This page is an educational summary for professionals working with AI. It is not the law and not legal advice. Always work from the current authoritative text linked below.
What does SPS 220 do?
SPS 220 establishes the risk management requirements for superannuation trustees. An RSE licensee must maintain a risk management framework appropriate to the size, business mix and complexity of its business operations, a Board-approved risk appetite statement, a Board-approved risk management strategy describing the key elements of that framework, and adequate resources to comply. It must notify APRA of a significant breach of, or material deviation from, the framework, or a discovery that the framework does not adequately address a material risk. Read the determination on the Federal Register of Legislation.
Who does it bind?
Every RSE licensee under the SIS Act 1993, in its entirety unless the standard expressly says otherwise. The Board is ultimately responsible for the framework, and for aligning it with the business plan.
What do practitioners get wrong?
Two citation errors. Reaching for CPS 220, which excludes RSE licensees in its own footnote, and quoting the 2012 determination, which determination No. 3 of 2019 revoked along with the standard made under it.
Where does AI use touch it?
At the definition of material risk. An AI system embedded in member servicing, investment decisions or administration is an internal source of inherent risk capable of materially affecting beneficiaries, so it belongs inside the framework rather than beside it. The gap-discovery notification duty then bites when the framework plainly never contemplated it. See the board risk declaration evidence chain and CPS 230.
Bottom line
SPS 220 is the trustee's risk management standard, and its Board-approved artefacts are where an AI deployment either appears or does not.
TheAICommand. Intelligence, At Your Command.