NYDFS wrote no AI rule, and made AI risk part of what the CEO certifies

The week

On October 16, 2024, the New York State Department of Financial Services issued an industry letter titled “Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks”. Addressed to the banks, insurers and other entities it regulates, the guidance said it imposed no new requirements. It explained how the existing cybersecurity regulation, 23 NYCRR Part 500, applies to AI. It named four risks: AI-enabled social engineering, including deepfakes; AI-enhanced cyberattacks; the exposure created by large volumes of nonpublic information collected for AI; and dependence on third-party AI providers. It then described how risk assessments, third-party oversight, access controls, training, monitoring and data management should account for them. The letter arrived midway through the phased implementation of the November 2023 amendments to Part 500, with universal multi-factor authentication due by November 2025.

Guidance that says it creates no new obligations is easy to file and forget. This letter deserved more attention because of how Part 500 works after its 2023 amendments. Each April, a covered entity must certify compliance, or acknowledge noncompliance, in a document signed by its highest-ranking executive and its CISO. By stating that AI risks fall inside existing Part 500 obligations, the letter put them inside that signature. An institution that has not addressed AI-driven risks in its risk assessment, access controls or vendor oversight has a certification problem, not merely a policy gap.

The letter’s four risks form a clean frame. Two describe how attackers use AI against the institution: social engineering and enhanced attacks. Two describe exposure the institution creates through its own AI use: concentrated data and dependence on AI vendors. Every AI-related cyber risk an institution faces sits on one side of that line or the other. For each, the useful question is what evidence the signers could show an examiner.

AI-enabled social engineering: evidence that a human is never the only authenticator

The letter treated deepfakes in audio, video and text as the most significant threat. Any step that relies on recognizing a voice or face, or on a convincing message, is weakened. That covers callback verification to an executive whose voice can be cloned, video calls used to approve payments, and help desk resets granted to a plausible caller.

The letter encouraged authentication that resists AI impersonation, such as digital certificates and physical security keys, and cautioned against relying on SMS, voice or video alone. Part 500’s multi-factor authentication requirement, expanding to all users by November 2025, provides the hook. The evidence an examiner would expect is an inventory of processes where a person is the authenticator, with the added factor documented for each: payment approvals, vendor bank-detail changes, privileged access requests and help desk resets. A process missing from that inventory is the likeliest place for a deepfake to succeed.

AI-enhanced attacks: evidence that fundamentals run faster

AI helps attackers find vulnerabilities, write exploit code and tailor lures faster and at greater scale. For the most part it does not create new classes of weakness. The defensive consequence is that existing controls, patching, vulnerability management, logging and monitoring, must run on shorter cycles.

Here the evidence is metrics. Time to patch internet-facing systems, by severity. Frequency of vulnerability scanning. Time from alert to containment. If those numbers have not changed since attackers adopted AI tooling, the risk assessment should explain why. The letter also acknowledged that institutions can use AI for detection and response. Doing so is welcome, but those tools then need the same access controls, change management and monitoring as any other system with privileged visibility.

Data concentration: evidence that AI data stores are inside the perimeter

Training, fine-tuning and retrieval often involve copying large volumes of nonpublic information, sometimes including biometric data. The resulting stores are attractive targets, and data science teams often build them quickly, outside normal controls.

Part 500 already requires an asset inventory, access controls, data retention limits and secure disposal. The letter asked institutions to apply them to AI data. Evidence would start with AI datasets and vector stores listed in the asset inventory, each with a named owner. Access lists should be reviewed on the same cycle as other sensitive systems. Retention rules should cover training copies and prompt logs, which often hold customer data that nobody meant to keep. Biometric templates deserve particular care, because a stolen template cannot be reissued the way a password can.

Third-party dependence: evidence that AI vendors are in the vendor program

Most institutions use AI through vendors, from cloud model providers to software products with embedded AI features. Each brings data access and a dependency that may be hard to replace. The letter asked institutions to apply their third-party service provider policies to AI vendors, including due diligence, contractual protections and notice of cybersecurity events.

The questions are familiar but sharper. What data does the vendor see? Does it retain or train on that data? Where is it processed? What happens to operations if the vendor fails or changes its model? The evidence gap is often contractual. Many AI services are used under click-through terms rather than negotiated agreements, which leaves the institution without notice rights or audit access. A list of AI vendors with the contract type for each shows an examiner, and the signers, where that gap sits.

Board reporting closes the loop. The amended rule expects the board, or a committee, to have sufficient understanding of cyber risk to oversee it. A short annual briefing on these four risks, with the metrics above, gives directors a basis for the oversight the rule expects and gives the signers a record that the board was informed.

The four sections together describe a certification file. An institution that can produce it is in a stronger position than one with an AI policy that sits apart from its cybersecurity program.

With hindsight

The letter aged well because it did not depend on any particular technology. FinCEN issued its own alert on deepfake fraud schemes the following month, reinforcing the authentication point, as a later article in this series discusses. NYDFS kept enforcing Part 500. In January 2025 it entered a consent order with PayPal over Part 500 failures linked to a 2022 credential-stuffing incident, a reminder that multi-factor authentication gaps were an enforcement matter. The November 2025 deadline for universal multi-factor authentication arrived as scheduled. In October 2025 NYDFS issued a further industry letter on managing third-party service providers, which again added no rules but stressed that compliance cannot be delegated to a vendor. With federal AI policy shifting toward fewer prescriptive requirements in 2025, state regulators and existing rules remained the main source of supervisory expectations on AI risk in financial services.