Australia’s prudential regulator is warning financial institutions that AI adoption is advancing faster than governance, assurance and operational resilience. A targeted review by the Australian Prudential Regulation Authority found AI in every large regulated entity examined, but uneven control maturity.
Banks and superannuation trustees are using or testing AI for software engineering, claims triage, lending, fraud prevention and customer interaction. Boards show strong interest in productivity, yet often rely too heavily on vendor presentations and do not challenge unpredictable behaviour or the impact of failure on critical services.
APRA’s findings show why agents cannot be governed as ordinary software. They introduce changing behaviour, delegated action and non-human identities.
Boards need inventories, ownership and exit plans
AI strategy should align with risk appetite, with defined monitoring and procedures for errors. APRA found gaps in behaviour monitoring, change management and decommissioning.
Institutions need a current inventory of models and agents, including a named owner, business purpose, data access and operational criticality. High-risk decisions require explicit human involvement rather than a general assurance that people remain “in the loop.”
Provider concentration adds resilience risk. Some firms depend on one vendor for many AI systems, yet few can demonstrate substitution or exit plans. AI may also appear in upstream products without the customer realising it.
Boards should understand what would happen if a provider changed price, model behaviour, availability or policy. Portability and tested fallbacks are governance requirements, not only procurement preferences.
Agent identity changes cybersecurity controls
Prompt injection, insecure integrations and AI-generated code expand the attack surface. APRA observed that identity and access practices have not always adapted to autonomous software.
Agents need privileged-access management, secure configuration, patching and permissions limited to their tasks. Generated code should receive security testing even when development volume pressures existing release controls.
The FIDO Alliance has created an Agentic Authentication Technical Working Group to develop standards for actions initiated by agents, including commerce. Human authentication models do not automatically show which person authorised a software delegate or under what conditions.
Google’s Agent Payments Protocol and Mastercard’s Verifiable Intent framework are among proposals submitted for review. The Centre for Internet Security has also mapped its controls to language models, agents and MCP environments.
Governance must follow every delegated action
Financial firms should be able to connect an agent’s action to the customer or employee who authorised it, the limits of that delegation and the evidence used in the decision.
This requires more than access logs. Institutions need records of model versions, retrieved data, tool calls, approvals and exceptions. When an agent’s purpose changes, permissions and validation should be reviewed rather than inherited silently.
Boards do not need to become model engineers, but they must ask operational questions: Which critical processes depend on AI? How quickly can the system be stopped? Who is accountable? Can the provider be replaced? What would a customer experience during failure?
APRA is not arguing against AI in finance. It is signalling that productivity claims do not offset weak control over systems capable of affecting loans, claims and customer communication.
The financial sector already has mature practices for human authority, outsourcing and operational risk. Agent governance extends those disciplines to machine participants, with additional attention to changing behaviour and delegated intent.
Institutions that create inventories, narrow permissions and test failure paths can scale more confidently. Those relying on vendor summaries may discover that a technically functional agent has become a critical dependency without a clear owner or exit.
The regulator’s message is direct: autonomy does not reduce responsibility. It increases the need to prove who authorised an action, how it remained within bounds and what happens when the system no longer behaves as expected.
