Source: APRA

reports that Artificial Intelligence is being rapidly adopted across APRA‑regulated industries and that a targeted engagement with selected large banks, insurers and superannuation trustees in late 2025 informed its observations and expectations. The letter outlines differing levels of maturity across governance, risk management and operational resilience, notes assurance practices are not keeping pace with AI’s scale and complexity, and flags many Boards as still developing the technical literacy needed to challenge AI‑related risks rather than relying on vendor presentations. APRA has provided observations and expectations for accountable executives in an attachment and is finalising a forward supervision plan that will take a proportional approach to prudential reviews, thematic activity and AI supplier engagement.

APRA highlights that AI materially changes the cyber threat landscape by increasing attack pathways — including prompt injection, data leakage, insecure integrations, exploit injection and misuse of autonomous agents — and that identity and access management have not adjusted to non‑human actors. APRA identifies gaps in security testing, change and release controls, patching and remediation timelines, and controls over staff use of enterprise AI outside approved frameworks. APRA expects entities to manage AI risk proportionately by setting risk appetite, strengthening cyber defences (timely patching, vulnerability closure, privileged access controls), maintaining AI inventories, ensuring human involvement in high‑risk decisions, mapping AI supply chains, and planning for supplier concentration and exit strategies; APRA also warns it will take stronger supervisory or enforcement action where entities fail to manage AI risks appropriately and encourages early engagement with its Non‑Financial Risk Team.