Australian banks face a unique AI challenge: significant opportunity for AI value alongside intense regulatory scrutiny. APRA’s expectations, combined with existing prudential standards, create a compliance framework that shapes how banks can deploy AI.

Here’s how the banking sector is navigating this reality.

The Regulatory Framework

APRA’s AI Expectations

APRA hasn’t issued AI-specific standards, but existing prudential standards apply:

CPS 234 Information Security: Requires effective information security for all information assets, including AI systems. AI systems processing customer data face the same security requirements as other systems.

CPS 220 Risk Management: Board-level accountability for risk management extends to AI risks. This requires governance frameworks that can identify, assess, and manage AI-specific risks.

CPG 235 Data Risk Management: Though guidance rather than standard, sets expectations for data quality, governance, and management – all relevant to AI.

SPS 220/SPS 232 (Superannuation): Similar expectations for superannuation trustees using AI in investment or member services.

What This Means Practically

Banks deploying AI must:

• Document AI systems in asset registers
• Apply security controls appropriate to risk
• Maintain model governance and documentation
• Demonstrate board-level risk oversight
• Ensure explainability for significant decisions
• Maintain audit trails

This creates overhead that other industries don’t face, but also creates discipline that improves outcomes.

Where Banks Are Using AI

Credit Decisioning

AI models for credit assessment and lending decisions. This is high-value but high-stakes.

What’s deployed: ML models that incorporate traditional credit bureau data plus alternative data signals. Used alongside human review, not replacing it.

Compliance requirements:

• Model explainability (why was this decision made?)
• Bias testing (are protected attributes affecting outcomes?)
• Human oversight (automated decisions require review paths)
• Documentation (model development, validation, monitoring)

Current state: Incremental AI enhancement of traditional credit models, not wholesale replacement.

Fraud Detection

AI identifying suspicious transactions and potential fraud. This is where bank AI is most mature.

What’s deployed: Real-time ML models scoring transactions. Suspicious activity triggers human investigation.

Compliance requirements:

• False positive management (blocking legitimate transactions has consequences)
• AML/CTF compliance (regulatory obligations for suspicious activity)
• Privacy obligations (monitoring customer activity requires appropriate basis)

Current state: Sophisticated, long-established, continuously improving.

Customer Service

AI chatbots and virtual assistants handling customer enquiries.

What’s deployed: Conversational AI for routine enquiries, often with escalation to human agents.

Compliance requirements:

• Disclosure (customers should know they’re interacting with AI)
• Accuracy (AI must provide correct information)
• Vulnerability (systems must handle vulnerable customers appropriately)
• Complaints (AI interactions must connect to complaints processes)

Current state: Growing deployment, with recognition that AI can’t handle all customer needs.

Internal Operations

AI for internal processes: document processing, compliance monitoring, risk assessment.

What’s deployed: Various tools for operational efficiency – often the highest-value, lowest-profile deployments.

Compliance requirements: Varies by application. Internal tools face less scrutiny than customer-facing systems but still require governance.

Current state: Quiet progress with meaningful efficiency gains.

The Explainability Challenge

Banking AI faces a fundamental tension: sophisticated models perform best, but complex models are hard to explain. Regulators and customers both demand explanation.

The trade-off: A deep neural network might predict default better than a simple model, but explaining why it made a specific prediction is harder.

How banks are managing:

• Using explainable-by-design models where possible
• Applying post-hoc explainability techniques to complex models
• Maintaining human oversight for significant decisions
• Documenting model logic even when models are complex

There’s no perfect solution. Banks balance performance against explainability requirements.

Model Risk Management

Banks have sophisticated model risk management frameworks, developed over years of regulatory pressure on traditional models. AI extends these frameworks.

Model governance requirements:

• Independent validation before deployment
• Ongoing monitoring for performance drift
• Regular review and recertification
• Clear ownership and accountability
• Documentation of development, testing, and approval

This governance adds time and cost to AI deployment but reduces risk of problematic outcomes.

Lessons for Other Regulated Industries

Banking’s AI approach offers lessons for other regulated sectors:

Lesson 1: Framework First

Banks built governance frameworks before scaling AI deployment. This sequence – framework then scale – works better than the reverse.

Lesson 2: Documentation Discipline

The documentation requirements for banking AI seem burdensome but create valuable institutional knowledge.

Lesson 3: Explainability as Feature

Treating explainability as a feature requirement, not an afterthought, produces better systems.

Lesson 4: Human-in-Loop Default

Defaulting to human oversight rather than full automation reduces risk during AI maturation.

Lesson 5: Conservative Pace

Banking’s conservative deployment pace has avoided the problems some industries faced with hasty AI rollouts.

The Vendor Consideration

Banks face additional requirements when using AI vendors:

Outsourcing standards: APRA’s outsourcing requirements apply to AI vendors handling material functions.

Due diligence: Extensive vendor assessment required before engagement.

Exit planning: Clear exit strategies required from the start.

Data handling: Vendor data handling must meet APRA expectations.

This often leads banks to prefer larger, established vendors with compliance experience – or to build internally.

Looking Ahead

Short-term (2026)

• Continued enhancement of proven AI applications
• Growing adoption of productivity AI (with governance)
• Increased regulatory engagement on AI topics

Medium-term (2027-2028)

• Potential AI-specific APRA guidance or standards
• More sophisticated AI governance frameworks
• Greater AI integration in core banking processes

Long-term

• AI as standard banking infrastructure
• More autonomous AI with appropriate safeguards
• Regulatory framework maturation

Final Thought

Australian banking demonstrates that heavy regulation and meaningful AI deployment can coexist. The regulatory framework creates discipline that improves AI outcomes even as it adds overhead.

Other regulated industries can learn from banking’s approach: build governance first, deploy carefully, document thoroughly, and maintain human oversight.

The conservative approach means banking AI is less flashy than some sectors. It’s also more reliable and sustainable.