APRA's AI letter: the four gaps, and what closing them takes

In late 2025 APRA examined how the largest banks, insurers and superannuation trustees adopt and control AI. The letter it sent to every regulated entity in April 2026 is the most specific statement yet from an Australian financial regulator about AI. Its finding fits in one line: adoption is running ahead of the practices meant to control it, and the regulator has said it will act where the gap persists.

What APRA requires of every regulated entity

APRA's minimum expectations are seven practices. Boards need enough AI literacy to provide effective challenge. Each entity maintains an AI strategy aligned to its risk appetite, with monitoring and reporting that covers third-party dependencies. Governance runs across the full AI lifecycle, from design to decommissioning, backed by an inventory of AI tools and use cases. Humans stay involved in high-risk decisions. The AI supply chain is mapped, including fourth-party dependencies. And assurance over systems whose behaviour changes after deployment runs continuously.

The letter closes with an enforcement warning. Where entities "fail to adequately identify, manage or control AI risks in a manner proportionate to their size, scale and complexity", APRA "will take stronger supervisory action and, where appropriate, pursue enforcement".

This article works through what APRA found, and what closing each gap takes in practice.

What the letter is, and who it covers

The letter is dated April 2026 and is signed by Therese McCarthy Hockey, an APRA Member. It went to all APRA-regulated entities. The findings come from a targeted engagement in late 2025 with a sample of the biggest banks, insurers and super funds. APRA published the detail "for the benefit of all regulated entities", including those earlier in their AI adoption.

The wider data says the acceleration APRA saw is economy-wide. The Reserve Bank's November 2025 survey of 105 medium and large firms found two-thirds had adopted AI in some form, with most of that adoption shallow: off-the-shelf assistants used for discrete tasks. The ABS's Business Characteristics Survey found 24 per cent of financial and insurance services businesses used AI in 2024-25, up from 1 per cent three years earlier. No industry grew faster.

APRA describes the same movement from the inside. The entities it examined are "moving beyond experimentation from internal productivity use cases to customer facing applications". AI is already in trial or production for software engineering, claims triage, loan application processing, fraud and scam disruption, customer interaction and insight generation. A customer-facing AI system is a different risk object from an internal drafting tool. The letter exists because the control environment has not made that jump with it.

Information security has not adjusted to AI agents

The first gap is information security. APRA found AI adoption is "materially changing" the threat landscape: the attack pathways now include prompt injection, data leakage, insecure integrations, exploit injection and "the manipulation or misuse of autonomous AI agents". AI shortens the attack cycle and increases the speed and coordination of attacks.

The detail underneath is what an engineering reader should sit with. "Identity and access management capabilities have not yet adjusted to nonhuman actors such as AI agents." An agent acting inside your systems holds credentials, and most identity stacks were not designed to issue, scope and revoke them. "The volume and speed of AI assisted software development is placing strain on the effectiveness of change and release management controls": code arrives faster than the process that reviews it. And staff use of enterprise AI tools outside approved frameworks is common, with entities "relying primarily on policy direction or detective, after-the-fact measures, rather than enforceable technical restrictions".

Closing this gap is specific work. Treat agents as identities: named, credentialed, scoped, logged, revocable. Extend security testing to cover AI-generated code and the components it pulls in. Match patching and remediation cadence to the threat speed APRA describes; most entities still run a quarterly cycle. Where AI supports a critical operation, build the fallback process the letter calls "credible": a defined way the operation runs when the model is wrong, degraded or unavailable. And enforce AI tool policy technically, with the same controls that govern any other data pathway, because a policy document nobody enforces is the gap APRA named.

Governance lags adoption

Governance is the second gap, and the letter's centre. APRA found that while most entities recognise existing prudential standards apply to AI, "few have operationalised governance in practice". The common failure is treating AI risk as "just another technology". That framing misses what makes these systems different: adaptive behaviour, inherent bias, and privacy and data risks that shift as the model does.

The specific gaps sit in the lifecycle's second half. Entities govern design and deployment reasonably well and then go quiet: "weak controls over post deployment monitoring, weak model behaviour monitoring, change management, and decommissioning of AI capabilities."

Closing it takes named ownership across the whole lifecycle, including the phases nobody wants to own. APRA's minimum list reads like a work plan: frameworks and reporting lines for AI; accountability from design and development "through to deployment, monitoring and decommissioning"; an inventory of AI tooling and use cases; human involvement for high-risk decisions; and staff training on use, misuse and limitations.

The inventory deserves emphasis. It costs the least of anything on the list, and most organisations have not done it. You cannot govern, monitor or decommission what you have not listed, and in our experience the list usually turns up tools nobody expected, bought by teams nobody asked.

The National AI Centre's Guidance for AI Adoption, the voluntary framework published in October 2025, lands on the same six practices: accountability, impacts, risk, sharing information, testing and monitoring, and human control. A voluntary framework and a prudential regulator converging on the same list is as close to a consensus standard as Australia has.

Supplier concentration and opacity

The third area is supplier risk: who else holds your AI risk. APRA observed entities "heavily dependent on a single provider for multiple AI use cases". Few had contingency plans or tested exit strategies for critical AI providers. Contracts lag practice, with limited provisions for audit rights, model updates and deviations, incident notification, or changes to data handling.

The opacity problem compounds the concentration problem. AI capability increasingly arrives embedded in software, platforms and developer tools, which means the upstream dependencies, foundation models, training data sources and fourth-party providers, are invisible to the entity buying them. APRA's line: this "limits entities' ability to independently assess model performance, bias, resilience and security".

Closing it takes a supply-chain map that reaches fourth parties, contract terms that assume the model will change under you, and substitution you have tested. APRA asks for "plausible and systemic failure scenarios" and a credible answer to what substitution, portability or exit looks like for a critical provider. For most entities, nobody has tried.

Assurance is built for systems that hold still

Assurance is the fourth gap: how anyone verifies the other three. APRA found entities relying on "point in time and sample based assurance methods, despite these methods being ill suited to probabilistic models that learn, adapt and degrade over time". Few entities run continuous validation or monitoring that would catch model drift, bias, failure modes or control breakdowns in time to act.

The skills gap sits underneath. Internal audit and risk functions, APRA found, "lack the specialist skills and tools required to engage in AI assessment or audit". That is especially true where agentic behaviour, automated decision-making or AI-assisted code generation are involved. The result is a race the assurance side is losing: "assurance activities often lagged AI deployment."

Closing it takes monitoring that runs continuously and scales with the use case's criticality, and second-line and audit functions with the tooling to assess probabilistic and agentic systems independently. APRA also asks for integrated assurance: one picture across cyber security, data governance, model performance, operational resilience, privacy and conduct risk, replacing the fragmented checks it found.

What boards must do

The board expectations are the letter's least negotiable section. APRA observed strong board interest in AI's benefits, and "many Boards are still developing the technical literacy required to provide effective challenge on AI related risks". It also observed "an overreliance on vendor presentations and summaries without sufficient examination of key AI risks such as unpredictable model behaviour and the impact on critical operations".

The minimum expectation has two parts. Boards must "maintain sufficient understanding and literacy with respect to AI in order to set strategic direction and provide effective challenge and oversight". They must also oversee an AI strategy consistent with the entity's risk appetite. That strategy needs "effective monitoring and reporting (including for third party dependencies)", and "clearly defined triggers aligned to resilience objectives to enable timely action when not operating as expected".

Defined triggers means the board decides in advance what counts as the model misbehaving and who gets told. That is a decision only the board can make, and it cannot be delegated to the vendor's slide deck.

On cyber, the letter is blunter still. APRA is engaging the sector on "the potential for increased cyber threats from high capability AI frontier models", and points to current ASD advice. It expects a "step change" in cyber practices, including using AI itself to find and close vulnerabilities.

The enforcement clause, and what happens next

The enforcement clause deserves quoting in full: "Where entities fail to adequately identify, manage or control AI risks in a manner proportionate to their size, scale and complexity, we will take stronger supervisory action and, where appropriate, pursue enforcement."

APRA is finalising its supervision plan for AI: prudential reviews proportionate to entity size, thematic activities, and engagement with AI suppliers. It also asks entities to engage early with its Non-Financial Risk Team, through supervisors, where existing risk management approaches are under strain.

The regulatory frame itself is unchanged. APRA's standards stay technology-neutral and principles-based; the letter applies them, it does not add a new rulebook. CPS 230, the operational risk management standard whose transition ended on 1 July 2026, already reaches AI vendors as material service providers. The letter is best read as the regulator saying the existing rules now bite on AI, and supervision will check.

Closing the gap: the work, in order

Read together, the four observation areas and the expectation lists describe a body of work. In the order we would run it:

First, inventory. List every AI tool, use case, data flow and model dependency, including the ones staff adopted without a ticket. Nothing else works until this exists.

Second, lifecycle ownership. A named owner per use case, accountable from design through deployment, monitoring and decommissioning.

Third, human oversight where decisions are high-risk. Design the handover as carefully as the model. In the conversational AI system we built for healthdirect, the national health advice service, the assistant hands the caller to a nurse the moment they want one: the guardrail is a product feature, and a policy paragraph would not have done its job.

Fourth, security controls for agents. Agent identities, scoped credentials, security testing that covers AI-generated code, and technical enforcement of tool policy.

Fifth, supplier terms and exit. Audit rights, model-update notification, incident notification, and a substitution path you have tested.

Sixth, continuous assurance. Monitoring for drift, bias and failure modes, scaled to the use case's criticality, with audit functions equipped to check probabilistic systems.

None of this is free, and the cost question deserves a plain answer. The Reserve Bank's finding on technology adoption applies here: productivity gains wait on the complementary investment, the workflows, skills and governance around the tool. The letter's four gaps are that complementary investment, itemised by a regulator.

The organisations APRA examined are the most resourced in the country, and it still found assurance lagging deployment everywhere it looked. That is the realistic baseline. The entities that act on the letter first will find the work is a list, and it starts with an inventory.

If you want a senior engineering team to work through that list with you, get in touch.

About the data

Sources: APRA, Letter to Industry on Artificial Intelligence (AI), April 2026, including the attachment "AI Supervisory Engagement Debrief: Observations for Executive Management". All quotations are from the letter. RBA, "Technology Investment and AI: What Are Firms Telling Us?", Bulletin, November 2025. ABS, "Business adoption of Artificial Intelligence accelerates in 2024-25", media release, 25 June 2026. National AI Centre (DISR), Guidance for AI Adoption, October 2025. Norton Rose Fulbright, "Artificial Intelligence in the Australian financial services sector: a practical compliance primer", February 2026, for the CPS 230 transition timing.