If your board asks “where do we use AI?”, hand over one document.
Most firms already use AI in more places than anyone has recorded. We find every use, rate the risk, put approval steps around it and write it all down. This is a standalone service, and it is also included in every build.
APRA's letter of 30 April 2026
On 30 April 2026, APRA wrote to all regulated banks, insurers and super trustees about AI. Its letter says AI adoption is moving faster than governance, and that boards need to oversee AI risk. Law firm commentary on the letter points to informal AI use, reliance on one vendor, and weak assurance as areas APRA is watching.
If you are an advice firm under ASIC, or an MGA working under an insurer's authority, the same questions will reach you through your licensee, your capacity provider or your auditor. APRA-regulated insurers should also map their AI use to CPS 230, the standard on operational risk and service providers.
Six steps from unknown to written down.
Find every use of AI
We interview your team and check your tools. You get a register of every AI use, including the ones nobody approved.
Rate the risk
Each use is rated by what data it touches, who sees the output, and what happens if it is wrong.
Set the rules
Who can approve a new use. What must be reviewed by a person. What gets tested and how often. What happens when something goes wrong.
Check your suppliers
Where each vendor stores data, which models they use, whether they train on your data, and what you would do if you had to switch.
Write it down for the board
A short summary your directors can read in one sitting, backed by the detailed documents.
Keep it current
Governance goes stale. On a retainer, we update the documents when your tools, models or rules change.
The documents you get
Every document is written for your firm and your systems. No templates with the names swapped.
- AI use register and risk assessment
- Data flow diagrams showing where client data goes
- Human oversight and sign-off procedures
- Testing and accuracy records
- Vendor and model due diligence
- Privacy impact assessment
- Incident and error-handling procedure
- Board-ready summary
- Staff guidelines and training material
We are not a law firm and we don't give legal advice. We prepare the documents and the evidence. Your lawyers and compliance team review what applies to your licence.
A short form. Answer 15 questions about how your firm uses AI today. We send back a one-page summary of where you're exposed.
Get the free governance check →