On 30 April 2026, APRA sent a letter to all the banks, insurers and super trustees it regulates. You can read it here. It is short and worth reading in full. Here is what it says, in plain terms.
What APRA found. APRA talked to a group of large banks, insurers and super trustees in late 2025. Everyone is using AI. But governance, risk management and assurance are not keeping up with how fast AI is being adopted.
What it says about boards. APRA saw plenty of interest in AI's benefits. It also saw boards still building the knowledge to challenge AI risk, and relying too much on vendor presentations. At a minimum, APRA expects boards to understand AI well enough to set direction and challenge, and to oversee an AI strategy that fits the firm's risk appetite, with monitoring and reporting that includes third-party dependencies.
The four problem areas it names.
- - Security. AI creates new ways to attack a firm. APRA also flagged staff using AI tools outside approved controls, with firms relying on policy and after-the-fact checks instead of technical controls.
- Governance. APRA expects an inventory of AI tools and use cases, clear ownership across the whole lifecycle, human involvement in high-risk decisions, and staff training.
- Suppliers. Many firms depend heavily on one provider. APRA expects visibility of the whole AI supply chain, contracts that allow audit and notice of model changes, and a credible exit plan.
- Assurance. Point-in-time sampling doesn't suit AI that changes over time. APRA expects continuous monitoring, in proportion to how critical the use is.
Questions a board could ask this month
- - Where do we use AI today, including tools staff chose themselves?
- Who owns each use?
- Which suppliers does each one depend on, and could we switch?
- How do we know it's still working properly next month?
- Which decisions always have a person involved?
If you are not APRA-regulated. The letter is addressed to APRA-regulated entities. Advice firms are mainly regulated by ASIC, and MGAs usually work under an insurer's authority. The letter doesn't apply to you directly, but your licensee, insurer or capacity provider may ask similar questions. Check with them.
Source: APRA letter to industry on AI, 30 April 2026. This article summarises it. It is not legal advice.