APRA puts AI model risk on every regulated CEO's desk

APRA has written to the chief executive of every regulated entity setting formal expectations for AI and machine learning model risk under CPS 220 and CPS 230. The letter, dated 17 April 2026, names four things APRA wants to see by the end of the financial year. A board-approved model risk framework that explicitly covers third-party AI. A registered model inventory with materiality ratings. Independent validation cadence tied to that materiality. And incident reporting that triggers on degradation, not just outage. APRA also signals it will run thematic reviews on banking and insurance subsets later in 2026, with findings published. None of this is new in spirit. CPS 220 has always covered models, and CPS 230 has covered third-party operational risk since 2025. What is new is that AI is now named, the expectation is written down, and the regulator is going to ask. If your model inventory still lives in a single team's spreadsheet, the next twelve weeks are going to be busy. Boards now own the framework, not just the policy. *TheAICommand. Intelligence, At Your Command.*