On 30 April 2026, the Australian Prudential Regulation Authority sent a letter to every bank, insurer and superannuation trustee it supervises. It was not another guidance note. It was the output of a targeted supervisory review of selected large institutions, and it read as a warning: governance, risk management, assurance and operational resilience are not keeping pace with how fast these firms are deploying AI (APRA).
The letter named four themes where APRA found the gap widest: cyber and information security, AI governance, assurance, and third-party and supply-chain risk (MinterEllison). Fifteen weeks on, it has done what guidance rarely does. It has set a baseline the regulator intends to test.
That raises an awkward question for a prudential supervisor. Enforcement usually rests on a demonstrable breach and a chain of causation. AI systems are probabilistic, they retrain, and when they are bought rather than built they sit inside a vendor’s platform with dependencies the buyer never sees. How does a regulator enforce against a model it cannot fully explain?
APRA’s answer is that it does not try.
What APRA is actually policing
Read the four themes together and a pattern emerges. None of them is about the model’s internal behaviour. All of them are about the wrapper around it.
APRA’s named failures are process failures. Point-in-time, sample-based assurance methods applied to systems that learn continuously. Internal risk functions signing off on technology they cannot independently evaluate. Vendor presentations and summaries accepted in place of governance (Clayton Utz). In each case the object of criticism is not the AI. It is the human and organisational apparatus that is supposed to sit on top of it.
That is the move. APRA has shifted the burden of explainability off the regulator and onto the regulated entity. The supervisor does not need to understand the model. It needs to see whether the board did, whether someone owns the model across its full lifecycle from design to decommissioning, whether the risk-appetite statement says anything about AI at all, and whether assurance is continuous rather than a snapshot (Holistic AI). If an entity cannot evidence governance over a model, that absence is itself the finding. The opacity of the model becomes the firm’s problem to solve, not APRA’s problem to litigate.
This is why the expectations are enforceable where a rule about model outputs would not be. APRA is not asserting that a given credit model is biased or that a fraud engine is wrong. It is asserting that the entity cannot show it would know if either were true. That is a far easier case to make.
The weak point is assurance
The design has a limit, and it sits in the assurance theme.
APRA says entities are failing because they apply static, sample-based audit to continuously-learning systems. The fix it wants is continuous validation and monitoring. But this is the one theme where the regulator needs the same capability it says the industry lacks. To judge whether a firm’s continuous-validation regime is adequate, a supervisor has to reason about model drift, retraining cadence, and the statistical behaviour of a probabilistic system over time. Reading board minutes is one skill. Auditing a monitoring methodology is another, and it is the harder one.
There is also a concentration problem hiding in the third-party theme, which APRA flagged as the widest gap of the four (MinterEllison). The most material AI risk for many regulated firms is not a model they trained. It is a model embedded several layers deep in a vendor platform, with upstream dependencies the firm cannot inspect. Governance of the wrapper works when the wrapper is yours. It strains when the model, the training data and the update schedule all belong to a supplier, and when that supplier serves most of the industry at once.
The enforcement hook is already live
APRA did not leave this as principle. It attached a date.
CPS 230, the operational-risk standard, required pre-existing material service-provider arrangements to be brought into compliance by 1 July 2026 (MinterEllison). That deadline has now passed. For AI bought as a service, and most of it is, CPS 230 gives APRA a concrete, already-binding baseline to test against: contractual rights, exit plans, and visibility into the provider. It is the near-term lever, and it does not depend on anyone explaining a neural network.
What to watch
The letter is a supervisory bet, and its payoff is not the document. It is the first action.
Until APRA moves against an entity on one of the four themes, targeted expectations are still guidance in a sterner register (Norton Rose Fulbright). The move that would prove the strategy is a finding that rests entirely on governance failure: a board that could not evidence oversight, an assurance function that snapshotted a system that had since retrained, a vendor arrangement that missed the CPS 230 baseline. None of those requires the regulator to open the model.
If APRA can win that case, it will have shown that a prudential supervisor does not need to explain AI to enforce against it. It only needs to prove the firm could not either. That is a lower bar, and a smarter one. Whether it holds the first time it is tested is the story worth watching through the rest of 2026.
Discussion
Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.