Australia's Prudential Regulator Says Assurance Practices Are Not Keeping Pace With AI at the Selected Large Entities It Engaged With

The Australian Prudential Regulation Authority, APRA, sent a letter on April 30, 2026 to all the entities it regulates. It reports what APRA found when it engaged with a group of selected large banks, insurers and superannuation trustees in late 2025, and sets out what it expects on AI. An attachment gives its observations and expectations for executives. The letter says the lessons from those larger entities will assist others that may be earlier in adopting AI. Parts of it follow, not the whole.

What APRA Found

APRA found AI being actively adopted by every entity it engaged with, at differing levels of maturity across functions such as governance, risk management and operational resilience. In addition, it says, "assurance practices are not keeping pace with the scale, speed and complexity of AI."

Boards, it says, show strong interest in AI's potential benefits, but "many Boards are still developing the technical literacy required to provide effective challenge on AI related risks and oversight." It also noted an overreliance on vendor presentations and summaries "without sufficient examination of key AI risks," such as unpredictable model behavior and the impact on critical operations.

On governance, the attachment says most entities recognize that existing prudential standards apply to AI risk, but "few have operationalised governance in practice." The gaps it names include weak controls over post-deployment monitoring, weak monitoring of model behavior, change management, and the decommissioning of AI capabilities.

Samples and Models That Change

The attachment's section on assurance says traditional change management and assurance are in place but "not sufficient for dynamic AI solutions." In it APRA reports "reliance on point in time and sample based assurance methods, despite these methods being ill suited to probabilistic models that learn, adapt and degrade over time." Few entities, it says, had continuous validation or monitoring in place to detect issues such as model drift, bias, failure modes or control breakdowns in a timely manner.

It found internal audit and risk functions challenged, many of them lacking the specialist skills and tools required to assess or audit AI, particularly where agentic behavior, automated decision making or AI-assisted code generation were involved. "As a result, assurance activities often lagged AI deployment."

What it expects "at a minimum" includes second line risk management and internal audit functions with the technical capability and tooling to assess AI systems independently, probabilistic models and agentic workflows among them, and monitoring that is "continuous and proportionate to the criticality of the use case."

A test at one point in time shows how a model behaved at that point. If the model can "learn, adapt and degrade over time," as APRA puts it, the open question is what evidence covers the time in between.

Suppliers, Contracts and Supervision

APRA observed some entities heavily dependent on a single provider for multiple AI use cases. Few entities, it found, had demonstrated robust contingency planning or tested exit and substitution strategies for critical AI providers. "Contractual arrangements often lagged practice," it says, with limited evidence of specific provisions on audit rights, model updates and deviations, incident notification or changes to data handling.

Its expectations here include contractual and governance arrangements that provide sufficient transparency, auditability and assurance over AI services. Where entities "fail to adequately identify, manage or control AI risks in a manner proportionate to their size, scale and complexity," APRA says it "will take stronger supervisory action and, where appropriate, pursue enforcement."