On October 16, 2024, the New York State Department of Financial Services (NYDFS) issued groundbreaking guidance addressing the cybersecurity risks of artificial intelligence (AI). The guidance highlights the dual-edged nature of AI in financial services—offering unparalleled opportunities for efficiency and growth while introducing sophisticated cyber threats. As AI technologies evolve, so do the tactics of cybercriminals, necessitating a robust and integrated approach to risk management.

The DOJ's updated guidance is critically important for U.S. companies right now because it underscores the necessity of a unified and strategic approach to risk management. It emphasizes the design and implementation of effective compliance programs and their practical application and continuous evolution in response to emerging risks. Failure to align with this guidance could result in severe penalties, reputational damage, and loss of stakeholder trust.

IRM transcends traditional risk management by incorporating GRC into the domains of ERM, ORM, and TRM, ensuring that governance and compliance are not isolated but integrated with all risk management activities. This comprehensive approach is crucial in an era where banking innovations such as digital platforms, and products like Buy Now Pay Later (BNPL) and Earned Wage Access (EWA), are rapidly evolving. These innovations, while beneficial, introduce complex compliance and operational risks that require an integrated approach to manage effectively.