APRA Issues Supervisory Letters to 4 Regulated Entities for AI Governance Failures
Multiple APRA-regulated entities
What happened
APRA identified material AI governance failures at four regulated financial institutions during supervisory reviews and issued formal supervisory letters. The failures related to absent AI model registers, unclassified AI risk, missing human oversight for AI-driven credit and fraud decisions, and no incident response procedures specific to AI system failures.
Root cause
AI deployed into production-critical financial processes without the governance infrastructure that CPS230 and CPS234 require; model registers absent or covering only ML models, not LLM-based systems.
Architectural failure
No centralised AI model register; AI risk not classified at intake; no documented approval workflow for AI deployment in regulated processes; no AI-specific incident response runbooks.
Outcome
Formal supervisory letters issued — the most significant APRA AI enforcement action to date. Entities required to remediate within defined timeframes.
Architectural Failure Patterns
These pattern categories on aipatterns.com.au describe the systemic failure modes this incident exhibited.
Cite this incident
https://corporateai.com.au/incidents/apra-ai-governance-failures-2026Quick facts
- Date
- 1 April 2026
- Organisation
- Multiple APRA-regulated entities
- Sector
- Banking
- Severity
- Critical
- Regulatory bodies
- APRA CPS230APRA CPS234
- Tags
- aprasupervisory-actionbankingai-governancemodel-registerenforcementaustralia
Related in Banking
NatWest Cora Chatbot Gave Incorrect Guidance to Vulnerable Customers
NatWest · 1 June 2023
Westpac AML Monitoring Missed 23M+ Transactions — $1.3B Penalty
Westpac Banking Corporation · 20 November 2020
Apple Card Algorithm Allegedly Gave Women Lower Credit Limits Than Husbands
Apple / Goldman Sachs · 10 November 2019
Explore failure patterns
aipatterns.com.au