CPS 230
APRA CPS 230 operational risk management and AI: critical operations, service-provider oversight, and resilience obligations.
7 articles
Articles about CPS 230
CPS 230's 1 July Deadline Just Caught Up With Your AI Vendors
From 1 July 2026, pre-existing contracts with material service providers must meet APRA's CPS 230, and a growing share of those arrangements are now AI. Here is the work to do before the deadline, plus a reusable contract-review prompt.
Read article
AI Agents Just Went From Minutes to Hours. The Control Point Is Where They Run.
OpenAI bought Ona and published research showing AI agents now run for hours, not seconds. The unit you have to govern moved from the prompt to the environment the agent runs in.
Read article
Your AI Assistant Just Became a Shared Teammate. Govern the Channel.
On 23 June, Anthropic launched Claude Tag, a single shared Claude that lives in a Slack workspace with its own memory and admin-scoped access to channels, tools and data. The unit of AI collaboration just moved from the private conversation to the team channel. The thing you now have to govern is no longer a prompt. It is a standing presence. Here is what changes, and the three decisions to make before it is live.
Read article
AI Is Moving Into the Core Systems of Regulated Work
This week two of the world's largest IT services firms began wiring a frontier model into the core systems that banks, insurers and airlines run on, not the chat window. Here is what it means for regulated work, and what to do this week.
Read article
AI Incident Response Needs an Evidence Pack, Not Just a Playbook
Prompt injection, data leakage and agentic failures require GRC teams to rethink incident response evidence, escalation and assurance.
Read article
APRA's Model Risk Thematic Review: What to Expect
APRA's model risk thematic review is expected to land in the second half of 2026. The signals from supervisory engagement to date suggest where it will press hardest, and what regulated entities should be doing now.
Read article
CPS 230 and AI: A Practical Operational Resilience Playbook
CPS 230 has been live since 1 July 2025. Nine months in, the practical question for boards and operational risk teams is no longer whether AI tools fall inside the standard. It is how to evidence it.
Read article