23 NYCRR Part 500, the Two AI Letters, and the CEO and CISO Certification
The one-paragraph answer
NYDFS Part 500, codified at 23 NYCRR Part 500, is the binding cybersecurity regulation for every entity that holds a New York financial-services licence. The Second Amendment finished phasing in on November 1, 2025. There is no grace period left. The Department has issued two AI industry letters, one on October 16, 2024 (cybersecurity risks arising from AI) and one on May 21, 2026 (frontier AI models); neither adds a new requirement. They tell covered entities how Part 500 already applies to AI use. The obligations that matter for AI are the ones a covered entity already runs: risk assessment under 500.9, third-party service provider policies under 500.11, access controls under 500.7 and MFA under 500.12, audit trails and monitoring under 500.6, data inventories under 500.13, training under 500.14, incident response under 500.16, and 72-hour notification under 500.17. The item most firms are still catching up to is the annual certification under 500.17(b): both the CEO and the CISO must personally sign, and the certification now attests to material compliance with the whole regulation, not merely to the completion of a self-assessment. AI-related cyber risk is inside that scope.
A New York-licensed insurer stands up an AI underwriting assistant. The vendor's SOC 2 is current, the contract has a security addendum, procurement signs. Nine months later NYDFS asks how AI-related cyber risk is addressed in the annual risk assessment under Section 500.9, and the answer that comes back is that the risk assessment was completed before the AI deployment and has not been updated. That is a 500.9 violation. The section requires the assessment to be updated when information systems or the business change materially. Deploying an AI system against nonpublic information is a material change.
The same insurer's third-party service provider policy under 500.11 lists the AI vendor and its SOC 2. It does not address what the vendor does with the insurer's data during training, whether the vendor's subprocessors have access, or how the insurer will be notified if the vendor's own model store is compromised. The October 2024 letter said all three of those need to be in the diligence.
Part 500 applies to "Covered Entities," defined as any person operating under a licence, registration, charter, certificate, permit, or similar authorisation under the New York Banking Law, Insurance Law, or Financial Services Law. That reach is broader than "banks in New York": it includes insurance producers, money transmitters, virtual currency licensees, and any out-of-state entity that touches a New York licence.
The regulation is a full cybersecurity program mandate, not a rule about specific controls. It requires a written cybersecurity policy, a designated CISO, annual penetration testing and biannual vulnerability assessments, MFA on all information systems, encryption of nonpublic information, incident response and business continuity plans, and a workable third-party service provider program. The Second Amendment (effective November 1, 2023) added the CEO-plus-CISO certification, ransomware-payment notice duties, an asset inventory requirement, and elevated obligations for "Class A Companies" (large covered entities defined at Section 500.1(d)).
The letters are the piece the field gets wrong, so this section says it plainly. Neither letter creates a new AI compliance program under Part 500. Both are advisory, and both direct covered entities to fold AI-related threats into the existing Part 500 program.
October 16, 2024: "Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks." This letter names four AI-related cyber risk areas: (a) AI-enabled social engineering, especially deepfakes, called out as one of the most significant risks to the sector; (b) AI-enhanced cyberattacks; (c) exposure and theft of large amounts of nonpublic information used to train AI models; and (d) increased third-party and supply-chain vulnerabilities. It then walks through the Part 500 sections that already require covered entities to address each: 500.9 (risk assessment), 500.11 (third-party), 500.7 and 500.12 (access controls and MFA), 500.14 (training and monitoring), 500.13 (data minimisation and inventory).
May 21, 2026: Industry letter on frontier AI models. Advisory only. Same posture: how existing Part 500 obligations apply to frontier-scale deployments. It does not add a control family and does not add a deadline.
The letters are a sharper instruction than a new AI rule would be, because they remove the argument that AI is unregulated until a dedicated standard appears. The existing controls apply, and the Department has told covered entities exactly which sections do the work.
AI-enabled social engineering. Deepfake voice and video have made vishing and executive impersonation dramatically more effective. Multi-factor authentication under 500.12 is the frontline control, but the Department also expects covered entities to consider liveness detection where biometric factors are used, and to update training programmes under 500.14 so employees know what an AI-generated attack looks like.
AI-enhanced attacks. Threat actors can now use AI at every stage of the attack chain, from reconnaissance to malware generation to post-exploitation. Monitoring under 500.6 must be sensitive to the new tempo.
Theft of nonpublic information. An AI system that requires large training or context data becomes a larger target, both because it holds more data and because model store compromise can reveal the data indirectly. Data minimisation under 500.13 becomes a live operational control rather than a policy statement.
Third-party and supply chain. The October 2024 letter said this is one of the most important AI-related controls. The covered entity must consider not only the vendor's own security but the vendor's use of AI, including whether the vendor's training or inference operations create new attack surface that the covered entity inherits.
Section 500.17(b) requires an annual certification by both the highest ranking executive and the CISO. As amended, the certification attests to "material compliance with this Part" during the prior calendar year. AI-related cyber risk is inside "this Part." A CEO or CISO who signs a certification without evidence that AI risk was inside the risk assessment, the vendor program, and the training programme is signing something they cannot defend. This is the piece that has moved AI from an IT topic to a board-level topic on this regulation. When the sign-off is personal, the review is personal.
Financial institutions in the U.S. face increasingly complex cyber threats and regulations, and artificial intelligence has significant potential for real-time threat detection, automated compliance processes, and proactive risk management, but its deployment must contend with ethical considerations, data privacy concerns, and potential biases in AI algorithms.
NYDFS did not need a new rule to require this because Part 500 already requires the risk assessment to catch the ethical, privacy, and bias exposure surface. The 2024 letter connected them, section by section.
Effective and manageable AI/ML in production requires a risk-based governance and testing framework that addresses model behaviour, data quality, and third-party dependencies as an ongoing programme, not a point-in-time control.
No. Neither the October 2024 letter nor the May 2026 letter adds a deadline. Existing Part 500 deadlines apply. The Second Amendment's final phase-in date was November 1, 2025, and the annual 500.17(b) certification cycle continues from there.
No. It applies to every entity operating under a licence, registration, charter, or similar authorisation under New York Banking, Insurance, or Financial Services Law. That includes insurance producers, money transmitters, and virtual currency licensees.
Not because Part 500 requires one. A separate policy can be useful, but the regulation attaches AI to the existing cybersecurity policy under 500.3, the risk assessment under 500.9, and the third-party program under 500.11. What matters is that the existing artefacts name AI specifically and produce evidence a Department examiner can inspect.
The Volume V engagement produces the exact artefacts the 500.17(b) certification requires: an AI-aware 500.9 risk assessment, a 500.11 vendor programme reaching AI vendors as AI vendors, a 500.13 asset inventory that catches consumer-grade tools, and a training curriculum under 500.14 that addresses AI-era social engineering. See Volume V: The AI IT Security Audit.
The AI Business Enablement Audit™ measures your organization against every framework in this library, including NYDFS Part 500, and delivers a defensible governance dossier. Start or finish your audit below.
Start or finish your AI Audit →