NYDFS issues guidance on cybersecurity risks arising from AI

The New York State Department of Financial Services (NYDFS) issued an industry letter on 16 October 2024, Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks. It explains how regulated entities should apply the existing Part 500 cybersecurity regulation to AI-related cyber risk.

What it is

The letter creates no new obligations beyond 23 NYCRR Part 500. It singles out four threats: AI-enabled social engineering, which it calls one of the most significant threats to financial services; AI-enhanced cyberattacks that gain potency, scale and speed; exposure or theft of the large data sets AI products collect; and vulnerabilities in third-party and supply chain dependencies.

What it requires

The controls the letter highlights, all framed through Part 500, include:

• risk assessments that cover AI used by service providers and vendors and weaknesses in AI applications, refreshed at least annually;

• authentication that deepfakes cannot fake, such as digital certificates and physical security keys instead of SMS, voice or video, with multi-factor authentication required for all Authorized Users as of November 2025;

• training on AI risks for all personnel, senior executives and board members included;

• monitoring AI tools for unusual queries that might signal attempts to extract nonpublic information, and blocking queries that could expose it to public AI products;

• an inventory of information systems that use or rely on AI, with mitigations prioritized for business-critical ones.

What security leaders should do

• Even outside New York financial services, use the letter as a compact AI control checklist that maps onto an existing cyber program.
• Replace call-back verification for payment requests with phishing-resistant factors or out-of-band checks that a cloned voice cannot pass.
• Add AI questions to third-party due diligence: what AI the provider runs, what threats it faces and how it protects your data.
• Log prompts to sanctioned AI tools and filter regulated data before it leaves the network.