Technology & Cyber in Australia

Key dates

2026-04-30

APRA issued its letter to banks, insurers and superannuation trustees calling for a step-change in governance, risk management, assurance and operational resilience for AI-related risks.

2026-05-08

ASIC issued its open letter to all licensees and market participants urging urgent strengthening of cyber resilience as frontier AI intensifies the global cyber-risk environment.

2026-06-01

ASIC and APRA began the June–July 2026 series of nine industry roundtables on frontier-AI preparedness and resilience; the source identifies June as the starting month but does not provide an exact day.

2026-07-31

ASIC and APRA completed the June–July 2026 roundtable period; the source does not provide an exact closing day.

2026-08-27

ASIC published the joint warning and related information paper and preparedness checklist, urging entities to move from awareness to action.

Suggested considerations

• Firms should consider presenting the ASIC and APRA roundtable themes, together with the available board and executive preparedness checklist, to the board and relevant risk or technology committees.
• Compliance teams may wish to map frontier-AI cyber and operational risks to existing obligations and controls under APRA CPS 230 Operational Risk Management, APRA CPS 234 Information Security, APRA CPS 220 Risk Management where applicable, and the entity's ASIC licence, governance and cyber-resilience arrangements.
• Firms should consider identifying critical assets, systems, data flows and material third-party dependencies, including common providers and concentration points that could create sector-wide disruption.
• Technology and security teams may wish to test patching, identity and privileged-access controls, attack-surface reduction, backup integrity, recovery-time priorities and incident-response playbooks against AI-accelerated attack scenarios.
• Boards and executives should consider documenting risk appetite, incident escalation authority, recovery priorities, internal and external communication strategies and decision rights before a frontier-AI-related crisis occurs.
• Firms should consider testing response and recovery arrangements under compressed timeframes and retaining evidence of exercise results, lessons learned, remediation owners and completion status.
• Entities using or procuring AI should consider applying existing model, data, supplier, change-management and assurance controls to internally developed models, vendor tools and embedded AI functionality, including defensive-AI tools used for threat intelligence, vulnerability detection, code review or incident response.
• Procurement and outsourcing functions may wish to strengthen supplier assurance, obtain relevant information on providers' AI and cyber controls, map material dependencies and assess substitutability and exit arrangements.

What changed

The regulators have consolidated a cross-sector expectation that entities address frontier-AI risk through cyber fundamentals, critical-asset identification, timely patching, strong identity and access controls, attack-surface reduction, reliable backups, tested response and recovery arrangements, and third-party risk management.

Suggested considerations

• Firms should consider reviewing digital advertising, affiliate, referral and social-media monitoring for deepfake endorsements, unauthorised use of executive or brand identities, fake licence claims and links to cloned investment platforms.
• Compliance teams may wish to test whether the firm’s website address, legal entity name, AFSL number and contact details are consistently displayed and match ASIC’s Professional Registers Search, including any authorised representative relationships.
• Firms should consider implementing or refreshing rapid escalation and takedown processes for impersonation, cloned websites, fraudulent advertisements and misleading investment promotions, with documented evidence of referrals to platforms, banks, ASIC, cyber.gov.au and Scamwatch where appropriate.
• Marketing and distribution controls may wish to require provenance and approval checks for celebrity, influencer, public-figure and AI-generated content, together with surveillance for fabricated reviews, news articles and testimonials.
• Risk and governance functions should consider assessing AI-enabled scam and impersonation scenarios within financial-crime, cyber-risk, operational-resilience and consumer-harm frameworks, including scripted follow-up calls, fake trading dashboards and small initial profit payments used to build trust.
• Firms should consider reviewing customer and counterparty onboarding controls for entities claiming to hold an AFSL, and escalation procedures where an opportunity encourages consumers to bypass licensed professionals or cannot be independently verified.
• Boards or risk committees may wish to receive trend reporting on impersonation incidents, customer complaints, fraudulent domains, takedown requests, losses and control remediation, notwithstanding that this media release itself imposes no new reporting requirement.

What changed

No new rule, mandatory control, reporting obligation or compliance deadline was introduced. ASIC has reinforced its expectation that consumers independently verify Australian Financial Services Licence details against the professional registers, including matching the licence holder’s name and number to the business or opportunity being promoted. The warning also indicates that reliance on search-engine results, polished websites, branding, testimonials, celebrity endorsements or claims of ASIC licensing is insufficient where firms or consumers assess legitimacy.