From Expectation to Evidence

On 15 October 2026 the Reserve Bank and the Financial Markets Authority said boards should understand material AI risks well enough “to set risk appetite and assign clear accountability for material AI risks”. Public disclosure is not required. This study asked what an investor, depositor or peer board could already see, in the last two reporting periods before that date, across 49 scored banks, non-bank deposit takers, insurers and FMA-licensed entities. The answer is: hardly at all where accountability lives. Fourteen of the 49 mention AI and seven disclose a policy, forum or committee, but only one names who owns AI risk — ASB, and only by inheritance — and none places AI within its risk appetite. The mean score on the study's 0–100 disclosure index is 8.3; the median is 0. The gap is not information about AI; it is information about who governs it. Eleven entities tell customers in privacy statements that they use AI, some that customer data may train models, yet seven of those say nothing about AI in their governance documents. No board or committee charter names AI. Provider dependence is announced in vendor newsrooms but nowhere linked to AI risk. Every Australian parent discloses more than its NZ subsidiary. Visibility exists where a vehicle invites it. The highest scorers are medium, NZ-owned entities — Kiwibank (58.3), NZX (50.0) — and new AI text is arriving through climate reporting, as strategic uncertainty and scenario drivers rather than cyber risk. Where AI is disclosed, it is modest and factual; no overstatement was found. The study measures visibility, not governance, and makes no finding of compliance or breach. An entity scoring zero may govern AI well. Two periods cannot show durability, and human validation of the entity codes by the FalconBridge team is still pending. A board could consider running the six-stage chain — use, risk, owner, route to board, appetite, assurance — against its own reporting, then naming the owner of AI risk, adding AI to an existing committee charter and, for subsidiaries, stating which group framework applies. Where the governance exists, these are a few accurate sentences; where it does not, no disclosure can supply it.