Artificial Intelligence (AI)

APRA, ASIC and the ACCC have all sharpened the rules on AI risk in 2026 — from APRA's step-change governance letter to ASIC's 'Year of Accountability' and the ACCC's doubled penalties for AI-washing. Here's why leaders should treat AI risk management as a business enabler, not a compliance checkbox.

APRA's April 2026 letter named four AI governance failures inside Australia's largest banks and insurers; ASIC has tied AI-driven cyber risk to its FIIG Securities enforcement precedent.

APRA's April 2026 letter to industry and ASIC's Report 798 both warn that boards are leaning on AI vendor assurances instead of independently verifying them. Here is what Australian organisations should be checking before they trust the compliance pack.

Shadow AI is no longer hypothetical: a NSW government contractor uploaded flood victims' personal and health data to ChatGPT, while APRA and ASIC have both issued 2026 letters demanding stronger AI governance and cyber resilience. This post sets out what boards and risk leaders should be asking right now.

Without a clear AI use-case lifecycle—from identification through retirement—organisations risk fragmented governance, hidden risks, and missed control opportunities. Executives and risk managers must demand disciplined visibility and stage-gate controls to keep AI aligned with strategy and risk appetite.

APRA and ASIC have both put board AI literacy gaps in writing this year, APRA's 30 April letter to industry and ASIC's 8 May open letter to AFS licensees. Here is what they found, and the questions every board should be able to answer now.