposure grows every month you carry it. Ask management for the list, and for the plan and date to retire or isolate each one.

4. You own your suppliers' risk too

The third area the regulators flagged is concentration: a growing dependence on a small number of AI and cloud providers. Their message was blunt. Outsourcing a service does not outsource accountability for it.

Ask which providers you could not operate without for a week. For each, ask what happens if they suffer an outage or a breach, what your contract lets you demand, and whether you have ever tested the fallback. If several critical services all run through the same provider, that is a single point of failure the board should see named, not discover.

A short checklist for your next meeting

• A register of AI in use, with owners, presented to the board.
• A named executive owner and a named overseeing committee, minuted.
• AI and cyber risk on the risk register, rated honestly, with residual risk after controls.
• A dated, severe but plausible incident exercise, with findings and follow ups.
• A list of out of support systems with a retirement or isolation date for each.
• A list of critical AI and cloud providers, with your fallback for each.

None of this requires the board to become technical. It requires the board to insist on evidence, and to keep asking until the evidence exists.