risk appetite

Many organisations have AI policies, but these often fail to guide day-to-day decision making. To manage AI risks effectively, policies need clear guardrails that business teams can apply consistently. This article explains how to translate high-level AI principles into practical standards and controls that enable confident, accountable AI use.

ASIC and APRA now both expect a named accountable person behind every material AI use case, not a shared committee. This post looks at what Beware the Gap, APRA's April 2026 letter to industry, and a real AI hiring-platform ownership failure mean for boards before the regulator asks who was responsible.

APRA and ASIC have both put board AI literacy gaps in writing this year, APRA's 30 April letter to industry and ASIC's 8 May open letter to AFS licensees. Here is what they found, and the questions every board should be able to answer now.

Many organisations unknowingly inherit significant AI risks through third-party technology and vendor services. Without rigorous independent challenge and clear ownership, vendor assurances fall short. Leaders must demand tailored evidence and embed structured AI risk governance that addresses supply chain complexities and local obligations.

Risk appetite setting is a powerful tool to encourage the taking of risks across all parts of the organisation. The alternative approach to risk appetite setting is to not focus on the process but on the business engagement.

The key question considered across the globe every day is "what is our risk appetite box, where do we stand?". A few months ago a member of Australia's regulatory body for Financial services (APRA), Ian...