The Reserve Bank and Financial Markets Authority issued a joint statement yesterday on the risks associated with advances in frontier AI, with particular attention to cybersecurity.
The accompanying speech also addresses board accountability, proportionality, oversight of third-party providers and the adequacy of existing risk management arrangements.
One passage caught my attention. FMA Executive Director Louise Unger refers to the role of appropriate independent assurance in confirming that controls are properly configured and operating as intended.
An organisation may have established governance arrangements, defined responsibilities and controls that were appropriate when they were introduced. As its use of AI expands, or it begins relying on AI for more consequential activities, the assumptions underlying those arrangements may change.
I would expect management to explain what has materially changed, whether existing arrangements remain adequate and what evidence supports that assessment. This includes evidence that the material controls being relied upon are operating as intended.
Independent assurance has a role where the significance of the exposure justifies it. A review against defined criteria can provide an objective assessment of governance adequacy and the effectiveness of existing controls.
The regulators are applying existing obligations, with expectations proportionate to each institutions circumstances. For boards, the practical starting point is to establish whether changes in organisational reliance on AI warrant a reassessment of existing arrangements, and to ensure that any decision is supported by evidence.
Source: RBNZ/FMA, Supervisory expectations on cyber risk associated with frontier AI, 15 October 2026.