Banks are scaling AI under named accountability
Executives are personally accountable under FAR, CPS 230 asks for resilience across service providers, and APRA now expects an inventory of AI tools and use cases. The AI itself keeps arriving faster than reviews can follow.
Gross benefit CBA reported from AI use cases in FY2026, on a $2.4bn technology budget
The Asian Banker, Aug 2026FAR applied to banks, with accountability statements for named executives
APRA, Financial Accountability RegimeInsurers are adopting AI where customers feel it most
Claims, pricing and underwriting are where AI touches customers directly. FAR has applied to insurers since March 2025, CPS 230 has covered how they manage service providers since July 2025, and APRA expects every AI use case on an inventory.
General insurance revenue in a single quarter, March 2026
APRA data via Insurance Business, May 2026AI use cases ASIC found across 23 banking, credit, insurance and advice licensees
ASIC REP 798, Oct 2024Trustees answer for AI they do not always run
Much of super runs through administrators and vendors, so a large share of AI sits outside the fund. CPS 230 has governed how trustees manage material service providers since July 2025, FAR has applied to trustees since March 2025, and APRA wrote to trustees on AI in April 2026.
Your questions about banking
APRA's April 2026 letter asks for an inventory of AI tools and use cases, ownership across the lifecycle, board literacy, human involvement in high-risk decisions, and controls over agentic workflows and the AI supply chain.
It sits beside your model risk framework. Models keep their validation process, and CognaOne adds the wider estate: copilots, agents and vendor AI, with owners, controls and evidence in one place.
No. Discovery uses read-only connectors and what teams declare. Runtime authority over agent actions is added only where you choose.
With visibility: connect the platforms you already run, register what teams use, and get a first live view of the estate before deciding where agents need more.
Your questions about insurance
There is no single AI rule. CPS 220, CPS 230, CPS 234 and FAR apply to the systems and the people accountable for them, ASIC expects licensees to govern AI, and APRA's April 2026 letter sets out its AI expectations.
That is your decision. CognaOne records what each agent may do, so a triage agent can read and draft while payment stays with people, until you decide otherwise.
It is part of the estate. Vendor AI is registered with its provider, the models behind it and the contract terms, so it is governed like anything you build.
With visibility: connect the platforms you already run, register what teams use, and get a first live view of AI across claims, pricing and service.
Your questions about superannuation
Much of the fund runs through administrators and vendors, so a large share of AI is outside the fund's own systems. Trustees remain accountable for it under CPS 230 and FAR.
APRA's April 2026 letter, sent to banks, insurers and trustees, expects an AI inventory, clear ownership, board oversight, controls over agents and a mapped AI supply chain, including fourth parties.
It is registered alongside the fund's own AI, with its provider and the fund's owner, so the controls that apply to it sit in the same live view.
With visibility: register what the fund and its partners run, connect the platforms you already use, and get a first live view of the estate.
Common use cases in banking
01 / 06 · One registerCredit, fraud, financial crime and customer AI, each with an owner and a risk tier, including vendor AI inside core platforms.
02 / 06 · Lending modelsModels that inform lending decisions carry their accountable executive, their controls and dated evidence.
03 / 06 · Scam and fraudMonitoring results flow in from the tools you already run, so changes in behaviour reach risk, not only data science.
04 / 06 · Fourth partiesEach AI provider, the models behind it and the contract terms, so concentration and exit plans are visible.
05 / 06 · CPS 230 and 234Controls mapped to the AI systems they govern, with evidence dated as it is produced, not gathered at audit time.
06 / 06 · Board viewA plain view of AI risk against appetite, for the board and the accountable executives.
Common use cases in insurance
01 / 06 · Claims agentsTriage and drafting agents go live with what they may do written down, and decisions on payment kept with people.
02 / 06 · Pricing modelsOwners, risk tiers and monitoring for the models that shape premiums and acceptance.
03 / 06 · Vendor AIAI embedded in core systems is registered and owned, with the provider and contract terms beside it.
04 / 06 · Customer assistantsCopilots and assistants that talk to customers are recorded with their controls for disclosure and complaints.
05 / 06 · FAR accountabilityEach AI system is tied to an accountable executive, with controls and dated evidence behind it.
06 / 06 · Board viewWhere AI sits in claims and underwriting, and how it is controlled, in terms the board can act on.
Common use cases in superannuation
01 / 06 · Member serviceAgents that answer members or prepare requests act within approved rights, with people on anything that moves money.
02 / 06 · Investment modelsModels in investment and operations carry owners, risk tiers and monitoring results from existing tools.
03 / 06 · Administrator AIAI inside administrator and vendor platforms is registered with its provider and terms, so the trustee can see it.
04 / 06 · One registerWhat the fund runs and what partners run for it, in one live view with owners on both sides.
05 / 06 · Service providersControls and dated evidence for AI that material service providers run on the fund's behalf.
06 / 06 · Trustee boardA plain view of AI risk against appetite, ready for the trustee board and accountable executives.
What we expect it to deliver
Best estimates from how CognaOne is delivered, not client results. Each is confirmed in the first weeks of an engagement.
To assemble an agent's approval case, with owner, model risk and controls already recorded
To a first live view of the AI estate across connected platforms
Of the effort spent gathering AI evidence for audit and regulator requests
What we expect it to deliver
Best estimates from how CognaOne is delivered, not client results. Each is confirmed in the first weeks of an engagement.
To assemble an agent's approval case, with owner, model risk and controls already recorded
To a first live view of the AI estate across connected platforms
Of the effort spent gathering AI evidence for audit and regulator requests
What we expect it to deliver
Best estimates from how CognaOne is delivered, not client results. Each is confirmed in the first weeks of an engagement.
To assemble an agent's approval case, with owner, model risk and controls already recorded
To a first live view of the AI estate across connected platforms
Of the effort spent gathering AI evidence for audit and regulator requests
Built on the obligations you already report against
Regulation
APRA Prudential Standards CPS 230 Operational Risk Management and CPS 234 Information Security, implemented control by control, inside the risk framework CPS 220 requires (SPS 220 for super trustees). ASIC and MAS expectations tracked alongside.
Legislation
The Financial Accountability Regime, and Privacy Act reforms that from December 2026 require privacy policies to explain decisions made or substantially supported by automated systems.
Obligations
Each obligation carries its source, its effective date, an accountable executive, and the controls and evidence that satisfy it.
Let's connect
Tell us where your AI programme is today. We scope the first engagement to your own AI estate, and every enquiry is handled in confidence.
Contact us