New York: NYDFS issues guidance on AI cybersecurity risks

The New York Department of Financial Services (NYDFS) issued guidance on October 16, 2024, for entities under its jurisdiction to assess and mitigate AI-related cybersecurity risks, without imposing new requirements but clarifying that AI risks should be considered under existing cybersecurity regulations. The guidance outlines specific AI-related threats, such as AI-enabled social engineering and AI-enhanced cyberattacks, and recommends controls and measures for mitigating these threats, including risk assessments, third-party management, access controls, cybersecurity training, and data management. It also discusses the broader implications of AI use in financial services and notes the trend of regulatory scrutiny and enforcement, highlighting actions by other states and federal agencies to manage AI risks in the financial sector.