ASIC and APRA warn frontier AI awareness must turn to action

Key dates

2026-04-30

APRA issued its letter to banks, insurers and superannuation trustees calling for a step-change in governance, risk management, assurance and operational resilience for AI-related risks.

2026-05-08

ASIC issued its open letter to all licensees and market participants urging urgent strengthening of cyber resilience as frontier AI intensifies the global cyber-risk environment.

2026-06-01

ASIC and APRA began the June–July 2026 series of nine industry roundtables on frontier-AI preparedness and resilience; the source identifies June as the starting month but does not provide an exact day.

2026-07-31

ASIC and APRA completed the June–July 2026 roundtable period; the source does not provide an exact closing day.

2026-08-27

ASIC published the joint warning and related information paper and preparedness checklist, urging entities to move from awareness to action.

Suggested considerations

• Firms should consider presenting the ASIC and APRA roundtable themes, together with the available board and executive preparedness checklist, to the board and relevant risk or technology committees.
• Compliance teams may wish to map frontier-AI cyber and operational risks to existing obligations and controls under APRA CPS 230 Operational Risk Management, APRA CPS 234 Information Security, APRA CPS 220 Risk Management where applicable, and the entity's ASIC licence, governance and cyber-resilience arrangements.
• Firms should consider identifying critical assets, systems, data flows and material third-party dependencies, including common providers and concentration points that could create sector-wide disruption.
• Technology and security teams may wish to test patching, identity and privileged-access controls, attack-surface reduction, backup integrity, recovery-time priorities and incident-response playbooks against AI-accelerated attack scenarios.
• Boards and executives should consider documenting risk appetite, incident escalation authority, recovery priorities, internal and external communication strategies and decision rights before a frontier-AI-related crisis occurs.
• Firms should consider testing response and recovery arrangements under compressed timeframes and retaining evidence of exercise results, lessons learned, remediation owners and completion status.
• Entities using or procuring AI should consider applying existing model, data, supplier, change-management and assurance controls to internally developed models, vendor tools and embedded AI functionality, including defensive-AI tools used for threat intelligence, vulnerability detection, code review or incident response.
• Procurement and outsourcing functions may wish to strengthen supplier assurance, obtain relevant information on providers' AI and cyber controls, map material dependencies and assess substitutability and exit arrangements.

What changed

The regulators have consolidated a cross-sector expectation that entities address frontier-AI risk through cyber fundamentals, critical-asset identification, timely patching, strong identity and access controls, attack-surface reduction, reliable backups, tested response and recovery arrangements, and third-party risk management. Boards and executives are expected to consider risk appetite, escalation authority, recovery priorities and communications before an incident occurs, while entities are encouraged to assess defensive-AI opportunities without treating immature AI capabilities as a substitute for foundational controls. The publication also signals increased emphasis on sector-wide threat-intelligence sharing, dependency mapping, supplier assurance and coordinated incident response.

Who is affected

• APRA-regulated authorised deposit-taking institutions
• APRA-regulated general and life insurers
• APRA-regulated superannuation trustees
• Australian financial services licensees
• Australian market participants and market operators
• Financial-sector entities relying on critical technology, cloud or other third-party service providers

Related regulations

• APRA CPS 230 Operational Risk Management
• APRA CPS 234 Information Security
• APRA CPS 220 Risk Management
• Corporations Act 2001
• ASIC Regulatory Guide 104 Licensing: Meeting the general obligations
• ASIC Report 798 Beware the Gap: Governance Arrangements in the Face of AI Innovation