Frontier AI: APRA And ASIC Expect Action, Not Awareness

APRA and ASIC have called on regulated entities to demonstrate that their governance, cyber controls, operational resilience and third-party risk arrangements can operate at frontier-AI speed.

Key takeaways

• Frontier AI is accelerating cyber, technology and operational risks and reducing the time available to respond.
• APRA and ASIC expect regulated entities to move from awareness to demonstrable preparedness.
• Boards and executives should test crisis decision-making, escalation, recovery and communications arrangements before an incident occurs.
• Firms should identify critical third-party providers, concentration exposures and common dependencies.
• Governance decisions, testing and remediation should be clearly and contemporaneously documented.

APRA and ASIC have published Resilience at Frontier AI Speed: Insights from the APRA–ASIC Industry Roundtables¹, setting out the outcomes of nine industry roundtables examining preparedness, governance, cross-industry collaboration, resilience, and concentration and dependency risks. The roundtables involved more than 600 attendees from over 380 entities across Australia’s financial system. The joint publication followed APRA’s Letter to Industry on Artificial Intelligence (AI), published on 30 April 2026, and ASIC’s open letter to licensees and directors, published on 8 May 2026, which called for urgent cyber resilience uplift as frontier AI accelerates cyber threats.

The central message is clear: frontier AI is accelerating cyber, technology and operational risks, compressing the time available to identify, escalate and respond to incidents. Regulated entities must move beyond awareness to preparedness. The regulators do not expect firms to wait for prescriptive guidance. They expect existing governance, decision-making and risk frameworks to be strengthened as the threat landscape changes.

APRA and ASIC expect firms to show they can make timely decisions, maintain critical operations and recover from rapidly evolving incidents involving multiple parties and complex external dependencies. This applies across the sector, with frameworks and controls proportionate to each organisation’s size, complexity and systemic importance.

Key themes from the Roundtables

Cyber fundamentals remain essential. Firms should be able to evidence effective asset and attack-surface visibility, timely patching, strong identity and access controls, monitoring, backup integrity and recovery arrangements. Legacy systems require particular attention where they create vulnerabilities or restrict response and recovery options. Defensive AI may assist with threat intelligence, vulnerability detection, code review and incident response, but the regulators emphasise that it is not a substitute for core controls. Any defensive AI capability must itself be securely configured, tested, monitored, governed and subject to human oversight.

Crisis decisions must be made before the crisis.

Governance processes, risk appetites and escalation arrangements cannot be created amid a crisis. Boards and executives should actively review incident plans and test whether escalation authority, shutdown decisions, recovery priorities and communications strategies will operate effectively during a cyber event. Compressed response timeframes driven by frontier AI speed will demand rapid and decisive action. Boards and executives should understand their roles and test them through realistic crisis exercises. Regulators will look for evidence that frontier AI risks have informed governance, investment and risk decisions.

Common suppliers can create system-wide contagion risk.

Common reliance on cloud services, software-as-a-service platforms, AI model providers, open-source components, payments infrastructure and telecommunications may transform an isolated incident into sector-wide disruption. Firms should identify which providers support critical operations, map shared dependencies, assess substitutability and test fallback, restoration and reconnection arrangements under accelerated scenarios. Contractual responsibility should align with operational reality. However, outsourcing does not transfer a regulated entity’s continuing accountability.

Resilience also requires collaboration.

APRA and ASIC encourage participation in industry threat-intelligence sharing, dependency mapping, supplier assurance and coordinated incident exercises. These recommendations echo findings arising from ASIC and APRA’s review of the coordinated cyberattack on superannuation funds in April 2025: when a threat or attack is detected, organisations should share relevant intelligence promptly. Industry would benefit from clearer communication pathways between organisations and clearer parameters for information sharing, while protecting commercially sensitive information and complying with competition law.

The joint roundtable publication builds on APRA’s Letter to Industry on Artificial Intelligence (AI) of 30 April 2026² and ASIC’s 8 May 2026 open letter to licensees and directors³. Together, those publications raised concerns about:

• the adoption of AI tools outpacing governance, risk management, assurance and operational resilience, with some boards and executives lacking the technical literacy needed to challenge risks or test vendor claims;
• an expectation that boards align AI strategy with risk appetite, establish clear lifecycle accountability, maintain inventories of tools and use cases, provide human oversight for high-risk decisions and train staff; and
• the acceleration of cyber threats through frontier AI, which lowers barriers to sophisticated attacks and increases their speed, scale and capacity to exploit combined weaknesses.

Demonstrably effective and proportionate cyber risk management is integral to the licence obligations of both ASIC- and APRA-regulated entities. Recent enforcement action against FIIG Securities⁴ and Bendigo and Adelaide Bank⁵ underscores the regulatory priority placed on cyber risk and resilience.

What firms should do now

ASIC and APRA have made clear through their industry engagement that supervisory focus will be on implementation, rather than policy statements alone. Licensees should expect regulators to seek tangible evidence that governance, cyber controls, operational resilience and third-party risk arrangements can operate at frontier-AI speed. For APRA-regulated entities, this work should be integrated with obligations under CPS 230 and CPS 234. For all entities, the risk should be integrated throughout the compliance and governance lifecycle, including directors’ and officers’ oversight duties, incident notification requirements, contractual commitments to customers and counterparties, and the adequacy and accuracy of representations concerning security and resilience.

Immediate priorities should include:

• well-documented, evidence-based and scenario-tested crisis plans, including reviewed incident response and communications protocols;
• testing backups and recovery arrangements against compressed attack timelines, and mapping critical providers and concentration exposures;
• assessing whether supplier contracts provide adequate assurance, audit, notification, continuity and exit rights; and
• confirming that AI-enabled security tools have clear accountability and appropriate human oversight.

This work should be clearly and contemporaneously documented. If an incident occurs, those records may assist directors and FAR-accountable executives to demonstrate the basis for their decisions, the steps taken and the operation of the organisation’s governance and risk frameworks.

Footnotes

1. Insights from the APRA-ASIC Industry Roundtables | APRA

2. APRA Letter to Industry on Artificial Intelligence (AI) | APRA

3. 26-092MR ASIC calls for urgent cyber uplift as AI accelerates cyber threats | ASIC

4. Australian Securities and Investments Commission v FIIG Securities Limited [2026] FCA 92

5. Bendigo and Adelaide Bank admits to breaching its BEAR obligations in relation to cyber incident | APRA

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.