NYDFS 23 NYCRR 500 AI Risk Assessment Program Cost for a Community Bank

Why NYDFS Part 500 Now Requires AI-Aware Risk Assessment

A community bank CRO with NY exposure has lived through the original Part 500 implementation, the 2023 amendment, and the certification cycles in between. The risk assessment requirement at Section 500.9 is familiar in structure. What changed in November 2023 was the addition of explicit attention to emerging risks, the expansion of governance requirements, and the broader scope NYDFS now uses when examining a Covered Entity's cyber posture.

The rule does not name AI directly in every applicable section. The risk assessment requirement is general enough that it now subsumes AI risk as part of the cybersecurity program. NYDFS examination guidance and Circular Letter 7 together signal that AI risk should appear in the risk assessment, in the third-party oversight program, and in the documentation supporting the senior officer certification.

From 23 NYCRR 500.9:

"Each Covered Entity shall conduct a periodic Risk Assessment of the Covered Entity's information systems sufficient to inform the design of the cybersecurity program."

The substance of the work is what the CRO has to size. What follows is the plain-English version of what the AI-aware risk assessment program costs at community bank scale, where the costs concentrate, and how the program integrates with existing cybersecurity governance.

What Part 500 Actually Requires From the Risk Assessment

Section 500.9 requires a periodic risk assessment that informs the design of the cybersecurity program. The amended rule expanded the requirement in three ways relevant to AI.

The first is scope. The assessment must address risks across information systems, which now includes AI systems handling sensitive data or making consequential decisions. AI in lending, fraud monitoring, customer service, or any function touching nonpublic information is in scope.

The second is governance integration. The assessment's output flows into the cybersecurity program design, the policies and procedures the Covered Entity operates, and the senior officer certification under Section 500.17. AI-related risks identified in the assessment must be reflected in the program.

The third is third-party scope. Section 500.11 covers third-party service provider security, and the risk assessment must consider third-party risks. AI vendors fall under this. The bank's vendor inventory, due diligence, and ongoing monitoring all feed into the assessment.

The rule does not specify the methodology. Each Covered Entity designs its own approach commensurate with the entity's size, complexity, and risk profile.

What an AI-Aware Part 500 Risk Assessment Costs

A community bank operating a Part 500 risk assessment program with AI integration faces five recurring cost components.

1. Assessment design and refresh. Annual or more frequent refresh of the risk assessment methodology, scope, and threshold criteria. At community bank scale, this is largely the CRO's time plus modest external input. Effective annual cost in the low five figures.

2. Evidence collection. Pulling together the inputs the assessment needs: asset inventories, AI model inventory, third-party listings, incident history, control test results, and threat intelligence. This is the largest single component and runs in the mid five figures annually depending on the bank's automation maturity.

3. Third-party AI review. Specific work to evaluate AI vendor relationships against the assessment scope. Includes vendor attestation review, contract review for AI-specific terms, and documented assessment of vendor controls. At community bank scale with three to six AI-related vendors, this runs in the low five figures annually.

4. Documentation. The risk assessment report itself, the supporting evidence package, and the linkages from assessment findings to program changes. NYDFS examinations look at documentation depth, so the work here is substantive. Effective annual cost in the low five figures.

5. Board and certification support. The bank's senior officer signs the annual certification. The risk assessment is part of the documentation supporting that certification. Board reporting on the assessment, board minutes capturing oversight, and the certification preparation all consume time. Modest dollar cost; meaningful time cost for the CISO, CRO, and signing officer.

The all-in annual run-rate for an AI-aware Part 500 risk assessment program at community bank scale is in the mid five figures to low six figures.

What the AI-Specific Assessment Work Actually Captures

For each AI system in scope, the assessment captures specific information.

• The AI system's purpose, intended use, and the decisions it informs or makes. This frames the consequential nature of the system.

• The data the AI consumes, including any nonpublic information, and how that data flows. This connects to Section 500.15's encryption requirements and broader data protection obligations.

• The AI's provider relationship. Internal, vendor-supplied, or hybrid. Vendor-supplied AI triggers the Section 500.11 third-party service provider requirements with AI-specific depth.

• The AI's failure modes. What happens if the model produces wrong outputs, if the model drifts, or if the model becomes unavailable. The assessment frames these as cyber risks even when they are also model risks.

• The AI's compliance touchpoints. Whether the AI affects credit decisions, AML programs, or other regulated functions. This connects to other regulatory frameworks the bank also operates under.

The output is a documented assessment that gives the cybersecurity program enough detail to design controls, allocate budget, and respond to incidents.

Three Places Part 500 Risk Assessment Programs Fall Short on AI

Three patterns repeat in community bank examination findings.

The first is the AI inventory gap. The bank's asset inventory does not include AI systems, or includes them only at a generic level. The assessment cannot address risks for systems that are not listed.

The second is the third-party AI depth gap. The bank's third-party listing includes the AI vendor but does not capture model-specific risks. The Section 500.11 documentation is generic where it should be specific.

The third is the governance flow gap. The assessment surfaces AI risks but the program does not show how those findings flowed into control changes, policy updates, or board reporting. The assessment exists; the program does not reflect it.

What the CRO Controls in the AI-Aware Part 500 Program

The CRO controls four things in the AI-aware Part 500 program.

The first is the assessment scope. Whether to address AI as a distinct risk category, as a thread across categories, or both. The CRO sets the methodology.

The second is the integration with cybersecurity governance. The CISO operates the cybersecurity program, but the risk assessment that informs it is typically owned by the CRO or a partnership between CRO and CISO. The CRO ensures the assessment produces inputs the CISO can use.

The third is the third-party AI work. The CRO coordinates with the vendor management function to ensure AI vendor relationships receive the depth the rule expects.

The fourth is the certification support. The CRO ensures the assessment work product is robust enough to support the senior officer certification under Section 500.17.

Why "AI Risk Belongs in Model Risk, Not Cyber" Misreads Part 500

Somewhere in the program conversation, the CRO will hear this argument. Part 500 is a cybersecurity rule. AI risk belongs in the model risk program. Combining them duplicates effort.

That is a false choice. Part 500's risk assessment requirement is broad by design. The rule does not separate cybersecurity from other risk categories. AI risks that affect information systems, sensitive data, or consequential decisions are cybersecurity risks under Part 500, whether or not they are also model risks under SR 11-7.

The right framing is not whether AI risk is "really" cyber or "really" model. It is whether the bank's documented risk assessment addresses AI in a way examiners can verify. The first framing produces a fragmented program. The second framing produces an integrated one.

Three Things to Have Before the NYDFS Examination

A community bank CRO should work through three things before the next NYDFS examination cycle. The first is a current-state inventory of every AI system in scope for Part 500, with provider relationship, decision impact, and data flow documented. The second is an updated risk assessment methodology that captures AI-specific risks alongside traditional cybersecurity risks. The third is a calendar discipline for assessment refresh, certification support, and board reporting that produces the documentation NYDFS examiners ask for.

When this discipline is in place, the cybersecurity examination conversation moves from "address your AI risk in the assessment" to "review the program's most recent outputs," and the gap between those two postures is the gap between a finding and a routine confirmation.

Refresh the Part 500 Risk Assessment to Cover the AI Footprint

A community bank CRO operating an AI-aware Part 500 risk assessment program is operating the program the November 2023 amendment expanded the rule to expect. The cost is moderate at community bank scale. The discipline is what makes the program credible to NYDFS examiners and meaningful in practice.

If your bank has not refreshed its Part 500 risk assessment to address the bank's current AI footprint in the last twelve months, that is the conversation worth having with your Tech-Operations partner before the next examination cycle.

Five Nines Technology Group is a Tech-Operations partner for community banks and credit unions. Translating regulatory frameworks into operating discipline at community bank scale is where our team focuses.