APRA Prudential Standard CPS 230
APRA's operational risk management standard requires regulated entities to identify, assess, and manage risks from AI as material service providers.
Requirements
AI Risk Register
Governance · min. 50/100Maintain a register of all AI systems used in material service delivery, including risk ratings and review cadences.
What to document: Register of AI models: owner, purpose, data inputs, risk rating, last review date. Required under CPS 230 Attachment A.
AI Incident Response Plan
Incidents · min. 55/100AI-specific incident classification and escalation procedures integrated into the broader IRP.
What to document: AI incident runbook with severity levels (L1–L3), escalation matrix, and APRA notification triggers (material incidents within 72 hours).
Third-Party AI Oversight
Governance · min. 60/100Due diligence and ongoing monitoring of material AI service providers (e.g. hyperscalers, AI vendors).
What to document: Vendor assessment templates with AI-specific criteria: model transparency, data residency, audit rights, exit strategy.
Check readiness against CPS 230
Run the free AI State Declaration to see where the organisation stands against each requirement above.
Other frameworks
This summary is a self-assessment aid, not legal or compliance advice. Suggest a correction →