Key Takeaway: Businesses need a clear understanding of how Frontier AI changes their risks, and practical evidence that they can respond. Through KiwiGen.AI and our newly launched Incident Arena 2026 cyber crisis simulation, we help firms connect AI adoption and governance with incident preparedness, informed decisions and improvements in cyber maturity.
New Zealand’s Reserve Bank and Financial Markets Authority have outlined supervisory expectations for cyber risks associated with Frontier AI. Their announcement on 15 October places greater emphasis on governance, third-party dependencies and operational resilience. Boards and senior management are expected to understand where AI is being used, the risks it introduces and who is accountable for managing them.
These expectations are directed at regulated financial entities, but the business questions extend further. Does your leadership team understand its exposure? Could the firm continue operating if a critical technology provider failed? Would your people recognise and respond effectively to an AI-enabled incident?
Understanding the risk requires practical expertise
Frontier AI refers to the most advanced AI systems and their evolving capabilities. For businesses, understanding the risk means looking at both how the organisation uses AI and how others could use it against them.
A firm may be introducing AI to improve research, document preparation or client service while also facing more convincing impersonation attempts and faster cyberattacks. Its suppliers may be embedding AI into services on which it already depends. These changes require informed decisions about information access, human oversight, verification and recovery.
Working with experts who understand AI helps turn broad concerns into specific actions. Leadership needs advice that connects the technology with the firm’s people, client obligations and operations. An AI policy is useful, but it must be supported by a clear understanding of what could go wrong and how the business would respond.
KiwiGen.AI: Supporting professional services firms
Our dedicated Generative AI website, KiwiGen.AI, supports professional services firms with AI adoption, governance and risk management. It brings together practical guidance to help firms identify useful applications, establish appropriate controls and make better-informed decisions as the technology develops.
Our article, New Zealand Regulators Raise Expectations for AI Governance and Cyber Resilience, examines the announcement and its implications for leadership oversight, supplier concentration and incident preparedness.
One practical question deserves particular attention: are apparently separate services dependent on the same underlying AI or cloud provider? Understanding that dependency helps firms assess whether their alternatives would remain available during a disruption.
International attention is turning to crisis exercises
The importance of testing is also receiving international attention. As covered in our article, G7 Countries Agree to Conduct Cyber Crisis Exercises Focused on AI-Enabled Attacks, G7 finance leaders have agreed to coordinated simulations examining how financial authorities respond to AI-enabled cyberattacks.
The initiative will test response procedures and coordination, with findings used to improve preparedness. For businesses, the practical lesson is straightforward: a documented plan needs to be tested against the speed, uncertainty and dependencies that could shape a real incident.
We have launched Incident Arena 2026
We have launched Incident Arena 2026, our new facilitator-led cyber incident response game. Your team works through an unfolding incident on one shared screen, discussing options and making collective decisions under time pressure. Five live health dials make the consequences visible, giving the room a shared basis for discussing priorities and trade-offs.
The exercise brings familiar leadership questions into focus. What needs attention first? Who can authorise expenditure? When should the organisation communicate? What can it afford to delay?
From new guidance to a dedicated exercise
Following the regulators’ publication, we immediately developed a dedicated Frontier AI module for financial entities in Incident Arena. The module offers 50 unique gameplay variations for each of three sectors: banks, investment providers and insurers, providing 150 variations in total, with adjustable severity levels, budgets, investment choices and other exercise options.
That flexibility allows us to adapt the challenge to the team and explore how different constraints affect its decisions. A response that appears manageable with sufficient resources may become considerably harder when the budget is tighter or the incident more severe.
From scenario selection to decisions, consequences and results: the dedicated Frontier AI module for Investment Providers in “Incident Arena 2026” by Incident Response Solutions.
Use the exercise to improve cyber maturity
The value lies in what the team learns and changes afterwards. An exercise can expose unclear responsibilities, untested assumptions and competing priorities before a real incident forces those issues into the open.
A facilitated debrief helps turn those observations into agreed improvements. Repeat exercises then provide opportunities to assess whether the team has addressed its gaps and strengthened its decision-making.
To discuss AI adoption, governance or a tailored Incident Arena exercise for your firm, contact Incident Response Solutions or email support@incidentresponse.co.nz.
