APRA warns banks, super funds and insurers have fallen behind on AI threat
Make us a preferred source
Make us a preferred source on Google
The news: APRA has urged the boards of Australia’s banks, superannuation funds and insurers to better manage AI risk, warning that entities’ governance and operational resilience are not keeping pace with the threat.
The industry letter, published on Thursday, confirms the regulator’s concerns about the technology. Capital Brief first reported that APRA and ASIC were holding high-level discussions with the financial services industry.
The letter recognised slow adoption could put entities at “a strategic disadvantage”, while also warning that AI creates new risks and intensifies existing challenges.
“APRA observed many boards are still developing the technical literacy required to provide effective challenge on AI related risks and oversight. APRA also noted an over-reliance on vendor presentations and summaries without sufficient examination of key AI risks such as unpredictable model behaviour and the impact on critical operations,” the letter said.
It set out the regulator’s expectation that, at a minimum, boards develop an adequate AI strategy with clear triggers for action when things go wrong. It also provided guidance for chief risk, technology and information security officers.
APRA confirmed it had been working with the Council of Financial Regulators (CFR) on the issue along with government agencies, as first revealed by this publication as super funds try to collaboratively cordinate their response to cyberattacks.
Recognising local fears around frontier models like Anthropic’s Claude Mythos, APRA said entities needed to strengthen their security defences and APRA would supervise entities closely on the matter.
“Where entities fail to adequately identify, manage or control AI risks in a manner proportionate to their size, scale and complexity, we will take stronger supervisory action and, where appropriate, pursue enforcement,” APRA said.
What they said: In an accompanying release, APRA member Therese McCarthy Hockey said entities were not keeping up with the emerging risk.
“We cannot be blind to the risks of such powerful technology — whether in our own hands or the hands of those with malign intent,” she said.
“The speed at which entities can identify and patch vulnerabilities needs to operate much faster, commensurate with the AI-accelerated threat.”
McCarthy Hockey said the regulator would continue working with the Australia government and local and global regulators to “ensure the ongoing safety and resilience of the financial system”.
“While we are not proposing to introduce additional requirements at this stage, we expect to see a significant improvement in how entities are closing the gaps between the power of the technology they are using and their ability to monitor and control it.”
The context: The announcement of Claude Mythos has sharpened the focus of global regulators on the fast-moving threat of AI-powered cybersecurity attacks, with Anthropic saying the new model is finding decades-old but severe vulnerabilities in popular browsers and operating systems.
But broader risks to systems and operational resilience have also attracted growing regulatory scrutiny since last year, including the single points of failure created by vendors.
On Thursday APRA also released the preliminary findings of its AI supervisory work, saying preventative measures were lacking.
“The use of AI increases the pathways that cyber attackers can use and lead to more frequent cyber attacks. Common attack pathways observed include prompt injection, data leakage, insecure integrations, exploit injection and the manipulation or misuse of autonomous AI agents. AI can shorten the attack cycle and increase speed, coordination and impact,” APRA observed.
It flagged concern about staff using enterprise AI tools outside approved control frameworks, and said entities were doing a poor job of managing those risks.
APRA also raised issue with many some entities being “heavily reliant” on a single AI vendor, raising concentration risk, with few entities monitoring for model drift, bias, or failure in the AI they were using.
The source: APRA letter
