APRA and ASIC warn frontier AI awareness must turn to action

APRA and ASIC have told financial market entities to move from awareness of frontier artificial intelligence risks to concrete action, publishing a joint report summarising insights from nine industry roundtables held in June and July 2026. The roundtables involved more than 600 attendees from over 380 entities, including banks, insurers, superannuation trustees, financial market infrastructure operators, market intermediaries, payment providers and material service providers, and were supported by the Australian Signals Directorate with participation from the Reserve Bank of Australia, Treasury and the ACCC.

The regulators said frontier AI is accelerating existing cyber, technology and operational risks by increasing the speed, scale and sophistication of threats, and is also creating potential for unintended outcomes from increasingly autonomous agentic systems. Key themes from the roundtables included the importance of getting cyber fundamentals right, such as identifying and managing critical assets and systems, timely patching, strong identity and access controls, attack surface reduction, backup integrity and third-party risk management. Participants also discussed the need for boards to settle decisions on risk appetite, escalation authority, recovery priorities and communication strategies before an incident occurs, given that frontier AI can compress incident response timeframes. The report noted growing interest in defensive AI applications such as threat intelligence and vulnerability detection, while acknowledging that industry capability in this area remains limited, and flagged that shared dependencies on common third-party service providers can turn isolated incidents into broader sector-wide disruption.

The publication builds on earlier letters APRA and ASIC issued in April and May 2026 setting expectations for frontier AI preparedness. It does not create new legal obligations but reflects the regulators' assessment of where entities currently fall short of expected practice, and signals that supervisory attention on AI governance and incident readiness is likely to continue.