RBNZ and FMA outlined non-binding supervisory expectations on frontier-AI cyber risk in remarks to New Zealand financial services leaders on 15 October 2026
The remarks are not a rule and set no deadline or penalty. They show how the prudential and conduct regulators want boards, patching, suppliers and incident testing handled under obligations that already exist.
Bottom line: These are non-binding supervisory expectations, not a rule. On 15 October 2026 the Reserve Bank of New Zealand and the Financial Markets Authority outlined supervisory expectations on cyber risk from frontier AI, in remarks to industry leaders in Auckland. The RBNZ release says they build upon existing prudential, conduct, cyber and operational resilience obligations, and neither source states a deadline or a penalty.
Who this affects: Chief risk officers, heads of compliance, CISOs and operational-resilience leads at RBNZ-regulated and FMA-regulated entities, and the directors they brief.
Issue date: 15 October 2026. No compliance date is stated.
What changed: The two regulators gave a joint position on three risks: increased cyber risk, evolving governance and oversight challenges, and growing third-party and concentration risk. The remarks also cover incident preparedness.
Analysis: On our reading, the remarks add no new requirement. They tell entities which questions both regulators are asking together, one from a financial-stability angle and one from a conduct angle.
- Instrument (English)
- "Supervisory expectations on cyber risk associated with frontier AI", remarks delivered to financial services industry leaders in Auckland, with RBNZ media release "RBNZ and FMA outline supervisory expectations on cyber and AI risks"
- Authority
- Reserve Bank of New Zealand (Angus McGregor, Assistant Governor Financial Stability) and Financial Markets Authority (Louise Unger, Executive Director Response and Enforcement). The roundtable was jointly hosted with the Department of the Prime Minister and Cabinet and the National Cyber Security Centre
- Jurisdiction
- New Zealand
- Status
- Delivered. Supervisory expectations in remarks form
- Bindingness
- Non-binding. The sources do not present the remarks as a new rule, guideline or standard, or as a new enforceable requirement. The release says the expectations build upon existing obligations
- Issue date
- 15 October 2026
- Effective date
- Not applicable (non-binding). No effective date or compliance deadline is stated in the source
- What changed
- The two regulators outlined, together, what they expect of regulated entities on cyber risk from frontier AI: strong foundational controls, board visibility and accountability, third-party and concentration risk management, and incident preparedness
- Who this affects
- Chief risk officers, heads of compliance, CISOs and operational-resilience leads at RBNZ-regulated and FMA-regulated entities, and the directors they brief
- Primary source
- RBNZ media release; remarks PDF (RBNZ)
- Workflow impact
- Not stated in the source as a process, form or filing. The remarks do expect action: Mr McGregor said "we expect all regulated entities to be taking steps now to shore up cyber resilience"
- Operational next step
- Not stated in the source as a formal step. The speakers' expectations are summarised in the sections below; they are supervisory expectations, and no penalty or deadline is stated
- Last verified
- 2026-10-24
Primary source: RBNZ media release and remarks PDF (RBNZ)
Key takeaways
- The expectations are non-binding remarks, not a rule, guideline or standard, and no deadline or penalty is stated.
- Boards and senior management are asked to know where AI is used, set risk appetite and assign clear accountability for material AI risk.
- The speakers encouraged faster risk-based patching, and acknowledged that faster patching carries its own operational risk.
- Accountability for operational risks stays with the regulated entity, including where a third party is involved.
- Entities are asked to assume incidents will occur and to test severe but plausible scenarios.
Are these expectations a new rule?
No. The RBNZ release quotes Mr McGregor saying the expectations "build upon existing prudential, conduct, cyber and operational resilience obligations". The remarks PDF says they "reflect" those obligations. They were delivered at a roundtable and published as remarks, and the sources describe no consultation, instrument number or compliance date.
| Item | What the sources state |
|---|---|
| Date | 15 October 2026 |
| Speakers | Angus McGregor (RBNZ) and Louise Unger (FMA) |
| Hosts | RBNZ, FMA, Department of the Prime Minister and Cabinet, National Cyber Security Centre |
| Three focus risks | Increased cyber risk; governance and oversight; third-party and concentration risk |
| Deadline | None stated |
| Penalty or enforcement action | None stated |
What do the regulators expect on cyber fundamentals and patching?
They expect strong foundational controls, naming identity and access management, asset lifecycle management and timely patching. The speakers encouraged entities to accelerate risk-based vulnerability identification, patching and remediation, and added that faster patching "comes with its own risks, including the potential for incidents", which entities should manage. They suggested assessing whether predominantly manual monitoring and triage remain adequate against machine-speed threats, and said any AI used for detection or vulnerability management should sit under oversight, accountability and control arrangements proportionate to the business. They also said frontier AI increases the risks tied to out-of-support legacy systems.
What do they expect from boards and senior management?
Visibility, risk appetite and named accountability. Ms Unger said in the release: "Boards and senior management need to know where AI is being used in their business". In the remarks she added that boards should maintain board capability to provide effective challenge and can be supported by independent assurance. She also said she expects AI adoption to extend into investment research, portfolio management, client communications and financial advice, and that boards should have visibility of where it is used and whether governance and control frameworks remain effective.
What do they say about third parties and concentration risk?
Entities should understand their third-party threat exposure, including how suppliers use AI, particularly where there is concentration risk. The remarks name supplier resilience assessments, appropriate controls and contractual arrangements that provide for timely notification of material changes, vulnerabilities and incidents. Ms Unger said: "accountability for managing operational risks remains with regulated entities."
What do they say about incidents and fraud?
"Entities should assume incidents will occur and should prepare accordingly", the remarks say in their key messages. They ask for response and recovery protocols for AI-enabled attacks and disruptions, tested against severe but plausible scenarios such as high-speed attacks, zero-days, model failure and third-party outages. Entities should also consider whether fraud controls and customer and employee verification remain effective against deepfake impersonation and synthetic identities.
What should regulated firms check now?
The remarks are not a checklist, and this list is ours, drawn from points the speakers made. It is not exhaustive and it is not a regulatory test.
- Whether the board can say where AI is used, and who holds accountability for material AI risk.
- Whether the patching and remediation cycle reflects the pace the speakers described, with the risk of faster patching recorded.
- Which systems are out of support, and whether transformation timelines account for them.
- Whether key supplier contracts provide for timely notification, and where AI and cloud concentration sits.
- Whether a severe but plausible scenario, with critical suppliers where appropriate, has been run or scheduled.
- Whether fraud and verification controls address deepfake impersonation and synthetic identities.
The regulators said operational resilience "is and remains a key supervisory focus area" and that entities can expect continued engagement. The remarks refer to the FMA's existing thematic review of AI in financial advice and its operational resilience thematic work. They do not announce a new review programme, reporting requirement or follow-up instrument.
FAQ
Are the RBNZ and FMA frontier-AI cyber expectations legally binding?
The sources do not present them as a new binding rule. They were delivered as remarks at an industry roundtable, and the RBNZ release said they build upon existing prudential, conduct, cyber and operational resilience obligations.
Is there a deadline or a penalty attached to the expectations?
Neither the RBNZ media release nor the remarks PDF states a deadline, a fine or an enforcement action. The regulators said they will continue to engage with regulated entities on the topic.
Who do the remarks cover?
The speakers addressed entities regulated by the Reserve Bank and the FMA. The sources do not extend the expectations to organisations outside those two regulators' remit.
Do the remarks change the FMA's work on AI in financial advice?
The remarks describe the FMA's thematic review of AI in financial advice as one of the initiatives that will inform future work and engagement with industry. They do not announce new advice-specific requirements.
What we did not verify
What we opened: the RBNZ media release and the full text of the remarks PDF, both read on 2026-10-24. Every quotation on this page comes from those two documents.
What we did not open: the footnoted third-party documents the speakers cited, including the NCSC guidance and Cyber Threat Report 2026, the Five Eyes call to action, the FSI paper and the FSB letter, an FMA-hosted copy of the remarks, and the FMA thematic review pages. We do not report what those documents say.
What we refuse to claim: that the remarks create a binding duty, that any unmet expectation breaches an existing obligation, a deadline, a penalty, or how either regulator will assess entities beyond the speakers' statement that they will continue to engage. We do not know whether a separate formal guidance document will follow.
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
The RBNZ and FMA remarks of 15 October 2026 are non-binding and set no deadline or penalty, and the regulators tied them to existing obligations. They are a useful set of questions for the board and CISO: where AI is used, who is accountable, how fast patching runs, what suppliers notify you of, and whether severe scenarios have been tested.
Related briefings
Source File
Primary: RBNZ media release, 15 October 2026; Remarks PDF, "Supervisory expectations on cyber risk associated with frontier AI"
Secondary: None relied on.
Last checked against primary source: 2026-10-24 (UTC)
Status: Non-binding supervisory expectations delivered as remarks; no deadline or penalty stated.
Editorial note: Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
Entities should assume incidents will occur and should prepare accordingly. · RBNZ and FMA remarks, Key messages, 15 October 2026
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.