When the Regulator Says your AI Governance Isn’t Good Enough

APRA’s April 2026 letter to industry lands a challenge that goes well beyond financial services.

On 30 April 2026, APRA released a letter to all APRA-regulated entities: banks, insurers, superannuation trustees and private health insurers. It summarises common weaknesses found through a targeted engagement with a group of large institutions in late 2025, and sets out APRA’s expectations going forward. Signed by APRA Member Therese McCarthy Hockey, the message is that governance, risk management and assurance practices are not keeping pace with AI adoption, boards are still building the technical literacy to challenge what management is doing with AI, and traditional assurance methods weren’t designed for systems that learn and change over time.

The letter is not a consultation paper. It sets out specific weaknesses, clear supervisory expectations, and a warning: APRA has said plainly that where entities fail to manage AI risk proportionate to their size and complexity, it will take stronger supervisory action and pursue enforcement where appropriate. It’s worth noting that despite the warning, the letter opens by acknowledging the opportunity AI presents, and the strategic risk of not adopting it. Read in full, the letter is making a case for AI governance rather than AI caution.

For organisations working with APRA-regulated clients or operating in any sector where AI is being used to make decisions that matter, the underlying challenge is the same.

The four problems APRA’s review surfaced

The review identified four patterns playing out across the sector. Taken together, they describe an industry where AI adoption is accelerating faster than the governance frameworks designed to manage it.

1. Information security practices have not kept up with an AI-driven threat landscape. New attack vectors like prompt injection and data leakage through model interfaces are being actively exploited. Identity and access controls have not been updated for AI agents, which don’t behave like human users and create gaps that traditional identity and access management frameworks were never designed to handle.
2. Governance maturity is lagging adoption. Most organisations recognise that existing standards apply to AI risk, but few have operationalised that recognition in practice. The failure APRA calls out is treating AI as just another technology. AI systems are probabilistic, not deterministic. They adapt, degrade and can fail in ways that are not visible until they’ve already affected customers or operational decisions.
3. Supplier concentration is building quietly. Many organisations have centralised their AI capability into a single provider, often without tested exit strategies or contractual provisions around model updates, audit rights or incident notification. The upstream dependencies (the foundation models and data sources sitting behind the tools) are often insufficiently transparent.
4. Traditional assurance is inadequate for systems that learn and change over time. Point-in-time testing was designed for software that behaves consistently once deployed but is inadequate for AI systems. APRA also found that internal audit and risk functions often lack the specialist skills and tools to assess AI systems, particularly where agentic behaviour or automated decision-making is involved.

What the letter doesn’t say

The letter is accurate but leaves two things unsaid.

The first is that the challenges identified are not primarily a financial services industry problem. They are broadly an AI adoption problem. Any organisation using AI in consequential decisions, be it claims processing, fraud detection, HR screening or customer service triage, is exposed to the same failure modes APRA has described. Regulatory status is not what determines whether AI governance matters.

The second point is perhaps more counterintuitive: good governance is what enables organisations to move faster, not slower. We see this repeatedly with clients who have invested in AI pilots and proof of concepts but are struggling to scale them into production. The blocker is almost never talent or budget alone. It’s sufficient governance to enable them to use and scale AI safely.

Without a clear AI operating model, defined accountability and controls, AI pilots stall and costs can accumulate without return. The gap between experimentation and operationalised AI gets wider, not narrower.

The organisations scaling AI with confidence right now are the ones that resolved the governance question early, rather than treating it as something to deal with once the technology was proven.

What we think good looks like

At Atturra, we help organisations navigate complex technology transformation, from large-scale ERP and business application implementations to cloud migrations across government, utilities, financial services, manufacturing and education. The governance and change challenges those programs have surfaced are not fundamentally different from what AI adoption is surfacing now. The technology is new. The organisational dynamics are very familiar.

Our approach to responsible AI is anchored to the frameworks that matter in the Australian and New Zealand context: ISO 42001, the Australian Government’s AI Ethics Principles, the DTA’s Responsible AI Policy, and the NIST AI Risk Management Framework.

What we’ve found is that the gap for most organisations isn’t knowledge of these frameworks. It’s translating them into practical governance: operating models, standards, guardrails and board reporting mechanisms that give leadership genuine visibility, and the risk function the confidence to approve production deployment.

APRA has drawn a line. The organisations that treat this as a compliance exercise will spend the next 12 months writing policies. Those that build governance into the way AI is designed, deployed and operated will build something that works, and find that they can move considerably faster as a result.

_{This article is provided for general information purposes only and does not constitute legal, regulatory or professional advice. Organisations should obtain advice tailored to their specific circumstance}