In force
1 Jul 2025
APRA CPS 230
Operational risk management requirements apply. AI systems are in scope.
AI governance built for APRA, ASIC, and OAIC scrutiny.
We advise Australia's banks, insurers, superannuation trustees, and public-sector agencies on the governance frameworks regulators expect to see, with deadlines now in force or arriving in 2026.
Built for
Board risk committees 路 FAR accountable persons 路 Chief risk and compliance officers 路 CIOs and heads of data 路 General counsel and privacy officers 路 Agency AI leads
Instruments we work to: APRA CPS 230 / ASIC REP 798 / Privacy Act 1988 / ISO/IEC 42001 / EU AI Act / NIST AI RMF / Voluntary AI Safety Standard
What an engagement leaves behind.
All nineteen servicesClassified AI register
Every AI system in use, with its risk tier, the obligations it triggers and the executive who owns it.
Mapped controls
Each control traced to the CPS 230 clause, APP, ISO 42001 requirement or Voluntary AI Safety Standard guardrail it satisfies.
Board-ready artefacts
Policy documents, oversight charters, escalation paths, and reporting packs sized for board approval.
Audit-ready evidence pack
One pack an APRA supervisor, an internal auditor or an external reviewer can read from start to finish without a walkthrough.
The dates your governance plan has to anchor to.
Key Australian and international milestones that materially change the obligations on regulated and public-sector deployers of AI.
In force
1 Oct 2025
Service Provider Register
APRA material service provider register required. AI vendors included.
Upcoming
2 Dec 2027
EU AI Act
Annex III high-risk obligations apply. AI built into regulated products follows on 2 August 2028.
Upcoming
10 Dec 2026
Privacy Act ADM
Automated decision-making transparency requirements take effect.
Four regulatory pressures now stack on the same board agenda.
Most Australian organisations are running AI in production without a documented risk taxonomy, accountable owner, or evidence trail. Below are the frameworks a regulator, auditor, or general counsel asks about first.
- 01In force
APRA CPS 230 covers AI as operational risk.
AI systems sit inside the operational-risk perimeter for APRA-regulated entities. The standard requires documented risk assessments, controls testing, third-party AI vendor classification as material service providers, and board-level accountability. Service-provider register obligations took effect 1 October 2025.
Build a CPS 230-aligned framework - 02In force
Board oversight is now a personal-accountability question.
Under the Financial Accountability Regime, accountable persons can be named for AI-related failures. Boards need a documented inventory of AI systems in use, an approvals path for new deployments, a clear escalation route for incidents, and a review cadence aligned to the entity's risk appetite statement.
Structure board-level oversight - 03Dec 2027
The EU AI Act reaches Australian providers and deployers.
If your AI system is placed on the European market, or if its output is used in the EU, the Act applies regardless of where you sit. High-risk classification triggers conformity assessment, technical documentation, post-market monitoring, and registration. Those obligations apply from 2 December 2027, or 2 August 2028 for AI inside regulated products. The Act's penalties reach 7% of global annual turnover.
Map your EU AI Act obligations - 04Dec 2026
Privacy Act amendments add automated-decision-making transparency.
From 10 December 2026, APP entities that use automated decision-making in decisions affecting individuals must update their privacy policies to disclose the kinds of personal information used and the decisions made. Internal documentation, model-cards, and notice copy all need to be ready before the date.
Prepare for the December 2026 deadline
How we work with regulated and public-sector clients.
Three practice tracks, each tied to a documented set of artefacts. Engagements typically run six to twelve weeks with a defined evidence pack at close.
Track A
Governance & strategy
Frameworks, policies, and operating models that hold up under board, regulator, or audit scrutiny.
Track B
Assessment & assurance
Independent testing of AI systems and the controls around them, with the evidence pack sized for internal audit or an APRA review.
Track C
Compliance & advisory
Ongoing alignment with Australian and international regulators. Workforce uplift, board education, and standing advisory support.
Governance scoped to your regulator.
Banking, insurance, superannuation, healthcare, and government each carry distinct regulatory expectations for AI. Engagements are scoped against the prudential, sectoral, and statutory frameworks that apply.
Further reading
The PolyGovern AI Governance Framework
Eleven elements, each traced to CPS 230, the APPs, the NAIC essential practices and ISO 42001.
Read the guideCPS 230 and AI
The APRA operational risk playbook for AI, with the material service provider checklist.
Read the guideGuides, templates and checklists
Guides, templates and checklists on ISO 42001, NIST AI RMF, shadow AI and AI policy for Australian organisations.
Browse the resourcesClassify first. Then scope the work.
The calculator classifies your AI systems against the EU AI Act and ISO 42001 in a few minutes. With that baseline we map the register against APRA, ASIC and the Privacy Act and set out the work that closes each gap.