NYDFS names AI adoption as a cybersecurity risk factor

The September 10 industry letter says significant AI-related developments can count as material changes to cyber risk under Part 500.

NYDFS issued an Industry Letter on September 10 instructing regulated entities on cybersecurity risk assessments under Part 500. The letter names adoption or use of artificial intelligence among emerging risks and states that significant AI-related developments may constitute material changes to cyber risk.

The source's own statement, as linked above. Nothing beyond it has been independently checked by us.

This is not a new rule requiring a specific AI control. It is guidance interpreting an existing risk assessment obligation.

Carriers domiciled or licensed in New York should fold AI adoption, including vendor AI tools, into the risk assessment already required under Part 500.

• Add AI adoption and vendor AI use as a line item in the next Part 500 risk assessment
• Flag material AI changes to the person who signs the annual certification

Milliman launches an AI Solutions practice for insurance clients