New York updates third-party risk guidance, adds AI provisions

New York’s Department of Financial Services issued clarifications to its Part 500 cybersecurity regulations for financial institutions, reinforcing third-party risk management and adding guidance on AI usage in vendor contracts without creating new obligations. Expert commentary highlights potential pitfalls of overly restrictive AI clauses and underscores the need for executive awareness of third-party risks amid evolving technology landscapes and recent large provider outages.