DFSA and C:>DIR publish new paper on cyber resilience implications of frontier...

Insights paper explores AI-related cyber resilience in financial services. The paperwill be discussed at the Dubai FinTech Summit on 2 November 2026.

The Dubai Financial Services Authority (DFSA), the independent banking, financial services, and markets regulator of Dubai International Financial Centre (DIFC), has published a new insights paper examining how frontier and agentic artificial intelligence (AI) could change the practical conditions under which financial institutions achieve cyber resilience.

Frontier and agentic AI: cyber resilience in the financial sector was developed by the DFSA in collaboration with the Cambridge Digital Innovation and Regulation Initiative (C:>DIR), an initiative of Financial Innovation for Impact.

The paper examines how frontier AI may accelerate selected cyber activities and how agentic systems can combine AI capability with the ability to use connected tools and take actions under delegated authority. It considers the implications for established approaches to cybersecurity, operational resilience, and third-party risk where AI-enabled activity becomes faster, more adaptive, and harder to trace and establish what happened after an incident.

The analysis examines AI-related cyber resilience through four connected dimensions:

• Speed: whether institutions can safely reduce significant cyber exposure before it has serious consequences;
• Reach: whether institutions understand the shared technology and services they depend on, including those beyond their direct suppliers;
• Authority: whether consequential actions by AI-enabled systems remain within their intended mandates; and
• Trust: whether institutions can establish what happened, bring unfinished activity under control, and continue or restore critical operations reliably.

It also examines how reliance on shared models, cloud infrastructure, identity services, software components, and recovery arrangements may create operational dependencies that are not always visible through direct supplier relationships.

Mark Steward, Chief Executive of the DFSA, said: "For the Dubai Financial Services Authority (DFSA), the practical question is how these capabilities interact with access, authority, critical financial operations, and increasingly complex technology and service provider networks. This paper brings together emerging thinking and will prompt wider discussion on how regulators and firms can prepare for these developments."

Bryan Zhang, Co-Creator of C:>DIR, said: "Cybersecurity is where the promise and the hazard of AI meet most directly. This paper puts the deployed system, not the model, at the centre of the analysis - what it can access, the authority it holds and the critical operations it can affect - and tests resilience on speed, reach, authority and trust. These questions will not be settled by any single firm, regulator or jurisdiction, and we hope the paper offers a common vocabulary for public sectors and private sectors working on them together."

The paper draws on evidence from controlled evaluations and reported cyber incidents, alongside international regulatory work, and current approaches to AI governance, third-party risk, operational resilience, and recovery. It includes an analysis on what AI systems have demonstrated in cyber tasks, the effects of those capabilities in operational settings, and possible disruption across institutions or markets.

This publication is intended to support research and international discussion. It does not constitute legal advice, regulatory guidance, a statement of DFSA policy, or an interpretation of applicable law. Its analytical tools and illustrative safeguards do not create or signal supervisory requirements.

Mark Steward and Bryan Zhang will discuss the paper during a fireside chat at the Dubai FinTech Summit on Monday 2 November 2026, as part of Dubai Future Finance Week. The session, "When innovation becomes infrastructure: Who is shaping the financial markets of tomorrow?", forms part of the Regulatory Sessions curated by the DFSA.

The paper is available on the DFSA website. Further information about the DFSA Regulatory Sessions is available on the Dubai FinTech Summit agenda, with details of the wider programme available on the Dubai Future Finance Week website.