New Zealand's regulated entities are talking about AI. Almost none of them say who owns the risk.

On 15 October 2026 the Reserve Bank and the Financial Markets Authority set out what they expect of boards on artificial intelligence. In the FMA's words, boards and senior management “need to know where AI is being used in their business, understand the risks it brings, and be clear about who is accountable for managing them”.

We asked how much of that an outsider could already see. On the public record, accountability is the part that is missing.

The expectations do not require anyone to publish anything, so this is a question about visibility, not compliance.

We read the governance-bearing documents of every New Zealand-incorporated registered bank and licensed non-bank deposit taker, and of samples of insurers and FMA-licensed entities, for the two latest reporting periods before the expectations were stated. That meant disclosure statements, annual reports, climate statements, sustainability reports, charters and privacy statements. Each was coded against six stages taken from the regulators' own wording: where AI is used, what risk it brings, who owns it, how it reaches the board, whether it sits within risk appetite, and what assurance exists. A blind second coding reproduced 92.3 per cent of 156 stage-level codes.

Of 49 entities scored in the latest period, 14 mention AI at all. Seven disclose some form of AI governance: a policy, a playbook, a forum, a centre or a committee. One names who owns AI risk, and it does so because its risk taxonomy lists AI under a class that already has an owner, not because the disclosure set out to. One shows AI reaching the board. None places AI within its risk appetite. Thirty-five of the 49 score nothing on the index we built.

What already works

This is not a story of entities ignoring AI. The documents that do address it are often specific about use. One existing technology committee charter already covers “the use of new technology” and “technology risk matters”; adding a few words would bring AI inside it. Eleven entities explain AI use to customers in their privacy statements, some in careful detail. And where a disclosure regime asks for it, as climate reporting does, these same documents already show a well-established vocabulary for governing an emerging risk.

Two things surprised us

A caution we would not want lost. Visibility is not governance. We observed only what entities publish, and an entity can govern AI well and say little about it. Where a document gives AI nowhere to appear, silence tells you nothing at all.

Our view, for what it is worth

The gap is narrower than the headline numbers suggest. The chain does not break at awareness; it breaks at the owner. Where governance already exists, one sentence naming the executive owner and the overseeing committee could close the most visible gap at very little cost. Where it does not exist, no sentence should be written, because naming an owner who does not in fact exercise ownership would be worse than silence. The questions a board could ask itself are simple to state:

These are questions, not advice, and the answers are for each board to reach.

This was a desktop study of public documents, and some documents could not be retrieved. If the public record misses something you know, we would like to hear it.