Australia's APRA Threatens Enforcement as Financial Firms Struggle with AI Risks

APRA Issues Stark Warning on AI Risks to Financial Sector

The Australian Prudential Regulation Authority has escalated its stance on AI risks, threatening enforcement action against financial firms that fail to implement adequate controls. In a letter published on Thursday, APRA warned that it will pursue stronger supervisory action and, where appropriate, enforcement against entities that do not adequately identify, manage, or control AI risks in a manner proportionate to their size, scale, and complexity 1

1

. The move reflects mounting urgency among global regulators as AI technology advances rapidly and introduces new vulnerabilities across the financial system.

Supervisory Review Exposes Critical Gaps in AI Governance

APRA's warning follows a targeted supervisory review conducted late last year examining how banks, insurers, and retirement funds are deploying and governing artificial intelligence. The review identified several critical shortcomings, including inadequate information security practices struggling to keep pace with AI threats and over-reliance on third-party AI vendors 1

1

. The regulator found that governance, risk management, and operational resilience practices are not keeping up with the scale, speed, and complexity of AI adoption 3

3

. Many financial firms still lack the technical expertise to manage AI effectively, with bank boards showing strong interest in AI's potential benefits but lacking the technical literacy required to provide effective challenge to management on AI-related risks 2

2

.

Anthropic Mythos Raises Cyber Attack Vulnerabilities

APRA is actively engaging across the sector on heightened cybersecurity threats from frontier AI models such as Anthropic Mythos, according to the letter from Therese McCarthy Hockey, an executive board member 1

1

. The regulator specifically flagged these advanced models as tools that could enhance the discovery of vulnerabilities by bad actors, thereby increasing the probability, speed, and scale of cyber attacks 2

2

. "We cannot be blind to the risks of such powerful technology - whether in our own hands or the hands of those with malign intent," stated McCarthy Hockey 3

3

. The regulator has heard clear recognition from regulated entities of the need for a step change in cyber practices in an evolving threat environment.

Concentration Risk and Vendor Dependencies Pose New Threats

Among the areas of weakness identified, APRA warned about concentration risk, where firms are heavily reliant on a single provider for multiple AI use cases 1

1

. The review detected gaps in contingency planning and an over-reliance on vendor presentations and summaries without sufficient examination of key AI risks such as unpredictable model behavior and the impact on critical operations 1

1

. The regulator noted that AI functionality is often embedded within broader software platforms or developer tooling, reducing transparency over where and how models are trained, updated, or constrained, and limiting firms' ability to completely assess and manage risks 3

3

.

Stronger AI Risk Controls Required for Critical Operations

APRA has called on companies to ensure credible fall-back processes where AI technology supports critical operations and demanded robust security testing across AI-generated code 1

1

. Among its expectations, the regulator said companies should prepare for timely action when AI tools are not operating as expected 1

1

. APRA is currently finalizing its forward plan for supervising AI risks and will continue to monitor the use of AI to assess potential prudential risks and consider whether further policy action may be needed 2

2

. While the regulator is not proposing additional requirements at this stage, McCarthy Hockey emphasized that APRA expects to see significant improvement in how entities close the gaps between the power of the technology they are using and their ability to monitor and control it 3

3

.