As frontier AI reshapes the cyber threat landscape, New Zealand’s financial regulators are reinforcing the need for effective governance, strong controls and operational resilience. Here’s what financial institutions should prioritise.
The Reserve Bank of New Zealand (RBNZ) and the Financial Markets Authority (FMA) have a clear message for financial institutions: as artificial intelligence (AI) advances, risk management frameworks, cyber controls and governance arrangements must keep pace.
On 15 October 2026 the regulators set out their supervisory expectations on the cyber risks associated with frontier AI: increasingly capable AI systems that are changing both the nature and the scale of cyber threats.[1][2] The expectations build on existing prudential, conduct, cyber and operational resilience obligations rather than creating a separate regime.
The challenge has two sides. AI makes cyber attacks more sophisticated and easier to scale, while institutions’ own use of AI, including through vendors, brings new governance, security and operational risks. Managing it is therefore not just a job for the technology team. It needs coordinated oversight across risk, compliance, cyber security, procurement and senior leadership.
For a practical guide to governing AI risk, download Protecht’s Managing AI Risks eBook:
Three areas of risk financial institutions need to address
The regulators identified three areas that need particular attention.
1. Increased cyber risk: Strengthening controls against evolving threats
AI is changing the cyber threat environment. More sophisticated phishing, automated attacks and AI-enabled social engineering can amplify existing vulnerabilities, making cyber incidents both more likely and more damaging.
The regulators expect institutions to maintain strong foundational cyber controls, which the RBNZ describes as “getting the basics right”, and to keep their frameworks under review as threats evolve.[1] In practice, this means moving beyond documenting controls to knowing whether they work.
We recommend that institutions:
- Review existing cyber risk assessments to account for AI-enabled threats
- Map cyber risks to controls, business processes and critical assets
- Test control effectiveness regularly and identify gaps
- Establish clear ownership and accountability for remediation
- Monitor incidents, emerging risks and control performance
Protecht’s cyber and IT risk management solution connects cyber risks, controls, incidents and actions in one integrated framework. Risk and cyber teams can assess their cyber risk posture, map controls to recognised frameworks, track control effectiveness and give management a clearer view of emerging exposures, replacing disconnected spreadsheets and periodic assessments with a consistent, evidence-based view.
2. Governance and oversight: Making AI risk visible to leadership
As the FMA’s Louise Unger put it: “Boards and senior management need to know where AI is being used in their business, understand the risks it brings, and be clear about who is accountable for managing them.”
AI may be embedded in customer service platforms, fraud detection systems, operational processes and third-party applications. Shadow AI, where employees adopt AI tools without formal approval or oversight, compounds the problem: without clear governance, organisations may not know how sensitive information is being shared, which systems are accessing business data or whether appropriate security controls are in place. Without a consolidated inventory of AI use, overall exposure is hard to judge.
Effective governance requires more than an AI policy. It needs clear accountability, documented risk assessments, appropriate controls and ongoing oversight throughout the AI lifecycle.
We recommend:
- Establishing a central inventory of AI systems, including those embedded in third-party applications
- Assigning ownership and accountability for AI-related risks
- Assessing AI use cases against the organisation’s risk appetite
- Integrating AI risks into existing enterprise risk management frameworks
- Giving boards and executives meaningful reporting on AI exposure, controls and emerging issues
Protecht’s AI governance capabilities provide a structured way to identify, assess and monitor AI systems across the organisation. They support a central AI inventory, capture risk assessments and governance decisions, and document accountability, controls and monitoring requirements. Because AI governance sits within broader enterprise risk management, leadership gets a fuller view of AI-related exposures and evidence of how they are being managed.
For risk professionals who want to build their expertise, Protecht Academy’s AI governance and risk management course shows how to embed AI risk management within existing enterprise risk frameworks, including its links to cyber risk, operational resilience and third-party risk management.
3. Third-party and concentration risk: Understanding dependencies beyond the organisation
Financial institutions increasingly rely on external technology providers, cloud infrastructure and AI-enabled services to support critical operations. These dependencies can create new vulnerabilities, especially where several services rely on the same underlying providers or AI models. The regulators highlight growing third-party and concentration risk as a key supervisory concern.
Institutions therefore need to understand not only the risks posed by individual suppliers, but also how dependencies across the wider technology ecosystem could affect operational resilience.
We recommend:
- Identifying third-party providers delivering AI-enabled services
- Assessing suppliers’ cyber security and AI risk management practices
- Understanding critical fourth-party dependencies where information is available
- Identifying concentrations of risk across providers and services
- Conducting ongoing supplier assessments and monitoring changes in risk exposure
- Evaluating contingency arrangements for critical technology dependencies
Protecht’s vendor risk management solution, complemented by VISO TRUST’s AI-powered third-party risk assessments, helps organisations streamline vendor due diligence, assess security risks and monitor third-party exposures. VISO TRUST uses AI to speed up analysis of supplier security documentation, helping risk teams identify gaps, reduce manual effort and conduct more consistent due diligence. Supplier exposures stay connected to enterprise risk management and operational resilience processes, which matters more as technology ecosystems grow more complex.
Operational resilience: The common thread
Operational resilience underpins all three areas, and both regulators say it remains a key supervisory focus. Institutions need to understand how AI-related threats and technology dependencies could disrupt critical operations, and whether their controls, response plans and recovery arrangements remain effective. That requires an integrated approach connecting cyber risk, AI governance, third-party risk and business continuity.
For example, an institution relying on an AI-enabled third-party service should be able to answer:
- Which critical business operations depend on the service?
- What risks could arise from a cyber incident, service failure or compromised AI system?
- Which controls and contingency arrangements are in place?
- How would an incident be identified, escalated and managed?
- Have recovery arrangements been tested against relevant disruption scenarios?
Protecht’s integrated risk and resilience capabilities connect these elements, giving a clearer view of critical operations, dependencies, controls, incidents and recovery arrangements. Risks can then be understood by their potential impact across the organisation, rather than managed in isolation.
Conclusions and next steps for your organisation
The RBNZ and FMA are not telling financial institutions to avoid AI. They want innovation backed by effective governance, proportionate controls and a clear understanding of the risks involved.
And although the announcement focuses on cyber risk, AI governance must take a broader view, covering consumer outcomes, algorithmic bias, discrimination, privacy and transparency. These risks are interconnected and belong in a consistent enterprise risk management framework, not in separate, disconnected processes.
As AI capabilities evolve, fragmented approaches to cyber risk, AI governance and third-party oversight will become harder to sustain. Protecht brings enterprise risk management, AI governance, cyber risk, controls assurance, third-party risk management and operational resilience together in one connected approach, helping institutions identify emerging threats, demonstrate accountability and strengthen operational resilience.
Request a demo to see how Protecht connects AI governance, cyber risk, third-party risk and operational resilience in one platform:
References
[1] Reserve Bank of New Zealand and Financial Markets Authority, “RBNZ and FMA outline supervisory expectations on cyber and AI risks”, 15 October 2026, https://www.rbnz.govt.nz/news-and-events/news/2026/10/rbnz-and-fma-outline-supervisory-expectations-on-cyber-and-ai-risks
[2] Reserve Bank of New Zealand and Financial Markets Authority, “Supervisory expectations on cyber risk associated with frontier AI”, October 2026, https://www.rbnz.govt.nz/-/media/project/sites/rbnz/files/publications/speeches/2026/supervisory-expectations-on-cyber-risk-associated-with-frontier-ai.pdf