Australia’s regulators are no longer waiting. In April 2026, APRA wrote directly to the boards of the country’s largest banks, insurers, and superannuation funds with a blunt assessment: AI systems are being deployed without inventories, lifecycle ownership is unclear, and post-deployment monitoring is failing to keep pace with the speed of adoption. The same month, ASIC reinforced the same point, urging all AFS licensees and market participants to strengthen cyber resilience and AI governance in response to AI-accelerated threats.
If your AI risk management starts with your risk team rather than a named business owner, you are already behind.
The 30-second take
Regulators have made it clear that AI risk is not a technology function — it is a business leadership responsibility.
The APRA and ASIC AI governance letters means executives can now face personal consequences for failing to maintain sufficient AI governance oversight.
Business ownership of each AI use case — defined from inception, not in retrospective review — is the minimum expected standard.
Understanding your governance, risk and AI risk practices, starts with you, whether you are a board member, executive or senior leader.
What APRA’s AI letter actually says
APRA’s targeted review of large banks, insurers, and super funds in late 2025 found consistent gaps across the sector. AI systems had been deployed without a maintained inventory. Accountability was unclear through the AI lifecycle. Post-deployment monitoring was weak. APRA’s letter set out minimum governance expectations, including:
- Governance frameworks and reporting lines covering the full AI lifecycle — from design and development through to deployment, monitoring, and decommissioning.
- Named ownership and accountability at each lifecycle stage — not shared responsibility that belongs to no one.
- An active inventory of AI tooling and use cases — not a plan to eventually build one.
- Board-level understanding sufficient to set strategic direction and provide effective challenge to management.
The message to regulated entities is direct: if you cannot name who owns an AI use case and demonstrate what governance arrangements are in place, you do not meet APRA’s minimum expectations. This is no longer aspirational guidance — it is the baseline.
FAR and regulatory enforcement makes ownership personal
The Financial Accountability Regime (FAR) was extended to insurers and RSE licensees — superannuation funds and insurance companies — in March 2025. These entities now sit alongside the banks in having personal executive accountability for material risk areas, including AI governance. ASIC’s 2025–26 enforcement data shows investigations up 50% and $104 million in civil penalties, with ASIC pursuing entire boards rather than isolated executives and naming AI governance among its top supervision priorities.
Personal accountability changes the risk calculus.
When an executive can be held personally responsible for an AI governance failure, the question “who owns this AI use case?” shifts from a process formality to a board-level concern. Regulated entities that have not mapped AI ownership to specific FAR accountability statements are carrying unquantified personal risk at the executive level.
CPS 230 and the third-party ownership problem
Many AI initiatives rely on vendor platforms, and this is where ownership typically breaks down. APRA’s prudential standard CPS 230 treats AI vendors the same as any material service provider: contracts must address resilience obligations, sub-contracting, data location, incident notification, and termination rights. In practice, most AI vendor terms of service do not meet CPS 230 requirements out of the box.
The exposure is straightforward. When a vendor changes its underlying AI model, adjusts its training data, or modifies service design, the regulated entity inherits the risks.
Business ownership must extend to vendor management. The executive who approved deploying a vendor AI solution is accountable for ensuring the organisation’s contractual and regulatory requirements are being met on an ongoing basis, not just at the point of sign-off.
December 2026 Privacy Act deadline adds urgency
Automated decision-making transparency requirements under the Privacy Act (APP 1.7–1.9) commence 10 December 2026.
For any AI use case that supports a customer-facing decision — credit assessment, insurance pricing, claims processing, fraud flagging — organisations must be able to explain how automated decisions are made. Without clear business ownership and documentation built from the point of design, meeting this obligation retrospectively will be operationally disruptive and expensive.
The December deadline is now less than six months away.
Questions your organisation should be able to answer today
- Who is the named business owner for each active AI use case, and can they describe its purpose, data inputs, and governance safeguards without referring to technical documentation?
- Does your AI intake process require a named owner and documented use case before any risk assessment or vendor engagement begins?
- Have your AI vendor contracts been reviewed against CPS 230 requirements — and what happens when a vendor unilaterally changes the model or service design?
- Does your AI inventory reflect what is actually deployed in your organisation, or only what teams chose to self-report?
- How will you demonstrate automated decision-making transparency under the Privacy Act by December 2026 — and which business owner is responsible for that preparation?
- At what point in the AI lifecycle does your board receive information sufficient to provide effective challenge — and are you meeting that threshold today?
“Clear business ownership is what separates organisations that can move quickly with AI from those that move fast and create risks they cannot manage.”
The regulatory direction from APRA, ASIC, and Privacy are consistent: name your owner, document your use case, manage your vendor, and evidence your governance.
The organisations that will move fastest with AI are those that have made ownership clear from the start — not those scrambling to retrofit accountability after a regulator asks.
If you want a structured way to assess where your organisation stands, visit the Innovation of Risk Reading Room at innovationofrisk.com — and take a readiness snapshot against the expectations APRA and ASIC have set.
Try one or all of our free snapshots for AI governance, risk & governance, or for board members to start asking the right questions…
Know where your AI governance stands in five minutes.
Use a short diagnostic to test practical AI governance, oversight and risk controls. Get an immediate visual result and suggested next focus areas.
Practical tools for boards, executives, auditors and risk professionals.
Innovation of Risk provides AI maturity and risk assessment tools to help organisations have better internal risk, governance and assurance discussions. Contact us to find our more…