Australian Regulator Warns Financial Firms on AI Risk Management Gaps

Australian Prudential Regulation Authority has called for stronger management of artificial intelligence risks across the financial sector, according to a press release. The regulator said that governance, assurance, and operational resilience practices are lagging behind the speed and complexity of AI adoption.

The findings come from a supervisory review that examined how banks, insurers, and superannuation trustees are deploying and governing AI systems. APRA noted that many boards show interest in AI's potential benefits but often lack the technical understanding to oversee related risks effectively. It also identified growing concentration risk, with some firms relying heavily on a single provider for multiple AI applications.

The review highlighted that AI functions are frequently embedded within broader software platforms or developer tools, reducing transparency about how models are trained or updated. APRA also cautioned that advanced models such as Anthropic’s Claude Mythos could increase the likelihood and speed of cyber attacks by helping malicious actors find system vulnerabilities.

APRA member Therese McCarthy Hockey said entities must continuously adjust their cyber practices to address the faster threat environment. While the regulator is not introducing new requirements, it expects significant improvement in how institutions align AI oversight with prudential standards in governance, information security, and operational risk management.