Simplicity IT | New York
AI governance for firms covered by NYDFS Part 500
NYDFS-regulated firms already manage cybersecurity risk under 23 NYCRR 500. AI use raises additional questions about data access, third parties and oversight that belong in the same governed review.
For NYDFS-regulated businesses. This page is readiness information, not legal advice or a compliance determination.
Book a scoping sessionStart with the regulation and the current guidance
Part 500 requires covered entities to manage cybersecurity risk. A September 2026 Department letter clarifies that risk assessments inform the program and are reviewed at least annually and after material changes. It creates no new requirement. Review current Department guidance with counsel because obligations depend on the entity and any exemptions.
Questions for your AI inventory
- Which tools or agents process regulated information?
- Which identities and vendors can reach those systems?
- What data is retained, exported or used for model improvement?
- Who approves use, exceptions and changes?
Controls to assess in Microsoft 365
Microsoft Purview, Microsoft Entra and Microsoft Defender can support a scoped review of data access, identity, monitoring and policy. The fit depends on your licenses and configuration.
How we help
Simplicity IT can assess the current state, propose prioritized controls and help operate an approved governance plan. Your legal and compliance teams determine obligations and certification.