APRA tells boards AI governance has not kept pace with adoption
← News Posts
NewsNews Post

APRA tells boards AI governance has not kept pace with adoption

Quick answer

APRA's 30 April letter to all regulated entities warns that AI adoption is outpacing governance across banks, insurers and super funds, and expects boards to lift technical literacy, vendor scrutiny and post-deployment monitoring.

The Australian Prudential Regulation Authority has written to all regulated entities on artificial intelligence, and the message is blunt: adoption is accelerating, governance is not. [The 30 April letter](https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai) draws on APRA's engagement with a group of large banks, insurers and superannuation trustees in late 2025. The findings read like an audit of habits. Many entities treat AI risk as "just another technology", missing the distinct behaviour of predictive and adaptive systems. Boards show strong appetite for AI's benefits but are, in APRA's words, still developing the technical literacy required to provide effective challenge. The letter also flags overreliance on vendor presentations and summaries, weak post-deployment monitoring, and gaps in ownership across the AI lifecycle from design to decommissioning. There are no new prudential requirements in the letter. There does not need to be. CPS 230 and CPS 234 already give APRA the hooks. The practical shift for governance teams is from policy packs to [evidence packs](/grc/ai-use-case-register-board-evidence): per use case, a named owner, risk tier, human review rule and monitoring trigger a board paper can actually show.

Tags

NewsRegulationAI GovernanceAPRACPS 230Vendor Risk
Discuss this on X (@TheAICommand)Follow on Instagram (@the_aicommand)

TheAICommand. Intelligence, At Your Command.

← Back to News Posts

Read next

Zurich Bahnhofstrasse Banking Dusk
News PostNews·

Build 2026 makes agents first-class citizens of the Microsoft stack

Microsoft used [Build 2026](https://blogs.microsoft.com/blog/2026/06/02/microsoft-build-2026-be-yourself-at-work/) to make agents first-class citizens of its stack, and the governance tooling arrived alongside the capability for once. Microsoft IQ, a context layer spanning Work IQ, Fabric IQ, Foundry IQ and Web IQ, is generally available across GitHub Copilot, Foundry and Copilot Studio, grounding agents in Microsoft 365 data through APIs that go live on 16 June. Microsoft Execution Containers enter preview as OS-enforced sandboxes that contain what an agent can touch, and ASSERT plus the Agent Control Specification are open-sourced for standardised agent safety evaluation. The headline for compliance teams is Agent 365: Entra, Defender and Purview extended into a unified control plane where agents get identities, security posture and compliance treatment the way employees do. The framing to take into your next architecture discussion: Microsoft is now assuming organisations will [run fleets of agents](/ai-news/more-agents-is-not-more-intelligence), and is selling the management layer. If your AI governance still models one user prompting one chatbot, the vendor roadmap has already moved past your risk register.

Read article
Lighthouse Cape Byron NSW
News PostNews·

OAIC survey finds trust in AI companies has collapsed to 4 per cent

The Office of the Australian Information Commissioner has released its triennial [Australian Community Attitudes to Privacy Survey](https://www.oaic.gov.au/news/media-centre/australians-more-concerned-about-privacy-as-trust-in-ai-languishes,-survey-finds), and the AI numbers are stark. Just 4 per cent of Australians trust AI companies. Only social media platforms rank lower, at 3 per cent. The broader trend is sharpening: 87 per cent of respondents are more concerned about privacy than five years ago, and privacy complaints to the OAIC are up 73 per cent this financial year to date. The survey was run by the Social Research Centre in March 2026 with 1,511 nationally representative adults. Privacy Commissioner Carly Kind noted that "wariness of emerging technologies is increasing, particularly in terms of fairness, accountability and the practical ability to exercise rights." The number worth building strategy on: 68 per cent would be more likely to use digital services if they knew data was handled fairly and responsibly. For any team [deploying AI on customer or employee data](/ai-news/workplace-ai-and-the-privacy-trust-test), the complaint pathway is not a side process. It is part of the control environment, and now a measurable trust asset.

Read article
Lisbon 25 De Abril Bridge Dusk
News PostNews·

Mistral puts frontier-class weights on four GPUs with Medium 3.5

Mistral has released [Medium 3.5](https://mistral.ai/news/vibe-remote-agents-mistral-medium-3-5/), a 128 billion parameter dense model with a 256k context window that folds instruction-following, reasoning and coding into a single set of weights. It posts 77.6 per cent on SWE-Bench Verified and 91.4 on the agentic telecom benchmark. Two release details matter more than the benchmarks. The weights are open, [published on Hugging Face](https://huggingface.co/mistralai/Mistral-Medium-3.5-128B) under a modified MIT licence that permits commercial use with carve-outs for high-revenue companies. And the model self-hosts on as few as four GPUs, with API pricing at $1.50 per million input tokens and $7.50 output for those who would rather not. The release also ships Vibe remote agents, asynchronous sandboxed cloud coding sessions that integrate with GitHub, Jira and Slack. For regulated Australian entities weighing [data residency](/ai-news/glm-5-2-open-weights-and-data-sovereignty), APRA-style vendor concentration questions and exit strategies, a frontier-class model that runs inside your own perimeter is no longer hypothetical. The procurement conversation has a new comparison point.

Read article