Several supervisors
A branch or subsidiary abroad will lean on the group's AI framework, and its local supervisor will read that framework against its own text, on its own timetable. The group does not build one answer per supervisor. It builds one, to the most specific text in force, and every entity relies on it.
The mechanism
This does not change what the home supervisor expects. It changes the latitude: a board that meant to pace its response to the next supervisory conversation now has a date set by another supervisor, for the same framework.
01
A branch or subsidiary abroad has little AI of its own. It runs on group systems, so it adopts the group's framework.
02
Its local supervisor reads that framework against its own text, on its own timetable.
03
The inventory, appetite, supply-chain mapping and provider evidence are the same things, wherever they are examined.
04
The group's answer has to exist, in substance, by the earliest date any entity is tested against.
Why a local carve-out fails
AI used only in one jurisdiction can be inventoried and rated locally within the group framework. A separate local framework over group systems costs more, and leaves two standards on the record.
A branch runs on group platforms, group models and group vendors. A local inventory mostly describes systems it does not own.
Audit rights and notice of AI changes go into group agreements at group renewals.
Dependence on a single AI provider is created by group procurement and only means something counted across the group.
A kill switch or prompt logging is configured where the model runs. Switching AI off locally can mean switching it off for the group.
Local senior managers answer to their supervisor for systems the group controls, and will press the group for the same evidence anyway.
A higher written standard in one jurisdiction and a lower one at home, over the same systems, shows the group knew what better looked like.
Who is asking
Australia
APRA's AI letter of 30 April 2026 asks for oversight inside third-party dependencies, with triggers.
Australia →Singapore
Appetite, inventory and materiality, then lifecycle controls.
Singapore →Canada
AI and third-party models enter OSFI's model risk guideline.
Canada →European Union
AI Act high-risk duties for credit and insurance; DORA already applies.
European Union →Hong Kong
The Hong Kong Monetary Authority issued supervisory guidance on responsible AI adoption.
New Zealand
Supervisors of the large banking subsidiaries Australian groups own are forming AI expectations of their own.
What sets the pace
Pace setter 1
Terms that miss a renewal before the latest supervisor date may not be available again in time. The start date depends on when your agreements renew, not on how fast you work.
Pace setter 2
Monitoring records for a year can only be produced during that year. Everything else can be compressed if a board starts late; these two cannot.
Questions a board can ask now
One assessment, every supervisor
The AI Use Assessment builds one group register that reaches into providers, with fields and materiality mapped to each supervisor's text. The legal half is your counsel's, in each jurisdiction.
Neither APRA's letter nor guidelines such as MAS's are rules that can be breached on their own. The case for acting rests on supervisory weight, dates and personal accountability, and counsel grades each proposition.
Regulatory position as at 26 October 2026. Not legal advice: every legal determination is yours and your counsel's.