NYDFS Highlights Strategies To Combat AI Cybersecurity Risks

The increased use of artificial intelligence (AI) in the banking, insurance, and financial services industries has led the New York State Department of Financial Services (NYDFS or Department) to publish an Industry Letter on October 16, 2024, that highlights cybersecurity risks resulting from the use of AI, the dangers posed by threat actors utilizing AI, and strategies to address these concerns (the Guidance).

New York's Cybersecurity Requirements for Financial Services Companies regulation at 23 NYCRR Part 500 (Cybersecurity Regulation or Part 500) codifies existing cybersecurity obligations. The new Guidance does not impose additional requirements but instead outlines how the banking, insurance, and financial services companies that NYDFS regulates (Covered Entities) should use the existing framework in Part 500 to address and mitigate AI-related risks.