Australia · APRA
APRA's letter of 30 April 2026 expects boards to oversee AI within appetite, including inside third-party dependencies, with clearly defined triggers. It named reliance on vendor summaries as the gap. The AI Use Assessment shows what each provider can actually evidence, before APRA asks.
What applies
APRA's letter says existing prudential standards apply to AI risk, without naming them. The mapping below is our reading; counsel grades what is a requirement and what is an expectation.
| Instrument | What it asks | What it means for evidence |
|---|---|---|
| APRA letter to industry on AI, 30 April 2026 | Boards oversee AI within appetite, including inside third-party dependencies, with clearly defined triggers. Stronger supervisory action where that is not done. No date set. | An appetite with testable limits and triggers, and a record each time a trigger fires. |
| CPS 220 Risk Management | The board owns the risk appetite and its triggers. | AI inside providers has to sit inside that appetite, not beside it. |
| CPS 230 Operational Risk Management | Reaches agreements with material service providers and the chain supporting them. Existing agreements must comply at renewal, and by 1 July 2026 at the latest. | Tolerances for critical operations, including those a provider runs with AI. |
| CPS 234 Information Security | Controls over information assets managed by third parties, tested in proportion to the threat. Material incidents notified within 72 hours. | Control testing that reaches AI in the chain, and a record that exists at the time of an incident. |
| Financial Accountability Regime | Accountable persons answer for reasonable steps. | A record of what was asked, found and decided, before APRA or ASIC asks. |
| Privacy Act, APP 1.7, from 10 December 2026 | Privacy policies must disclose substantially automated decisions that significantly affect individuals. | A register of where AI decides, including inside providers. |
The seven questions, in CPS 230 terms
"No reasonable reach" is a documented conclusion, not a gap. The determination at each step is the entity's and its counsel's.
Where it bites first
The date might be an APRA review, an incident, a material provider renewal, or the 10 December 2026 disclosure deadline.
| Kind of entity | Small | Mid-sized | Large | Very large |
|---|---|---|---|---|
| Industry super fund Administration and mandates outsourced | Unlikely | First | First | Later |
| Customer-owned bank Core banking run by a provider | Unlikely | First | Early | Later |
| Private health insurer Claims platforms outsourced | Later | First | Early | Later |
| General insurer writing through intermediaries Agencies, brokers and aggregators hold the AI | Unlikely | Early | Early | Later |
| Life insurer in a trustee chain Trustees will ask; AI often built by a foreign parent | Unlikely | Early | Later | Later |
| Entity with a large in-house AI team Short chain; will answer the letter internally first | Unlikely | Later | Later | Unlikely |
What moving first gives you
Providers serve several regulated entities. The first to specify the evidence shapes what they build.
Wrong assumptions are corrected cheaply, before a deadline sets the pace.
What was asked, found and decided is recorded before APRA or ASIC asks.
The first board to hold the record can say who checked it, and that the checker is independent of audit.
Commonwealth agencies
The policy for the responsible use of AI in government asks each agency for an accountable owner and an impact assessment for every in-scope use, and a register of AI use cases. Automated decisions are disclosed under the Privacy Act from 10 December 2026. The DTA model clauses will carry the evidence terms with providers, and nobody has yet tested what providers can produce against them.
The impact assessment settles what the agency intends. The AI Use Assessment tests what each provider can actually evidence, through the agency's counsel, without redoing the first.
Advisory for agencies and regulated entities →Regulatory position as at 26 October 2026. Not legal advice: every legal determination is yours and your counsel's.