01 / GOVERNANCE50
AI Risk Register
What must be documented
Register of AI models: owner, purpose, data inputs, risk rating, last review date. Required under CPS 230 Attachment A.
58readiness
threshold
threshold
Requirements3
Average minimum55
Strictest control60
02 / INCIDENTS55
AI Incident Response Plan
What must be documented
AI incident runbook with severity levels (L1–L3), escalation matrix, and APRA notification triggers (material incidents within 72 hours).
03 / GOVERNANCE60
Third-Party AI Oversight
What must be documented
Vendor assessment templates with AI-specific criteria: model transparency, data residency, audit rights, exit strategy.
DECISION
Run organisation benchmark Test the organisation against the same threshold.
Self-assessment aid only; not legal or compliance advice.