TheAICommand Brief: May 2026 | TheAICommand Brief

1. The month in AI

GRC: APRA demands a step change in AI governance

APRA wrote to regulated entities warning that AI risk is not just another technology risk. Boards must hold sufficient technical literacy to challenge management. Lifecycle governance, human oversight for high-risk decisions, and third-party transparency are now baseline expectations.

Source: apra.gov.au

APRA AI Governance Expectations: AI Lifecycle Accountability, Continuous Model Monitoring, Human Oversight for High-Risk Decisions. — Figure 1. APRA AI governance maturity ladder. Indicative. Source: APRA letter to industry, April 2026.

HR: Fair Work Commission braces for 70 percent claims surge

The Fair Work Commission is preparing for a 70 percent rise in claims driven by employees using chatbots to draft unfair dismissal and general protections applications. Mandatory human verification declarations are on the way, with potential cost consequences for AI-only filings.

Source: hcamag.com

AI-Generated Claims Surge: 70 percent projected increase in FWC claims, with hallucinated precedents and human verification required. — Figure 2. FWC claims surge with the verification gate. Indicative. Source: HCA Mag, April 2026.

WC: AI exclusions arrive as agentic claims triage scales

Workers compensation is moving fast on AI-native triage at first notice of loss, but the global insurance market is responding with broad AI exclusions in liability policies. Claims leaders face a new tension between operational efficiency and coverage gaps.

Source: pymnts.com

2. Three actions GRC practitioners can take this month.

This month is GRC, with APRA's letter to industry on the radar. The three actions below assume you operate in or near a regulated entity covered by APRA prudential standards. Each takeaway produces an artefact you can table at your next risk committee.

One. Replace point-in-time assurance with continuous monitoring. Sample- based audit cannot detect drift, bias, or control breakdown in probabilistic models that change behaviour between audits. Stand up at least one continuous validation signal for each material AI-driven model this month. A drift dashboard, a precision check, an output sample review. The artefact is the validation log.

Two. Map your AI supply chain for concentration risk. Most regulated entities use one foundation model provider for many use cases. APRA flagged this. Build a one-page concentration map. Provider, dependent processes, contractual audit rights, exit feasibility. Five rows is a defensible start. The artefact is the map.

Three. Move from policy to enforceable controls on shadow AI. Policy direction alone does not stop staff using unsanctioned AI tools with customer data. Pair the AI use policy with three technical controls. Privileged access on enterprise tools, blocking on consumer endpoints, and automated discovery for new SaaS. The artefact is the deployment plan.

Why these: These three actions produce evidence in three of the four areas APRA's letter flagged: governance, risk management, and operational discipline. Drift detection, concentration mapping, and enforceable controls are exactly the questions a supervisor will ask in a thematic visit.

3. The governance gap behind agentic AI in procurement.

Agentic AI is breaking traditional procurement frameworks. Banking, insurance, and government procurement was designed for software that executes explicit instructions. Agentic systems do something different. They interpret context, decide what to do, and act autonomously across processes at machine speed. The shift from a rules-based fraud filter to an autonomous agent that triages alerts, investigates patterns, and escalates cases without human input is a category change, not an upgrade. Existing governance frameworks do not cleanly accommodate that delegation of authority. Three frame breaks tend to show up first. Vendor due diligence assumes you can specify and test deterministic behaviour. Agentic systems show emergent behaviour that did not exist in pre-deployment evaluation. Model risk management assumes the model is the unit of governance. In agentic deployments the unit is a workflow that may invoke many models, tools, and APIs. Third-party oversight assumes you control configuration. With foundation-model-based agents the configuration changes when the underlying model is updated by the provider, often without notice. The institutions making the most progress are not building a new agentic governance framework from scratch. They are extending the frameworks they already have, in small contained pilots, in lower-risk areas like compliance monitoring or regulatory change management. Those pilots are used as learning environments where risk, compliance, and procurement teams test new contractual clauses, explainability requirements, and the boundary between autonomous action and human review. Four practical questions help frame whether your existing framework extends or breaks. First, can you trace the authority of any single agent action back to a named human accountability owner? Second, can you produce a meaningful, end-to-end model inventory that includes the underlying foundation models the agents call? Third, can you contract for fourth-party visibility, since the foundation model is itself a fourth-party dependency? Fourth, can you exit the agentic deployment quickly if the underlying provider updates the model in a way that breaks your validation? If three of those four are no, the framework breaks. If three are yes with caveats, the framework extends. With 44 percent of finance teams expecting to use agentic AI in 2026, and the curve still steepening, the governance question is not whether agentic AI will land in regulated industries. It is whether your framework can absorb it before regulators ask. Six months of preparation now is cheaper than six months of remediation later.

The agentic AI procurement gap. Traditional procurement assumes software executes instructions; agentic AI systems interpret, decide, and act. 600 percent increase in agentic AI adoption in finance. — Figure 3. The agentic AI procurement gap. Two frameworks compared, with finance-sector adoption growth. Sources: APRA April 2026; The Connector May 2026.

4. Prompt of the month.

This prompt produces a vendor risk assessment against APRA's new AI expectations. Use it when reviewing a new AI vendor proposal or pitch deck. The model returns a structured gap analysis and three contractual clauses you can take into negotiation.

You are a Senior Technology Risk Assessor at an Australian financial institution preparing a vendor risk assessment for senior management.

Vendor and service:
- Vendor name: [insert]
- Service description: [insert, for example automated claims triage or generative AI customer service]
- Sector: [insert, for example general insurance, banking, superannuation]
- Internal sponsor: [insert role]

Reference frameworks:
- APRA letter to industry on AI (April 2026).
- CPS 230 operational risk management.
- Existing model risk management policy and third-party risk management policy of my organisation. I will paste extracts as needed.

Produce:
1. A structured risk assessment that scores the vendor against four domains: visibility over fourth-party dependencies, continuous model monitoring capabilities, contractual audit rights, and exit and substitution feasibility. Use a five-point scale per domain with a one-sentence justification.
2. A gap summary identifying where the existing procurement framework cannot adequately assess this vendor.
3. Three contractual clauses we should negotiate before approval. For each clause, include the rationale, suggested wording, and the risk if the vendor refuses.

Constraints:
- Do not invent obligations the inputs do not mention.
- Where evidence is insufficient, score amber and state what would be needed to score green.
- Flag any item that appears to create an APRA, ASIC, or Privacy Act exposure.
- Do not include vendor pricing or proprietary technical specifications.

How to use it. Paste this prompt into your approved enterprise AI tool. Replace the bracketed inputs with the specific vendor and service. Run. Compare the output against your existing TPRM policy. Use the three contractual clauses as the starting point for legal review and negotiation.

What to watch for. The output may include suggested clauses that are commercially unrealistic or legally unenforceable in Australia. Have your legal team review every clause before sending to the vendor. The risk assessment is a draft for discussion. Do not table it as a board-ready artefact without sign-off from your risk and compliance functions.

5. Glossary

APRA: Australian Prudential Regulation Authority. The statutory authority that regulates the Australian financial services industry under the Banking Act, Insurance Act, and Superannuation Industry (Supervision) Act.
FNOL: First Notice of Loss. The initial report made to an insurer following a loss, theft, injury, or damage. The point at which claims triage and reserving start.
FWC: Fair Work Commission. Australia's national workplace relations tribunal, with jurisdiction over unfair dismissal, general protections, and enterprise agreements.
Generative AI: AI systems that generate text, images, audio, or other media in response to prompts. Distinct from traditional predictive models.
GRC: Governance, Risk, and Compliance. An integrated discipline covering board governance, enterprise risk management, and regulatory compliance.
Shadow AI: Unsanctioned or unmanaged use of AI tools by staff outside the organisation's IT and security oversight. Common at the consumer endpoint.
TPRM: Third-Party Risk Management. The discipline of assessing and controlling risks introduced by vendors and service providers.
WC: Workers compensation. The system of statutory insurance providing wage replacement and medical benefits to workers injured in the course of employment.

6. References

Australian Prudential Regulation Authority, APRA letter to industry on artificial intelligence (AI), 30 April 2026
Grant Thornton Australia, Artificial intelligence, risk and governance: closing the gap between capability and control, 1 May 2026
Human Resources Director, AI is flooding Australia's employment system, forcing a rethink of how law is practiced, April 2026
Human Resources Director, Government moves to rein in workplace AI, April 2026
Five Sigma, Fast Cover deploys Five Sigma's AI-native claims platform and Clive AI claims adjuster in Australia, April 2026
PYMNTS, Big insurance backs away from AI risk and startups rush in, May 2026
The Connector, Agentic AI governance in banking: closing the gap in 2026, May 2026

← All editions

APRA, FWC, and the WC market step up on AI.