NYDFS has no single rule for AI agents. It applies what it already enforces: its cybersecurity regulation, its guidance on cyber risks created by AI, and, for insurers, its expectations on AI in underwriting and pricing. An agent with credentials to your systems is a privileged user, and often a third-party service, so those rules reach it directly.
What does NYDFS require, in plain words?
The New York State Department of Financial Services supervises banks, insurers, money transmitters and other firms operating under New York's banking, insurance and financial services laws. Three sets of expectations matter for agents.
Its cybersecurity regulation. Covered firms must run a cybersecurity programme based on a risk assessment, appoint a senior person responsible for it, limit and review access privileges, use multi-factor authentication, keep an inventory of information assets, oversee the security of third-party service providers, keep audit trails, notify NYDFS of qualifying cybersecurity events, and have senior officers certify compliance each year.
Guidance on AI-related cyber risk. NYDFS has told regulated firms that AI raises the risk of AI-enabled social engineering and attacks, increases the exposure of the nonpublic information AI systems hold, and deepens dependence on third parties. It expects risk assessments, access controls, vendor oversight and training to take AI into account.
Expectations for insurers using AI. For underwriting and pricing, NYDFS expects insurers to govern AI systems and external data, test for unfair discrimination, explain adverse decisions, and oversee vendors that supply models or data.
Who does it apply to?
Firms holding a New York charter, licence or registration under the state's banking, insurance or financial services laws. That includes many out-of-state and foreign firms with a New York branch or licence. Federal regulators may supervise the same firm at the same time; our overview of who regulates AI agents in financial services explains the overlap.
What does this mean when the system is an agent that acts?
NYDFS rules were written for people and software, not for agents. Applied to an agent, four things follow.
The agent is a user with privileges. It logs in, reads nonpublic information and changes records. Access privileges must be limited to what each capability needs and reviewed like any privileged account. An agent that can read every customer file because it was easier to set up fails the least-privilege expectation.
Its actions belong in the audit trail. The regulation expects records sufficient to detect and respond to cybersecurity events. For an agent, that means every action, the data it used and who approved it, not just a login record.
The agent platform is a third-party service provider. If a vendor's platform holds your nonpublic information or connects to your systems, your third-party security policy applies: due diligence, contract terms on access and incident notice, and periodic assessment.
Agents create new attack routes. An agent that reads incoming emails or documents can be manipulated by instructions planted in them. NYDFS's AI guidance names social engineering as a heightened risk; for agents, the defence is that untrusted content can never authorise an action.
Take an illustrative case. A New York money transmitter runs an agent that answers customers and updates their contact details. Its cybersecurity team adds the agent to the asset inventory, gives it access only to contact records, requires a person to approve any change to a phone number linked to two-factor codes, and logs every update with the source of the request. A fraud attempt using a forged email is refused because the email cannot authorise the change.
How do you meet NYDFS expectations for agents?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Risk assessment covering AI | Agent capabilities assessed for cyber and data risk | Updated risk assessment |
| Access privileges | Each agent capability limited to the systems and data it needs | Access scope per agent; periodic access reviews |
| Asset inventory | Agents, their credentials and connections listed | Inventory entries |
| Audit trail | Every agent action logged with data used, verdict and approver | Append-only action log |
| Third-party service providers | Agent platform and model provider assessed and contracted | Due diligence file; contract terms |
| Social engineering defences | Untrusted inputs cannot trigger high-risk actions | Refused verdicts citing source |
| Incident response | Agent misuse covered in incident plans and notification decisions | Incident records |
| Insurer AI governance | Testing for unfair discrimination; explanation of adverse decisions | Fairness test results; decision notices |
| Annual certification | Agent controls included in evidence for senior officers' sign-off | Certification file |
What will an examiner ask?
- Which agents have access to nonpublic information, and what can each one change?
- Show us the audit trail for an agent action last month.
- How did you assess the agent platform as a third-party service provider?
- How would you detect an agent being manipulated by a fraudulent email?
- For insurers: how do you test agent-assisted underwriting or claims decisions for unfair discrimination?
What does NYDFS not cover?
It does not regulate AI as such, and its cybersecurity rules do not tell you what decisions an agent may make for customers. Federal privacy law under GLBA applies alongside it; see GLBA and AI agents handling customer financial data. Federal bank regulators, consumer protection law and fair lending law also apply. Firms operating in several markets will meet different regimes again, such as ASIC's approach to agents in Australia. For the full map, see our guide to AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme keeps an agent's privileges narrow and its trail complete. Each capability carries its own depth and the customer's limits; every action meets the minimum chain; and every verdict is filed in an append-only record. Facts arrive labelled by provenance, so a forged email is external and cannot authorise a change to a customer's account.
Questions people ask
Does the NYDFS cybersecurity regulation require multi-factor authentication for agents?
The regulation requires multi-factor authentication for access to information systems, with limited exceptions. Agents typically authenticate with service credentials rather than people's factors, so firms should document how agent credentials are protected, scoped and rotated, and why that meets the requirement.
Is an agent platform vendor a third-party service provider under NYDFS rules?
If it holds or can access your nonpublic information, or connects to your information systems, it is likely to be. Treat it under your third-party security policy and record why.
Do NYDFS expectations on AI apply to banks as well as insurers?
The cybersecurity regulation and AI cyber guidance apply to all covered firms. The specific expectations on AI in underwriting and pricing are directed at insurers, though their logic on fairness testing is useful for lenders too.