APRA Provides New Minimum Expectations Amid Growing AI Security Risks

On 30 April 2026, the Australian Prudential Regulation Authority (APRA) published an open letter signalling a shift in its stance on the adoption of AI tools by Australian insurers and the associated prudential risks.

APRA is the authority responsible for the prudential regulation of banks, insurers, and superannuation trustees in Australia. The authority expressed concerns after its targeted review of APRA-regulated entities found that there was an increasing lag between the adoption of emerging AI technologies, and the implementation of appropriate risk management strategies.

APRA discovered that rapidly evolving AI risks have surpassed entities' existing risk management frameworks, particularly in cybersecurity, governance, supplier risk management, and change management and assurance.

While APRA has traditionally taken a technology-agnostic approach to the risks associated with new technologies, offering principle-based guidance rather than technology-specific rules, the supervisory review findings have prompted the regulator to issue a set of minimum expectations for AI. This indicates a transition to more active supervision of AI.

Security

APRA's view is that the rapid rise of AI has substantially altered the cyber threat landscape with many regulated entities struggling to keep pace with new and evolved risks. APRA found that many entities have not adapted their security controls quickly enough to keep pace with the risks created by new AI technologies. The regulator identified gaps in security testing, monitoring and remediation processes.

To address these risks, APRA expects active management of security vulnerabilities including:

•  Understanding where the entity relies on AI for critical operations
•  Maintaining effective controls against AI-specific threats, and testing those controls; and
• Considering the risks arising from concentrating reliance on common technology platforms and third-party providers.

Governance

APRA also found that governance arrangements have not evolved at the same pace as AI adoption. It observed a tendency to treat AI as ‘just another technology', with entities recognising that prudential standards apply to AI, but failing to adapt their governance frameworks to address the technology's specific risks. The regulator highlighted concerns around issues such as model behaviour, biases, privacy and accountability.

APRA expects regulated entities to establish clear governance arrangements for AI including:

•  implementing policies, standards, and guidance to promote the safe and sustainable adoption of AI;
• ownership and accountability across the AI lifecycle;
• human involvement for high-risk decisions; and
• training and education for staff on AI use, misuse, limitations and practices.

Supplier risk management

Another key concern for APRA was regulated entities' increasing dependence on third-party AI providers. APRA found that many entities rely on a small number of providers across multiple business functions, with the overreliance creating concentration risks. It also found that entities generally lack visibility over how AI services operate behind the scenes.

APRA expects regulated entities to:

• maintain a clear understanding of their AI supply chains;
• ensure transparency and oversight of AI providers;
• monitor provider performance over time; and
• consider contingency arrangements if a critical provider becomes unavailable.

Change management and assurance

APRA's review found that traditional change management and assurance processes are often not suited to AI systems, which can evolve, adapt and produce varying results over time.

The regulator observed that many regulated entities rely on point-in-time reviews that may not identify emerging risks such as model drift, bias, or control failures. APRA expects entities to:

• employ globally recognised control frameworks for AI implementation;
• conduct thorough risk assessments prior to deployment; and
• ensure that risk management and internal audit functions are capable of independently assessing AI systems.

Comments

APRA's shift in its supervisory approach, combined with its research findings reinforce that the rapid adoption of AI poses significant risks to APRA-regulated entities. Insurers must look beyond traditional risk frameworks to meet the regulator's expectations.

The letter provides early guidance on effectively managing the unique challenges of this fast-evolving technology. Reassessing current governance and risk controls, and embedding specific AI protocols now will ensure regulated entities are resilient against emerging threats.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.