Within one week in May 2026, two prudential regulators named the same emerging risk.
On 11 May, PRA chief executive Sam Woods warned that the latest AI models, including Anthropic’s Mythos and ChatGPT 5.5 Instant, could cause what he called “quite significant disruption” to financial services.
His core concern: AI models are becoming better at finding vulnerabilities, forcing banks to patch at speed. That pressure is now “the main driver of outages” in the financial system.
In the same week, the RBNZ said frontier models such as Mythos “could materially amplify cyber risks” and confirmed it is actively monitoring the threat.
This is no longer a future-risk debate. Frontier AI is entering the operational resilience frame.
NZ financial services firms are already operating under multiple reporting regimes:
- RBNZ-regulated banks, non-bank deposit takers, and insurers must report material cyber incidents within 72 hours.
- Some FMA-regulated entities must notify material operational resilience incidents affecting critical technology systems.
- Serious privacy breaches must be reported to the Privacy Commissioner and affected individuals as soon as practicably able.
For trans-Tasman entities, APRA CPS 230 and CPS 234 raise the bar again.
An AI-developed exploit compromising customer records may start several regulatory clocks at once.
The question is simple: can you find, fix, evidence, and explain the issue before the reporting clock runs out?
We broke down the full regulatory picture in our latest white paper. Get in touch and I’ll send you a copy.
