Two regulators wrote to Australian industry about artificial intelligence within eight days of each other. APRA’s letter landed on 30 April 2026; ASIC’s followed on 8 May. Both were addressed to specific entities: banks, insurers, superannuation trustees and financial services licensees. If your company sits outside that perimeter, the easy conclusion is that neither letter is for you.
APRA’s letter doesn’t bind you, but it still matters because it is now the clearest Australian account of what a board is expected to understand about AI, and a director’s duty of care does not stop where APRA’s jurisdiction does.
The letters are doing different work
ASIC’s letter is a cyber resilience letter with AI at the edge of it. Strip away the AI framing (a frontier model gets a name-check as a threat accelerant) and the work it asks for is familiar: patch faster, shrink the attack surface, review privileged access, exercise incident playbooks and manage third-party concentration. It has a governance section and it is addressed to directors, but the governance it asks for is cyber assurance, and AI itself appears once, as one emerging risk to be integrated into the risk framework. ASIC ties the letter to its $2.5 million court outcome against FIIG Securities and reframes cyber resilience as a licensing obligation rather than an IT problem.
APRA’s letter is harder to treat as a cyber uplift exercise. Cyber is one of its four sections; the other three are AI governance proper, covering lifecycle ownership from design through to decommissioning, AI inventories, model drift and degradation, supplier and fourth-party concentration, and assurance that keeps working after the first test. APRA states plainly that point-in-time, sample-based assurance does not work for systems that learn and degrade over time. It also names the mistake directly: treating AI as “just another technology.”
That mistake is not confined to financial services; it describes most boards, in most sectors, right now.
APRA put the board in the frame
This is the part of APRA’s letter that should make directors pause, regulated or not.
APRA did not gently recommend that boards improve their AI literacy as a matter of good practice. It wrote that many boards are still developing the technical literacy required to provide effective challenge on AI risk, and that some are relying too heavily on vendor presentations and summaries without enough examination of the underlying risks.
Then APRA set a floor: at a minimum, boards are expected to understand enough to set strategic direction, provide effective challenge and oversee an AI strategy with clearly defined triggers aligned to resilience objectives. That is not a call for directors to become machine learning specialists. It is a statement about the level of understanding required before a board can credibly approve, challenge or tolerate the use of AI in the business.
APRA was describing the boards it supervises. But nothing in that description is specific to a bank. A board over-relying on vendor decks, unable to interrogate the AI risk in front of it, is a board you will find in energy, retail, healthcare and any ASX-listed company that has let AI into its operations faster than it has built the capacity to oversee it. APRA simply looked first.
The standard won’t stay inside APRA’s perimeter
APRA is the heaviest-hitting financial regulator in the country, and when it publishes what it expects of boards, that statement does not stay neatly inside the financial sector. It becomes a reference point: for directors’ institutes, for auditors, for the D&O insurers pricing directors’ risk, and (this is where the legal exposure lives) for the standard a court applies when it asks whether a director did their job.
Every company director in Australia owes a duty of care and diligence under section 180 of the Corporations Act. That duty is not a fixed checklist. The standard is objective: it asks what a reasonable director, in that company’s circumstances and that director’s role, would have done. And the reasonable director is not frozen in time. The standard rises as expectations rise, and an authoritative, regulator-issued account of what boards should understand about a risk is exactly the kind of material that moves it.
APRA’s letter does not claim to bind non-regulated entities. But it now sits in the record as a considered statement of what competent AI oversight looked like in 2026. A director who cannot interrogate AI risk after 30 April 2026 is not dealing with an undefined risk. The expectation has been written down, and anyone later assessing the duty of care will have it at hand.
The same logic reaches the protection directors rely on. The business judgment safe harbour holds only where directors informed themselves about the subject of the decision to the extent they reasonably believed appropriate. A board that cannot meaningfully assess the AI risk in a decision has not met that condition. It has not made an informed judgement; it has deferred one and called it a judgement.
For some boards the exposure is sharper still. APRA-regulated entities carry it through the Financial Accountability Regime, where directors are named accountable persons and the letter directly informs the “reasonable steps” they are required to take. Critical infrastructure operators already give their boards a formal role in attesting to a risk management program. Listed-company boards answer to ASX governance expectations on risk oversight. The route differs by sector, but no regulatory perimeter limits the underlying duty of care.
The visible work will get the attention
The two letters are built differently, and that difference decides where board attention is likely to land.
ASIC’s letter is concrete. It can be turned into a program: patching, access reviews, incident exercises, supplier reviews, control testing, board reporting. A cyber uplift can be scoped against it, costed and reported as complete. APRA’s letter is more awkward. Its expectations on governance, lifecycle and assurance are harder to convert into a closed action item, and its finding on board literacy is harder still. There is no line item that reads “directors now sufficiently literate.”
Boards gravitate to the legible task. The risk, for any board in any sector, is finishing the visible program (the cyber uplift, the policy refresh, the vendor briefing), minuting the matter as actioned, and leaving the one finding that names the board itself entirely untouched.
Effective challenge needs more than a better briefing pack
APRA named the problem directly: boards relying on vendor presentations rather than independent examination. The response most boards will reach for (an AI literacy program, a governance workshop, a more structured briefing pack) is still a briefing response. Those things may help, but they do not answer APRA’s concern if the board’s picture of AI risk still comes mainly from the people selling, implementing or defending the technology.
What changes the position is whether the analysis reaching the board has some independence from the preferred answer: whether someone is testing the completeness of the AI inventory rather than accepting it, whether risk reporting reaches the fourth-party infrastructure upstream or stops at the named vendor, whether escalation triggers were agreed before they were needed or written after the fact. ASIC put it plainly in its own letter: boards should not “rely only on assurances” and should receive “meaningful reporting on end-to-end control effectiveness, not just activity.” That standard applies whether ASIC’s jurisdiction reaches the boardroom or not.
The more basic board problem is that AI risk rarely arrives as a coherent picture. It comes through operational, cyber, model, data, legal and procurement channels, each function accountable for its own slice and nobody necessarily accountable for whether the slices add up. A board that only receives those parts separately may feel informed while still lacking the view it needs to challenge the decision.
APRA wrote to the banks, the insurers and the super funds. But it wrote down something every board now has to reckon with: letting AI into the business while the boardroom stays unable to challenge it is no longer acceptable as a transitional position, and a court asked about a director’s duty in 2026 will have APRA’s own words to work with.
A board can decide APRA’s letter was not addressed to it. What it cannot safely do is leave the boardroom exactly as literate as APRA found the ones it looked at, and later say the expectation was invisible.