New Zealand’s financial regulators have told insurers and other regulated entities to strengthen their cyber defences as frontier artificial intelligence (AI) changes the speed and scale of cyber threats.
The Reserve Bank of New Zealand (RBNZ) and the Financial Markets Authority (FMA) published supervisory expectations on October 15, 2026, addressing cyber risks tied to advances in frontier AI. For brokers, the practical impact is clear: the insurers and financial institutions they work with will face increased scrutiny on how they govern AI use, manage third-party provider dependencies, and prepare for AI-enabled fraud, all of which have implications for cyber, professional indemnity, and crime policy conversations.
The guidance was delivered by RBNZ assistant governor financial stability Angus McGregor and FMA executive director response and enforcement Louise Unger at an industry roundtable in Auckland, jointly hosted with the Department of the Prime Minister and Cabinet and the National Cyber Security Centre (NCSC). It builds on existing prudential, conduct, and operational resilience obligations and focuses on three areas: increased cyber risk, evolving governance challenges, and growing third-party and concentration risk.
At the core of the guidance is a call to strengthen foundational cyber controls, with particular emphasis on identity and access management, asset lifecycle management, and timely patching.
“Today, we take the opportunity to outline our supervisory expectations specifically on the cyber risk associated with the advances in frontier AI. These build upon existing prudential, conduct, cyber, and operational resilience obligations and aim to support resilience for regulated entities and the broader financial system,” McGregor said.
The regulators noted that frontier AI has reduced the time between vulnerability discovery and exploitation and encouraged entities to accelerate risk-based patching and remediation. Legacy technology, particularly systems that are out of support, faces heightened risk. The RBNZ’s remarks acknowledged that accelerated patching carries its own operational risks and that entities should manage them accordingly.
The NCSC’s Cyber Threat Report 2026, covering the year to June 30, 2026, recorded 369 incidents of potential national significance, up from 331 the previous year. Of those, 44% were linked to criminal or financially motivated actors and 23% were attributed to suspected state-sponsored activity. Direct financial losses totalled $23.8 million.
Read more: NZ cyber threat rises as insurance market moves the other way
Unger said AI-related risk is exposing weaknesses not only in technical controls but also in governance and oversight arrangements. “Boards and senior management need to know where AI is being used in their business, understand the risks it brings, and be clear about who is accountable for managing them,” Unger said.
The FMA expects AI adoption to extend beyond operational processes into areas such as investment research, portfolio management, client communications, and financial advice. Boards should maintain visibility of where AI tools are deployed and whether governance frameworks remain effective, according to the guidance. The FMA is also conducting a thematic review of AI in financial advice, examining governance arrangements and consumer outcome implications, as Insurance Business has previously reported in its coverage of how AI advice tools are operating outside the law and the professional indemnity cover implications.
The regulators warned about the financial system’s growing reliance on a small number of AI and cloud service providers. Disruption or outages at these providers could affect multiple institutions at the same time, according to the RBNZ’s remarks. “Accountability for managing operational risks remains with regulated entities,” the guidance stated.
Entities are expected to assess how third parties use AI within their environments and whether those arrangements could introduce or amplify threats, particularly where concentration risk exists.
In June, the Five Eyes intelligence alliance, comprising New Zealand, Australia, Canada, the UK, and the US, issued a joint call to action on AI preparedness, warning that organisations should expect a rise in vulnerabilities and incidents and that cyber resilience is integral to business continuity and market confidence.
The guidance told entities to assume incidents will occur and prepare accordingly. It highlighted the need to watch for AI-enabled fraud, including deepfake impersonation, synthetic identities, and sophisticated social engineering attacks. Deepfake scams are not theoretical in New Zealand: they are already affecting consumers, as Insurance Business has reported in its coverage of how deepfake scams have hit 29% of New Zealanders and fuelled fears of AI-driven fraud.
Entities should consider whether existing fraud controls, customer verification processes, and staff awareness programmes remain effective against these threats, the regulators said.
Read more: Catch-up or pay up: New Zealand’s cyber resilience gap falls to brokers
For brokers, the regulatory expectations carry practical consequences across several lines of business. Insurers that are regulated entities will need to demonstrate stronger cyber governance, which could affect how quickly they respond to incidents and how they manage provider risk. Brokers advising commercial clients on cyber cover should note the focus on third-party concentration risk, as single-provider dependency is an area where policy wordings may not always provide clarity.
Stewart Hunt, insurance adviser at First Commercial Insurance Brokers in Auckland, has previously noted that “cyber insurance is one of the few covers where what’s not in the policy matters as much as what is.” That observation carries added weight now that regulators are spelling out expectations around AI governance, deepfake fraud preparedness, and supplier dependency, as Insurance Business recently examined in its analysis of New Zealand’s widening cyber resilience gap and the broker’s role in closing it.
“The core message today is simple: advances in AI are changing the operating environment for financial institutions. Entities are responsible for ensuring that they have the systems and controls in place to manage the risks arising from AI,” McGregor said.
The RBNZ and FMA said operational resilience remains a key supervisory focus and that they will continue engaging with regulated entities on the topic.
