APRA and ASIC agree: your problem is evidence, not rules
Two regulators wrote to regulated entities eight days apart in 2026. Neither said firms were unclear on the rules. Both said firms could not produce evidence their controls were working.
Most AI governance spending assumes an information problem: teams do not know what the rules are, so buy them a tracker. The two most consequential letters sent to Australian regulated entities this year say the opposite.
30 Apr
APRA letter to all regulated entities
2026
8 May
ASIC letter following, eight days later
2026
624
AI use cases ASIC had already reviewed across 23 licensees
REP 798, Oct 2024
The diagnosis both regulators reached
Neither letter is primarily about what AI systems are permitted. Both are about whether an entity can demonstrate, on request, that the controls it claims to operate are actually operating.
That is a different failure mode, and it has a different remedy. Knowing an obligation exists costs you a subscription. Proving a control worked on a Tuesday in March costs you a records discipline you either have or you do not.
The gap is measurable, and large
The self-reported numbers line up with what the regulators are describing.
78%
of business leaders do not believe they could pass a 90-day AI governance audit
37%
of Australian boards have audited their own AI use at all
The second number is the more uncomfortable one. An audit you have never attempted is not a control gap you have measured — it is a control gap you have not looked for.
What "evidence" actually means here
In practice, regulators asking you to demonstrate control effectiveness want artefacts with dates on them, not policies with version numbers:
- A risk register naming specific AI systems, not AI as a category
- A record of who approved deployment, against what assessment, on what date
- Evidence a control was tested — not that it was designed
- A route by which a person contests an automated decision, and a log of contests
- Change records showing what happened when a model was retrained or a vendor updated
Where to start if you are behind
Start by finding out how far behind you are, against a control set rather than against a vibe. Most organisations discover the gap is uneven — strong on transparency because it was visible, weak on contestability and reliability because nobody asked before.
