NYDFS ties AI risk to cyber assessment obligation
The guidance doesn't impose new rules, but it tells examiners exactly where to look, and NYDFS has already found the gaps it's flagging.
TL;DR
NYDFS issued Sept. 10 guidance clarifying that annual cyber risk assessments under its 2017/2023 cybersecurity regulation must consider whether AI adoption, quantum computing advances, supply-chain attacks, ransomware evolution, and geopolitical conflict materially alter a firm's risk profile. The guidance does not create new obligations but identifies common gaps NYDFS has already observed during examinations, including failure to account for emerging technologies and concentration risk from third-party dependencies. Covered entities range from banks and insurers to their service providers.
The New York Department of Financial Services has published guidance that, while technically imposing no new requirements, draws a direct line from AI adoption to the mandatory annual cyber risk assessment every regulated financial services entity must perform under the state's cybersecurity regulation.
The Sept. 10 letter tells covered entities that risk assessments "should consider whether emerging technologies or changes in the threat environment materially affect their risk profile. Examples may include the adoption or use of artificial intelligence, advances in quantum computing that may affect future cryptographic protections, increasing software supply chain attacks, evolving ransomware techniques, and significant geopolitical tensions or conflict that result in increased nation-state cyber activity."
This is the first time NYDFS has explicitly folded AI risk evaluation into assessment guidance tied to the 2017 regulation and its 2023 amendments. It isn't a standalone AI advisory. It's an instruction on how to satisfy an existing obligation. The distinction matters: a firm that omits AI from its next assessment isn't ignoring guidance, it's arguably failing to meet the regulation's requirement that assessments account for material changes to risk.
What examiners have already found
NYDFS didn't write this guidance in a vacuum. The letter states that during examinations and investigations, the department has identified "common gaps in Risk Assessments which, in turn, have contributed to deficient cybersecurity programs." Among those gaps: "failure to account for evolving and interconnected risks, including emerging technologies, changes in the threat landscape, interdependencies, concentration risk, and single points of failure."
The guidance effectively publishes the examiner's checklist. It flags third-party concentration risk (multiple critical functions depending on the same cloud provider, managed service provider, or software platform) and instructs firms to evaluate how AI adoption changes threat exposure, data risks, access controls, and third-party dependencies. A vendor that looked low-risk in isolation may look different when it's supplying AI capabilities across three business-critical functions.
What the guidance doesn't say
NYDFS stops short of stating that failure to assess AI risk constitutes a standalone violation. The framing is careful: the guidance "does not impose new obligations" and is meant to "clarify regulatory requirements" and "share best practices." That leaves open whether NYDFS would cite an AI-blind assessment as a regulatory violation or as evidence supporting a broader deficiency finding, a distinction with real enforcement implications. The department's recent track record ($19 million in penalties against eight auto insurers in October 2025 for cybersecurity regulation violations) suggests it's willing to pursue enforcement when exam findings reveal systematic gaps.
The guidance also ties together threads NYDFS has pulled separately before: a May 2026 advisory on frontier AI model risks and a June 2025 letter on cyber resilience amid geopolitical conflict. This latest letter doesn't merely reiterate those. It places them inside the assessment framework, treating them as inputs a covered entity must weigh when determining whether its risk profile has materially changed.
Published ·Deep Fathom