AI Governance Expectations on the Rise for Insurers Amid New Regulatory Activity

Ah, the New York Department of Financial Services has issued an advisory warning that frontier AI models 'may amplify the potency, scale, and speed' of threat actors. Because nothing says 'decisive action' like a politely worded suggestion that something bad might happen. Insurers, who have spent years treating AI governance as a box-ticking exercise, are now expected to 'enhance their governance frameworks'—presumably by adding a few more bullet points to the same dusty risk register.

Let's not pretend this is new. The advisory is essentially a regulatory memo telling insurers that the sky might be falling, but please don't stop paying premiums. The specific threat vector? Frontier models helping threat actors 'identify vulnerabilities and exploits' faster than ever. As if insurers weren't already behind on patching their own systems. The DFS might as well have said: 'Hey, remember that fire? It's getting bigger. Carry on.'

The real joke is that this advisory carries no new enforcement teeth. It's a finger-wag, not a fist. Meanwhile, frontier labs keep releasing models with capabilities their own safety teams can't fully characterise. But sure, let's ask insurers to be more 'proactive'—because that's worked so well for data privacy, cyber resilience, and every other regulatory warning of the last decade.