Australia does not have an AI Act. It probably will not have one in 2026, and quite possibly not in 2027 either. The Australian Government’s approach, developed through successive consultations from 2023 through 2025, has settled on a strategy of applying existing law with targeted amendments where necessary. The rhetoric is “principles over prescription.”
Do not read that as absence of regulation. Read it as regulation through existing instruments, applied with intensifying supervisory attention. The two most important documents in Australian AI governance in 2026 are not statutes. They are letters from regulators. The APRA Letter to Industry on Artificial Intelligence, dated 30 April 2026, and the ASIC Letter to Industry, dated 8 May 2026. Together they signal a supervisory shift that changes what regulated entities have to be doing, on what timeline, and to what standard.
This article is a working guide to the Australian AI governance picture. It covers financial services regulation (where the action is), general-purpose law that applies to AI regardless of sector, and the practical implications for entities operating here.
The two-track structure
Australia’s regulatory architecture for AI has two tracks.
The first track is sector-specific supervision by financial regulators. APRA regulates the prudential soundness of banks (ADIs), insurers, and superannuation trustees. ASIC regulates market conduct and licensee behaviour across financial services and markets. Both have applied their existing frameworks to AI, and both intensified that application in 2026.
The second track is general-purpose law that applies to any use of AI regardless of sector. The Privacy Act 1988 (administered by the OAIC), anti-discrimination law (federal and state), consumer protection law (administered by the ACCC), communications law (administered by the ACMA), and AUSTRAC’s anti-money-laundering framework all apply to AI systems where their subject matter is engaged.
For any given AI system, both tracks may apply. A bank using AI for fraud monitoring engages APRA’s operational risk expectations, ASIC’s licensee conduct obligations, the Privacy Act, AUSTRAC’s AML/CTF requirements, and consumer protection law simultaneously. The governance program has to address all of them, not just the most prominent one.
APRA: what the 30 April 2026 letter did
The APRA Letter to Industry on Artificial Intelligence was signed by Therese McCarthy Hockey, APRA Member, and addressed to every APRA-regulated entity: every Australian bank, general and life insurer, private health insurer, and superannuation trustee. Its stated purpose was to communicate the observations of a targeted supervisory engagement conducted in late 2025 across a sample of the largest banks, insurers, and superannuation trustees.
What the letter is worth understanding for.
APRA did not issue new rules. Its principle-based prudential framework is technology and vendor agnostic. CPS 230 (Operational Risk Management), CPS 234 (Information Security), CPG 235 (Data Risk), and CPS 510 (Governance) apply to AI as they apply to any other operational activity. The letter clarifies what those standards mean in practice for AI. It does not add to them formally.
APRA identified four areas of concern. The observations are not framed as findings against specific entities, but as gaps identified across the sample and expected to be present in similar form across the broader regulated population.
The first area is governance and board oversight. APRA observed strong board interest in AI’s strategic upside, but noted overreliance on vendor presentations and summaries without sufficient examination of key AI risks. Many boards, in APRA’s assessment, were still developing the technical literacy required to provide effective challenge on AI-related risks. APRA expects boards to maintain sufficient understanding to set strategic direction, provide effective challenge, and oversee an AI strategy that aligns with the entity’s risk appetite.
The second area is operational governance and lifecycle accountability. APRA observed AI systems being deployed without full inventories, unclear lifecycle ownership, weak post-deployment monitoring, weaker model behaviour monitoring, and largely absent decommissioning processes. APRA expects consistent governance arrangements including frameworks and reporting lines, ownership and accountability across the lifecycle, an inventory of AI tooling and use cases, human involvement for high-risk decisions with accountability, and structured staff training.
The third area is third-party and supply chain risk. APRA observed heavy dependence on single AI providers for multiple use cases, with limited business continuity or exit and substitution strategies. Contractual arrangements often lagged practice, with limited evidence of specific provisions addressing audit rights, model updates, incident notification, or data handling. APRA expects entities to map and maintain visibility over the full AI supply chain, including material third and fourth-party dependencies, and to have contractual and governance arrangements that provide transparency, auditability, and assurance.
The fourth area is assurance and cyber resilience. APRA observed that point-in-time, sample-based assurance is poorly suited to probabilistic systems that learn, adapt, or degrade over time. APRA also observed that AI adoption is materially changing the cyber threat landscape, opening new attack pathways including prompt injection, data leakage, insecure integrations, and manipulation of autonomous agents. APRA expects integrated assurance across cyber security, data governance, model performance risk, operational resilience, privacy, and conduct risks, and it expects entities to actively manage information security vulnerabilities including those introduced by AI-specific attack paths.
APRA signalled next steps. The letter states that APRA is continuing to develop its forward plan on supervision of AI risks and is considering whether further policy action may be needed. Translated: this is not the last word.
Figure 1: What APRA expects, at a minimum
Figure 1 shows the minimum governance arrangements APRA has identified as expected, drawn from the 30 April 2026 letter. The elements group into four clusters (governance framework, lifecycle accountability, third-party management, and assurance) that map onto CPS 230, CPS 234, CPG 235, and the board accountability provisions of CPS 510. The figure is deliberately structured to make the mapping visible, because APRA’s principal instruments have not changed; what has changed is what “compliance” with them looks like when AI is in scope.
ASIC: what the 8 May 2026 letter did
The ASIC Letter to Industry, released a week after APRA’s, focused on cyber resilience in the context of frontier AI capabilities.
ASIC’s core message was direct: AI is materially changing the cyber threat landscape, and licensees and market participants need to strengthen cyber resilience without waiting for perfect clarity on how the threat will evolve. ASIC referenced developments including the constrained release of certain highly capable frontier models due to their capacity for vulnerability discovery.
ASIC directed that the letter be tabled and discussed at board and risk governance committees. The regulator’s expectations focused on: assessing implications of AI reliance for operational resilience and business continuity; considering the impact of new AI technologies on existing CPS 230 and CPS 234 obligations (in coordination with APRA); implementing security controls that address AI-specific threats and attack paths; reassessing cyber plans with focus on the most critical risks; robust security testing across AI-generated code, components, and libraries; and maintaining ongoing awareness of third-party and concentration implications for common platforms and providers.
ASIC also emphasised the licensee obligations that apply regardless of technology: responsible lending, best interests duty, anti-hawking, market integrity, and dispute resolution obligations under RG 271. All of these apply fully to AI-driven customer interactions.
Beyond financial services: the OAIC, ACCC, ACMA, and AUSTRAC
OAIC and the Privacy Act. The Privacy Act 1988 and the Australian Privacy Principles apply to AI systems processing personal information. The OAIC has been active on AI-related privacy questions, including through its 2023-2024 consultation on privacy and AI, its guidance on AI in the workplace, and its ongoing investigations. The Privacy and Other Legislation Amendment Act 2024, which passed in late 2024, introduced targeted amendments including new provisions on automated decision-making that will take effect through 2026. Organisations processing personal information through AI need to consider both existing APP obligations and the emerging automated decision-making requirements.
ACCC and consumer protection. The Competition and Consumer Act 2010 applies to AI-driven consumer conduct. The ACCC has actioned representations about AI capabilities that were found to be misleading, and has raised concerns about competition dynamics in AI markets, particularly around foundation model concentration.
ACMA and communications. The Australian Communications and Media Authority has issued guidance on AI-generated content, particularly in the context of the misinformation and disinformation framework and content service regulation.
AUSTRAC and AML/CTF. AI is widely used in transaction monitoring for anti-money-laundering purposes. AUSTRAC expects regulated entities to be able to explain how AI models are trained, validated, and calibrated as part of their AML/CTF programs. The AML/CTF regime is expanding in stages through the first half of 2026 to cover additional sectors, which brings more entities into AUSTRAC’s scope.
The Robodebt Royal Commission findings, though focused on government, have materially changed Australian regulators’ tolerance for automated decision-making that produces adverse consequences for individuals. Any AI system that generates adverse decisions affecting individual rights should now be designed with human review and clear grounds for the decision, regardless of sector.
The CPS 230 vendor contract deadline
One specific operational deadline warrants highlighting. CPS 230 requires regulated entities to have arrangements with material service providers that meet the standard’s requirements. Existing contracts must be updated at the earlier of their next renewal or 1 July 2026.
For AI vendors, this means contracts should now cover, at a minimum: audit rights (including access to relevant technical information); notification of model updates and material deviations; incident notification with specified timeframes; data handling obligations; business continuity and exit provisions; and allocation of responsibility for compliance with legal and regulatory obligations that continue to apply to the regulated entity.
Organisations that have not already begun this contract review should treat it as urgent. Most large AI vendors are being asked for the same updates by their many regulated customers simultaneously, and turnaround times are tightening.
The Australian AI Safety Standard and Voluntary AI Code
Beyond the sector-specific and general-purpose picture, Australia has also produced two non-binding instruments that shape practice.
The Voluntary AI Safety Standard (September 2024) sets out ten guardrails for organisations developing or deploying AI. It is voluntary but has been influential in shaping expectations, particularly for organisations that do not sit under specific regulator supervision.
The proposals in the government’s consultation on mandatory guardrails for high-risk AI, released September 2024, are under active consideration. If enacted, they would introduce a horizontal framework similar in shape to (but distinct from) the EU AI Act. As of mid-2026, no legislation has been introduced. The timing remains uncertain.
Australia’s Artificial Intelligence Ethics Framework (2019) continues to operate as a set of eight voluntary principles for responsible AI. It informs government AI use and public sector guidance.
What organisations should do
If you are a regulated financial services entity in Australia, five moves matter.
Table the APRA and ASIC letters at the board and risk committees. Both regulators expect this. Both letters are structured to support that discussion. The chair’s discussion notes should reference each of the observations in the APRA letter and each of the expectations in the ASIC letter. This is documentation of governance response.
Build or refresh your AI inventory. APRA’s expectations start here. A live inventory of every AI system in production and development, with named ownership across design, deployment, monitoring, and decommissioning, is the foundation.
Assess vendor concentration and exit strategies. For each material AI provider, document the exit strategy and, where possible, test it. APRA has been explicit that this is a CPS 230 obligation and that supervisory attention is on it now.
Update contracts by 1 July 2026. For material AI vendors, contract updates should be complete. For non-material vendors, next renewal is the target.
Move to continuous assurance. Point-in-time controls testing is inadequate for AI systems. Build monitoring that runs continuously and produces evidence for second-line risk, internal audit, and the board.
If you are not a financial services entity, the framework is different but the discipline is similar. Privacy Act compliance for AI processing personal information is not optional. Consumer protection obligations apply to representations about AI capabilities. Anti-discrimination law applies to AI-driven decisions. And the direction of travel, based on the government’s own consultations, is toward eventual horizontal regulation with similar expectations to those APRA has just crystallised.
Figure 2: The Australian regulatory architecture
Figure 2 shows the layered structure of Australian AI regulation as of mid-2026: sectoral prudential and conduct supervision at the top (APRA and ASIC), general-purpose regulator supervision in the middle (OAIC, ACCC, ACMA, AUSTRAC), voluntary standards and frameworks below (Voluntary AI Safety Standard, AI Ethics Framework), and general law as the foundation. Any given AI system in Australia sits within multiple layers of this architecture simultaneously. Governance programs that address only one layer will miss real obligations.
What comes next
The Australian picture is stable in shape but intensifying in supervision. Boards and executives of regulated entities are on notice. The next 12 months will produce more specific supervisory action against entities that have not moved. The APRA letter used the word “urgency” for a reason.
For non-financial-services entities, the picture is quieter but building. The government’s mandatory guardrails proposals remain live. Privacy and anti-discrimination obligations are active now. And the market-level pressure toward AI governance discipline (from insurers, from customers, from investors, from the Robodebt precedent) is real regardless of what the regulators do next.
The next article covers Singapore and the wider APAC region, where the FEAT principles, the Veritas Toolkit, and the MAS Guidelines have produced what I think is the most sophisticated sector-specific AI governance framework in the world today. There is a lot to learn from it, whether or not you operate there.