Privacy policies need an automated decision-making section by 10 December 2026.
Draft yours free

AI in Australian financial services

No AI-specific statute governs Australian financial services. Instead, ASIC and APRA have both said existing licensee obligations, director duties and prudential standards apply in full to AI, and both regulators have put the industry on notice about governance gaps. A hard legislative deadline is coming: automated decision-making disclosure under the Privacy Act from 10 December 2026.

ASICAPRAOAICAUSTRAC

Last reviewed October 2026. Every entry links to its official source.

The rules

What applies today

ASIC's first review of AI use by 23 licensees covering 624 use cases across banking, credit, insurance and advice. It found adoption accelerating while governance lagged: nearly half of licensees had no policies covering consumer fairness or bias. ASIC's position is that existing consumer protection provisions, director duties and licensee obligations already put the onus on institutions to govern AI properly. No new law is needed for those duties to bite.

Who this affects: AFS licensees and credit licensees using or planning AI.

Latest updates

What changed recently

  1. South Australia's Royal Commission into Artificial Intelligence commenced, with Dr Iain Ross AO as chair alongside Kate Pounder and Professor Christopher Manning. It reports by 1 July 2027.

    ABC News: three experts appointed to lead SA's Royal Commission into AI

  2. The OAIC published its final guidance on the automated decision-making transparency obligation: a fact sheet on APP 1.7 to 1.9, a supplementary sheet for agencies, a flowchart and an updated Chapter 1 of the APP Guidelines. Computer program is read broadly, human review does not remove the duty where the program's output is a material input, and there is no grace period after 10 December 2026.

    OAIC: new resources on transparency for AI and automated decision-making

  3. The Prime Minister disclosed that an OpenAI agent had bypassed access controls on a Services Australia Medicare statistics portal on 18 June 2026, with notification reaching the Government 84 days later. An Office of AI taskforce with ASD and the AI Safety Institute is reviewing the incident, and the Government said mandatory, timely AI incident reporting will be part of the Australian Standards for AI, to be introduced by the end of 2026.

    ABC News: AI agent accessed Australian government site, PM says

  4. The Office of AI in PM&C opened consultation on the Australian Standards for AI, proposing mandatory standards for large data centres and conditions for AI training rather than obligations on organisations deploying AI; submissions close 9 October 2026.

    PM&C: have your say on AI training and infrastructure

  5. The Information Commissioner told the Law Council the OAIC is on the verge of releasing its guidance on the automated decision-making transparency obligation that commences 10 December 2026.

    OAIC: Law Council of Australia address

  6. The Council of Financial Regulators flagged frontier AI and critical third parties as system-wide operational risks and noted the APRA and ASIC roundtable paper.

    Council of Financial Regulators quarterly statement

  7. The Attorney-General released the Privacy Amendment (Personal Data Protection) Bill 2026 exposure draft, with a fair and reasonable test for handling personal information and express coverage of AI-derived information; submissions closed 18 September 2026.

    AGD consultation: privacy reform

  8. APRA and ASIC published Resilience at Frontier AI Speed, insights and a board preparedness checklist from nine industry roundtables, warning entities to move from awareness to tested action.

    ASIC media release 26-201MR

  9. National Cabinet agreed the Commonwealth will legislate nationally consistent AI laws and mandatory standards for large data centres in early 2027, complementing state and territory planning processes.

    National Cabinet communique

  10. Parliament appointed a Joint Select Committee on Artificial Intelligence, naming financial services among the sectors it will examine, reporting by 30 November 2026.

    Parliament of Australia: Joint Select Committee on AI

  11. The Prime Minister announced an Office of AI within PM&C and a commitment to legislate Australian Standards for AI, with legislation expected early 2027. Financial services obligations remain regulator-led until then.

    PM media release: AI in Australia's interests

  12. APRA's System Risk Outlook named AI a key system risk, warning that AI is being adopted rapidly across all regulated industries while governance arrangements have not matured at the same pace.

    APRA System Risk Outlook

  13. The OAIC opened consultation on guidance for the automated decision-making transparency obligation that commences 10 December 2026, with guidance expected before commencement.

    OAIC ADM consultation

  14. ASIC issued an open letter to all AFS licensees demanding an urgent cyber uplift against AI-accelerated threats, with twelve actions and a direction to table the letter at board level.

    ASIC 26-092MR

  15. APRA published its letter to industry on AI, setting minimum board and executive expectations and flagging stronger supervisory action and possible enforcement where AI risks are unmanaged.

    APRA letter to industry on AI

Getting ready

Compliance checklist

  • Keep an inventory of every deployed and planned AI use case, with policies covering consumer fairness, bias and disclosure. ASIC found nearly half of licensees lacked these. See the rule

  • Treat efficient, honest and fair services, misleading-conduct prohibitions and director duties as applying fully to AI outputs today. Do not wait for AI-specific legislation. See the rule

  • Build board AI literacy: the board should be able to genuinely challenge AI strategy and receive AI risk reporting with defined escalation triggers. See the rule

  • Fold AI into CPS 230: register AI vendors and foundation-model dependencies as potentially material service providers and test contingency plans for supplier concentration. See the rule

  • Harden AI-specific security: test for prompt injection, data leakage and insecure integrations, and extend identity management to non-human and agentic actors. See the rule

  • Update your privacy policy before 10 December 2026 if automated systems use personal information to make or substantially contribute to decisions that significantly affect people. See the rule

  • Document AI transaction-monitoring tools in your reformed AML/CTF program and keep qualified human oversight over suspicious-matter reporting. See the rule

Straight answers

Questions people ask

What did ASIC Report 798 find about AI governance?

REP 798, Beware the gap (October 2024), reviewed AI use by 23 licensees across 624 use cases in banking, credit, insurance and advice. It found adoption accelerating while governance lagged: nearly half of licensees had no policies covering consumer fairness or bias. ASIC's position is that existing consumer protection provisions, director duties and licensee obligations already require institutions to govern AI properly, so no new law is needed for those duties to apply.

Is there an AI-specific law for Australian financial services?

No. ASIC and APRA have both said existing licensee obligations, director duties and prudential standards apply in full to AI. The hard legislative date is the Privacy Act's automated decision-making disclosure, which commences on 10 December 2026 and catches AI used in credit scoring, claims handling, pricing and onboarding. The Australian Standards for AI announced in July 2026 target large data centres and AI training, not firms deploying AI.

What does APRA expect boards to do about AI?

APRA's April 2026 letter to industry reported that security practices were lagging (prompt injection, data leakage, non-human identity gaps), that governance was not maturing at the pace of adoption, and that AI supply was concentrated on a few providers. Boards are expected to have enough AI literacy to challenge management, and APRA said it will take stronger supervisory action and pursue enforcement where AI risks are unmanaged. The joint APRA and ASIC paper of 27 August 2026 adds a board checklist built from nine frontier AI roundtables.

Do AI vendors count as material service providers under CPS 230?

They can. CPS 230 is not AI-specific, but AI suppliers and foundation-model dependencies that support critical operations can be material service providers that must be registered, risk-assessed and notified to APRA. Transitional relief for pre-existing contracts ended at the earlier of contract renewal or 1 July 2026.

How can financial institutions govern AI-driven transactions and decisions?

Keep an inventory of every deployed and planned AI use case with policies on fairness, bias and disclosure; treat the efficient, honest and fair obligation and misleading-conduct prohibitions as applying to AI outputs today; give the board AI risk reporting with escalation triggers; fold AI vendors into CPS 230; test for prompt injection and data leakage; document AI transaction-monitoring tools in the reformed AML/CTF program with human oversight of suspicious-matter reporting; and update the privacy policy before 10 December 2026.

Has the OAIC published its automated decision-making guidance?

Yes. On 30 September 2026 the OAIC published a fact sheet on APP 1.7 to 1.9, a supplementary fact sheet for agencies, a flowchart and an updated Chapter 1 of the APP Guidelines, built on 90 submissions to its May 2026 issues paper. The guidance reads computer program broadly, confirms that human review does not remove the duty where the program's output is a material input, and keeps the commercial-in-confidence carve-out narrow. The obligation commences 10 December 2026 with no grace period.

Show your customers you're across all of this

Certification against Australia's AI Ethics Principles is independent proof that your business uses AI responsibly, before a client, regulator or tender asks.

Get certified