GUIDE: AI UNDER APRAAI under APRA: CPS 234, CPS 230 and what regulated entities must do

What has APRA said about AI?

30 April 2026: letter to industry. After a targeted supervisory review in late 2025, APRA wrote to all regulated entities. [1][2] Its main findings:

• “While most entities recognise that existing prudential standards apply to AI risk, few have operationalised” that recognition. [1]
• Many boards “are still developing the technical literacy required to provide effective challenge”. [1]
• Governance “has not matured at the same pace”, and “assurance activities often lagged AI deployment”. [1]
• For unapproved AI, entities relied “primarily on policy direction” rather than “enforceable technical restrictions”. [1]
• “Few entities had continuous validation or monitoring in place to detect issues such as model drift”, and identity and access management “have not yet adjusted to nonhuman actors such as AI agents”. [1]

For what unapproved AI looks like in practice, and how to fix it without a ban, see our piece on shadow AI.

APRA said it was “not proposing to introduce additional requirements at this stage”, but expects “a significant improvement”. [2] Where entities fail to manage AI risk, it “will take stronger supervisory action and, where appropriate, pursue enforcement”. [1] Our private AI guide lists the letter’s expectations in full.

24 June 2026: AFIA Risk Summit. Therese McCarthy Hockey described reliance on frontier AI models in blunt terms: “It’s third-party risk, a concentration risk and a sovereign access risk.” [3] APRA’s review of 11 banking, super and insurance entities found some heavily dependent on a single AI provider for several use cases. She asked boards and senior managers to assess AI like any other critical dependency: its purpose, where it is hosted, what data it uses, and what happens if it is withdrawn. [3]

29 October 2026: Senate Economics Legislation Committee. APRA Chair John Lonsdale called AI one of the fastest growing operational resilience risks, and said APRA is working to make sure entities strengthen their resilience to “AI-enabled cyber threats”. [4]

6 November 2026: ICA conference. Suzanne Smith told insurers that “Boards do not need to understand every technical detail, but they do need a clear view of where AI is used”. [5]

General information, not legal advice. APRA statements as published on apra.gov.au, checked 10 Nov 2026.

How does CPS 234 apply to AI?

CPS 234 Information Security has applied since 1 July 2019. [6] It never mentions AI, and it does not need to. Every AI tool reads and writes information, so every requirement applies. APRA’s practice guide CPG 234 explains how to meet it. [10]

The one people miss: logs. An AI system’s logs hold the prompts and outputs, which often contain the most sensitive information in the whole flow. Classify and protect them like the source data. [6]

How does CPS 230 apply to AI tools, vendors and agents?

CPS 230 Operational Risk Management commenced on 1 July 2025. An amended version, with targeted exemptions for some non-traditional service providers such as central banks and clearing and settlement facilities, took effect on 1 July 2026. [7][8] It applies across banks, insurers and superannuation trustees.

The test that matters: does the AI sit inside a critical operation? An AI tool that drafts internal meeting notes probably does not. An AI service that triages claims, answers customer enquiries or prepares hardship decisions probably does, and then its provider, and the model provider behind it, come into scope. [7]

What does CPG 235 mean for AI data?

CPG 235 Managing Data Risk is a prudential practice guide from 2013. Practice guides “do not themselves create enforceable requirements”. [9] They are still the clearest statement of how APRA thinks about data risk. Three ideas carry straight over to AI:

• Data quality has dimensions. Accuracy, completeness, consistency, timeliness, availability and fitness for use. A retrieval system that answers from out-of-date policy documents fails on timeliness, however good the model. [9]
• Validate close to capture. CPG 235 wants validation, correction and cleansing “as close to the point of capture as possible”. [9] For AI, the point of capture is often the model’s output. Check it before it enters a system of record.
• Detect issues early. APRA asks for “timely detection and reporting of data issues”. [9] That is the monitoring for drift that APRA’s 2026 review found few entities had. [1]

How do the standards apply to AI tools, vendors and agents?

Most AI risk in a regulated entity comes from three places: staff using AI tools, the vendors and models behind those tools, and AI agents that act in your systems. The map shows, for each one, what each APRA source asks, a practical control, and the evidence to keep. [1][6][7][9]

AI control map

What you govern

Staff using AI toolsAssistants, chatbots and AI features people use in their daily workAI vendors and modelsHosted models, AI platforms and SaaS products with AI insideAI agentsAI that reads systems and takes actions with its own credentials

CPS 234CPS 230CPG 235APRA letter

AI vendors and models × CPS 230 Operational risk and service providers

What it asks

Identify material service providers, do due diligence, sign formal agreements with APRA access, notify APRA within 20 business days, and manage fourth parties.

Practical control

Decide whether each AI service supports a critical operation; map the model provider behind your SaaS vendor; check where inference runs before any offshoring.

Evidence to keep

Material service provider register entry; offshoring assessment; fourth-party map.

quantana.com.au

AI control map: three AI exposures (staff using AI tools, AI vendors and models, AI agents) against CPS 234, CPS 230, CPG 235 and APRA's April 2026 letter. Choose an exposure and a source to see what it asks, a practical control and the evidence to keep.

Exposure and source	What it asks	Practical control	Evidence
Staff using AI tools: CPS 234	Classify information assets, including those managed by third parties, by criticality and sensitivity, with controls to match.	Information classes for AI inputs; approved tools per class; restrict unapproved AI services and extensions; data loss prevention on uploads.	AI register showing the highest information class per tool; proxy and data loss prevention reports.
Staff using AI tools: CPS 230	Manage operational risk, including technology and change risk, and keep critical operations within tolerance.	Map where staff use AI inside critical operations such as claims processing or customer enquiries; keep a manual fallback.	Process maps that show the AI steps; a business continuity plan that covers losing the tool.
Staff using AI tools: CPG 235	Manage data quality, with validation and correction as close to the point of capture as possible.	A person reviews AI output before it enters a system of record; corrections are tracked.	Review sign-off in the workflow; sample checks of AI-assisted records.
Staff using AI tools: APRA letter	Board literacy, and controls on unapproved AI that go beyond policy direction.	Training for every AI user and a board briefing; technical restrictions on unapproved tools.	Training completion; board minutes; blocked-traffic reports.
AI vendors and models: CPS 234	Assess the information security capability of third parties that manage your information assets; internal audit covers controls run by third parties.	Security due diligence on every AI vendor: where prompts, outputs and logs are stored and processed, training on inputs, certifications, incident notice.	Vendor assessment; contract security schedule; internal audit coverage.
AI vendors and models: CPS 230	Identify material service providers, do due diligence, sign formal agreements with APRA access, notify APRA within 20 business days, and manage fourth parties.	Decide whether each AI service supports a critical operation; map the model provider behind your SaaS vendor; check where inference runs before any offshoring.	Material service provider register entry; offshoring assessment; fourth-party map.
AI vendors and models: CPG 235	Manage data risk within the operational risk framework, with controls that match data criticality and sensitivity.	Record what data each vendor receives, keeps and for how long, and the quality of the sources it retrieves from.	Data-flow diagram per AI service; retention terms.
AI vendors and models: APRA letter	Map the full AI supply chain, actively manage concentration risk, and make substitution or exit credible; contracts with transparency, auditability and assurance.	A concentration view across use cases; contract clauses on audit rights, model changes, incidents and data handling; a tested alternative model.	Supply chain map; contract checklist; exit test results.
AI agents: CPS 234	Timely controls matched to risk; systematic testing by functionally independent specialists; APRA notified within 72 hours of a material incident.	A distinct identity per agent with least privilege; prompt injection and data exfiltration testing before go-live and after changes; AI scenarios in incident playbooks.	Identity records; independent test reports; incident playbook.
AI agents: CPS 230	Manage change and operational risk incidents; notify APRA within 72 hours of a material incident, and within 24 hours of a disruption beyond tolerance.	Change control for model, prompt and tool changes; human approval for actions in critical operations; a kill switch and rollback.	Change records; approval logs; tested rollback.
AI agents: CPG 235	Detect and report data issues in time to limit their impact.	Log every tool call, record read and record changed; monitor agent output quality and drift.	Audit trail; monitoring dashboard; data issue log.
AI agents: APRA letter	Controls over agentic and autonomous workflows; human involvement for high-risk decisions; monitoring proportionate to criticality.	An agent inventory with owners; approval gates on high-risk actions; continuous monitoring.	Agent inventory; approval records; monitoring reports to the risk committee.

Using AI on SAP for finance or claims data? Our AI in SAP guide shows how least-privilege, masking and a request-level audit trail map to the same standards. For how these controls sit in an LLM architecture, see the CPS 230 and CPS 234 mapping in our private AI guide.

A practical AI control checklist

Twelve controls that cover what APRA’s letter, CPS 234 and CPS 230 ask of AI. Tick what you can evidence today.

AI readiness check for APRA-regulated entities

0of 12 in place

Early days. Start with an owner and an AI register.

Governance

A named executive owns AI risk, and each AI system has an ownerAPRA expects ownership and accountability across the AI lifecycle.An AI register lists every tool, model, agent and AI feature inside purchased softwareAPRA asks for “an inventory of AI tooling and AI use cases”.The board has had an AI briefing and sees AI risk reportingAPRA found many boards still developing the literacy to challenge.

Data and security

Information classes say which data may go to which AI deploymentCPS 234 controls must match criticality and sensitivity.Unapproved AI is restricted by technical controls, not only policyAPRA criticised reliance on policy direction alone.AI systems are tested independently for prompt injection and data leakageCPS 234 requires testing by functionally independent specialists.

Suppliers

AI vendors are assessed against your material service provider criteriaCPS 230 covers providers relied on for critical operations, and their fourth parties.AI contracts cover audit rights, model changes, incident notice and data handlingAPRA expects transparency, auditability and assurance over AI services.A substitution or exit plan for critical AI has been testedAPRA flagged heavy reliance on a single AI provider.

Operations

A person makes high-risk decisions, with evidence of real reviewAPRA expects human involvement for high-risk decisions.Every agent has its own identity, least privilege, logging and a kill switchAPRA expects controls over agentic and autonomous workflows.Incident playbooks include AI scenarios and the 72-hour noticeCPS 234 and CPS 230 both require notice within 72 hours of a material incident.

Close first: A named executive owns AI risk; An AI register lists every tool; The board has had an AI briefing and sees AI risk reporting.

quantana.com.au

Readiness check: twelve AI controls in four groups. Tick the ones you have in place to see your score and the gaps to close first.

Control	Group	Why it matters
A named executive owns AI risk, and each AI system has an owner	Governance	APRA expects ownership and accountability across the AI lifecycle.
An AI register lists every tool, model, agent and AI feature inside purchased software	Governance	APRA asks for “an inventory of AI tooling and AI use cases”.
The board has had an AI briefing and sees AI risk reporting	Governance	APRA found many boards still developing the literacy to challenge.
Information classes say which data may go to which AI deployment	Data and security	CPS 234 controls must match criticality and sensitivity.
Unapproved AI is restricted by technical controls, not only policy	Data and security	APRA criticised reliance on policy direction alone.
AI systems are tested independently for prompt injection and data leakage	Data and security	CPS 234 requires testing by functionally independent specialists.
AI vendors are assessed against your material service provider criteria	Suppliers	CPS 230 covers providers relied on for critical operations, and their fourth parties.
AI contracts cover audit rights, model changes, incident notice and data handling	Suppliers	APRA expects transparency, auditability and assurance over AI services.
A substitution or exit plan for critical AI has been tested	Suppliers	APRA flagged heavy reliance on a single AI provider.
A person makes high-risk decisions, with evidence of real review	Operations	APRA expects human involvement for high-risk decisions.
Every agent has its own identity, least privilege, logging and a kill switch	Operations	APRA expects controls over agentic and autonomous workflows.
Incident playbooks include AI scenarios and the 72-hour notice	Operations	CPS 234 and CPS 230 both require notice within 72 hours of a material incident.

Two more items sit beside APRA’s rules. The Privacy Act’s automated decision rules start on 10 December 2026: your privacy policy must describe the kinds of personal information used, and the kinds of decisions made, where a computer program makes or substantially and directly helps make decisions that could significantly affect individuals. [11] And the National AI Centre’s Guidance for AI Adoption is the government’s recommended practice for AI governance across all sectors. [12] For your staff-facing rules, start with our AI policy template.

How does private AI help with APRA expectations?

APRA’s prudential framework “is technology and vendor agnostic”. [1] It does not require you to run AI on your own infrastructure, and hosted AI can be acceptable with the right controls and contracts.

For sensitive workloads, running open-weight models on your own infrastructure does make several questions simpler:

• Supplier and offshoring. No hosted model provider receives the data, so there is no fourth party for inference and no offshore processing to notify.
• Concentration and exit. A private model is a tested alternative if a hosted provider changes terms, withdraws a model or becomes unavailable, which is the dependency APRA raised in June. [3]
• Evidence. You hold the logs, so you can show exactly what each model saw and produced.

It does not remove obligations. You still classify, test and log under CPS 234, and your own hardware becomes a dependency to manage under CPS 230. [6][7] SecGPT Vault is our private AI that runs on-premises with no internet connection, with single sign-on and audit logs. Our private AI guide compares hosted, private cloud and on-premises options.

What questions should boards ask about AI?

APRA wants boards to “maintain sufficient understanding and literacy with respect to AI” and to oversee an AI strategy “consistent with the entity’s risk appetite and tolerance settings”. [1] These ten questions test whether management can show it:

1. Where do we use AI today, including inside the software we buy, and who owns each use?
2. Which of our critical operations depend on AI, and what happens if that AI is unavailable or withdrawn tomorrow?
3. How many of our AI uses rely on one provider, and have we tested switching?
4. Which decisions about customers does AI make or shape, and where does a person decide?
5. What stops staff putting customer data into unapproved AI, beyond the policy?
6. Are our AI vendors on the material service provider register where they should be, and do our contracts give us audit rights, notice of model changes and incident notice?
7. What can our AI agents do without a person approving it, and how quickly can we switch them off?
8. Has anyone independent tested our AI for prompt injection and data leakage?
9. Can our second line and internal audit assess AI systems on their own, with the skills and tools to do it?
10. Does our privacy policy meet the automated decision rules that start on 10 December 2026?

If the answer to the first question takes more than a week, start there. Everything else depends on it.

Do APRA’s AI expectations reach MGAs and other suppliers?

Most managing general agents (MGAs), brokers and technology vendors are not APRA-regulated in their own right. In our reading, the expectations still reach them, through the insurers and banks they serve. Those entities must do due diligence on service providers and sign agreements with APRA access under CPS 230, and must assess the information security of third parties that manage their information under CPS 234. [6][7]

Expect insurer partners to ask what AI you use, where data is processed, who can see it, and how you would keep a delegated function running if an AI service failed. Having the AI register, information classes and incident route ready makes that conversation short. Our guide to AI for MGAs and insurance agencies covers where AI pays off in an MGA, and the governance carriers ask for.

Our reading, not legal advice. Whether and how APRA expectations flow to a supplier depends on its contracts and the service it provides. Confirm with your partners and compliance advisers.