AI Agent Governance Australia: The 2026 Regulatory Landscape

1. Australia regulates agents already, without an AI Act

Australia has no AI Act. That is often read as a light-touch position. For an organisation deploying AI agents, it is closer to the opposite: the obligations that reach an agent are already in force, spread across prudential standards, licence conditions, privacy law, cyber security law and critical infrastructure rules, and regulators are now saying so in writing.

In the space of eight days in 2026, the Australian Prudential Regulation Authority (APRA) told every regulated entity that AI governance, risk management and assurance are not keeping pace with adoption¹, cyber agencies from Australia and its Five Eyes partners published joint guidance written for agentic AI^2,3, and the Australian Securities and Investments Commission (ASIC) told licensees that cyber resilience is a core licensing obligation, not an IT issue⁴. None of these created new law. Together they show how regulators and cyber agencies expect organisations to manage agent risk under the rules that already apply.

In Australia the question is not whether agents are regulated. It is which of several existing regimes an agent's actions fall under, and whether the organisation can show control under each of them.

The Government has also announced Australian Standards for AI, with legislation expected early next year. As announced, those standards focus on large data centres and AI training rather than on how organisations deploy agents⁵. For agent governance, the regimes described here are the ones that apply now.

This edition goes deeper than the Global Focus edition on the Australian instruments. It covers the APRA prudential standards and the April 2026 AI letter, ASIC's licence obligations and its May 2026 open letter, the Five Eyes agentic AI guidance, privacy, ransomware reporting, critical infrastructure, scam prevention and the rules that apply to Commonwealth agencies.

2. How to read this edition

The instruments carry different force. Prudential standards and statutes are binding on the entities within their scope. Regulator letters set supervisory expectations and signal enforcement priorities; they do not create new rules. Guidance from cyber agencies and the National AI Centre is voluntary, although supervisors increasingly point to it. We state the force of each instrument plainly.

Every factual statement about an instrument is referenced to the issuing body's own text wherever that text was accessible, and all sources were checked in September 2026. Where a primary source restricts automated access, we say so and identify the source used to confirm its content. Secondary sources are labelled as such in the references.

The mapping from obligations to engineering controls is our analysis and nothing here is legal advice. CognaOne builds controls of the kind described in Section 10. Product descriptions are identified separately from regulatory findings.

Who this edition is for. Find your lane before the detail, because the regimes do not overlap neatly:

3. The Australian instrument map

Most binding instruments on this list were not written with AI agents in mind; the regulator letters and guidance show how they are expected to apply.

4. The prudential core: CPS 230, CPS 234, CPS 220 and SPS 220

For APRA-regulated entities, agent governance starts with prudential standards that were not written for AI and apply to it fully: CPS 230 and CPS 234 across all APRA-regulated industries, and a risk management standard (CPS 220 for banks and insurers, SPS 220 for superannuation trustees).

CPS 230: agents inside critical operations

CPS 230 requires an entity to manage its operational risks with effective controls, to continue delivering critical operations within tolerance levels through severe disruption with a credible business continuity plan, and to manage the risks that arise from service providers⁶. It commenced on 1 July 2025. The transition for pre-existing service-provider contracts ended at the earlier of renewal or 1 July 2026, when targeted amendments also took effect^7,8.

Three consequences follow for agents. First, an agent that performs or supports a step in a critical operation, such as payments, claims or member services, brings that step into the tolerance and continuity analysis: the entity has to know how the operation continues if the agent is unavailable or behaves wrongly. APRA's AI letter makes this explicit: where AI supports critical operations, credible fallback processes are required¹. Second, the model provider or agent platform behind that step is a service provider risk, and a material one if the operation depends on it. Third, an agent-driven incident that is likely to have a material financial impact or a material impact on a critical operation must be notified to APRA within 72 hours⁶.

CPS 234: agents as privileged information assets

CPS 234 requires an information security capability commensurate with vulnerabilities and threats, including for information assets managed by related parties and third parties, and places ultimate responsibility on the Board⁹. An agent holds credentials, reads data and calls systems; it is an information asset with privileges. Material information security incidents must be notified to APRA within 72 hours, and material control weaknesses the entity does not expect to remediate in time within 10 business days⁹.

APRA's AI letter supplies the observation that makes CPS 234 urgent for agents: identity and access management capabilities have not yet adjusted to non-human actors such as AI agents¹. An agent running under a shared service account, or under a person's credentials, is exactly the control weakness CPS 234 is designed to surface.

CPS 220, SPS 220 and the FAR: appetite and accountability

CPS 220 requires ADIs and insurers to maintain a Board-approved risk management framework, risk appetite statement and risk management strategy covering all material risks¹⁰. SPS 220 imposes the equivalent risk management framework requirement on superannuation trustees¹¹. If agents can take consequential actions, the risk appetite needs to say which actions, at what value or impact, and under what conditions. The Financial Accountability Regime, which applies to ADIs from 15 March 2024 and to insurers and superannuation trustees from 15 March 2025, assigns responsibility to named accountable persons¹². In our reading, when an agent acts inside an accountable person's area, the accountability does not move to the agent or its vendor.

5. What APRA's April 2026 AI letter found

APRA's letter of 30 April 2026 is addressed to all regulated entities and draws on a targeted supervisory engagement¹. It does not create new rules. It tells entities what their existing obligations mean for AI, and it is specific.

APRA says it is finalising a forward plan for supervising AI risk, including prudential reviews, thematic activities and AI supplier engagement¹.

Read as a control specification, the letter asks for four things an agent programme rarely has on day one: an inventory, an identity for each agent, preventative controls rather than detective ones, and assurance that can test an agentic workflow.

6. ASIC: licence obligations, enforcement and the May 2026 letter

For AFS licensees, the anchor is section 912A of the Corporations Act 2001. In early 2026 the Federal Court ordered FIIG Securities to pay a $2.5 million penalty and $500,000 towards ASIC's costs, and to undertake a compliance programme with an independent expert, over cyber security failures. ASIC describes it as the first time the Court has imposed civil penalties for cyber security failures under the general AFS licensee obligations¹³. ASIC draws the lesson that cyber risk management controls must be demonstrably effective and proportionate to the size, nature and complexity of the business⁴. The case concerned cyber security under the general licence obligations; it did not decide what controls an AI agent must have. What follows for agents is our analysis.

ASIC's open letter of 8 May 2026 builds on that case. It frames frontier AI as materially increasing cyber risk, asks for a principles-based, model-agnostic response, and treats cyber resilience as a core licensing obligation⁴. The steps it asks for include reassessing cyber plans against the current threat environment, protecting critical assets, reviewing user access and reassessing privileges, patching promptly, maintaining incident response plans, actively managing third-party risks where services introduce concentration or systemic exposure, and using AI defensively where appropriate. Entities are required to table the letter at their ultimate board and risk governance committees⁴.

Neither the case nor the letter is about agents specifically. In our reading, both apply directly to them: an agent with broad privileges is an access-control question, an agent platform is a third-party dependency, and an agent that can be misdirected is part of the attack surface. ASIC's earlier Report 798, which reviewed how 23 AFS and credit licensees use AI and govern the associated consumer risks, remains its baseline on AI governance in licensed firms¹⁴.

7. Cyber security: the Five Eyes guidance written for agents

On 1 May 2026, ASD's Australian Cyber Security Centre, the United States Cybersecurity and Infrastructure Security Agency and National Security Agency, and the national cyber centres of Canada, New Zealand and the United Kingdom published Careful adoption of agentic AI services^2,3. It is voluntary guidance. It is also the most specific statement any Australian government source has made about controlling agents.

The guidance groups agentic risk into five categories: privilege, design and configuration, behavioural, structural and accountability risks³. Its central recommendations translate almost directly into controls:

Scope. Align agentic AI risks with the organisation's existing security model, never grant agents broad or unrestricted access, especially to sensitive data or critical systems, and use agents only for low-risk and non-sensitive tasks².

Identity. Construct each agent as a distinct principal with a cryptographically anchored identity, authenticate agent-to-agent and agent-to-service calls, and keep a trusted registry that binds identities to authorised roles and is reconciled against the live set of agents³.

Privilege. Apply least privilege strictly, and prohibit agents from modifying their own privileges or initiating unapproved delegation without expiry and a recorded grant chain³.

Human control. Build human control points into the workflow, such as live monitoring and interruption, human approval for decision-making steps, and auditing and reversibility after execution, so that an agent approved for low-risk tasks cannot progress into higher-risk activity on its own³. The guidance calibrates approval to risk: multi-agent approval for moderate-stakes actions, with human approval added for high-stakes actions².

Safe defaults. Configure systems to fail safe by default, requiring agents to stop and escalate to human reviewers in uncertain scenarios, with containment, versioning and rollback to known-good behaviour³.

Graduated autonomy and records. Deploy in phases with progressively increasing access and autonomy, roll back when failures occur, restrict tools to an approved allow list, and log tool use in human-readable form³.

On accountability, the guidance observes that agentic architectures can obscure what caused a particular action, making accountability hard to trace³. Most of its recommendations aim at systems that do not depend on trusting the agent's judgement.

Two cyber statutes complete the picture. Under Part 3 of the Cyber Security Act 2024, a reporting business entity (broadly, a business above the turnover threshold, or an entity responsible for a critical infrastructure asset) that makes a ransomware or cyber extortion payment, or becomes aware one was made on its behalf, must report it to ASD within 72 hours; the obligation commenced on 30 May 2025, with an education-first period that ended on 31 December 2025¹⁷. Under the SOCI Act, responsible entities for critical infrastructure assets must maintain a risk management program covering cyber and information security, personnel, supply chain, and physical and natural hazards, and report on it annually; the Cyber and Infrastructure Security Centre (CISC) describes that report as a mechanism for boards to assess security risk management^18,19,27. An agent with access to a critical asset is a cyber, personnel-equivalent and supply chain question at the same time.

8. Privacy: automated decisions and the data agents touch

Two privacy developments matter for agents. The first is binding and dated. From 10 December 2026, new APP 1.7 to 1.9, inserted by the Privacy and Other Legislation Amendment Act 2024, require an entity's privacy policy to include certain information where it has arranged for a computer program, using personal information, to make a decision, or to do a thing substantially and directly related to making a decision, that could reasonably be expected to significantly affect an individual's rights or interests¹⁵. The OAIC states that the obligations apply to decisions made from that date, regardless of when the arrangement was made or when the personal information was collected¹⁵. An agent that approves, declines, prioritises or routes on the basis of personal information may bring an organisation within scope, and the organisation will need to know which agents do so. The OAIC has said it will publish detailed guidance on these obligations in 2026¹⁵.

The second applies now. APP 11 requires an entity to take reasonable steps to protect personal information it holds from misuse, interference and loss and from unauthorised access, modification or disclosure, and to destroy or de-identify it once it is no longer needed for a permitted purpose²⁸. For agents, that reaches memory stores, conversation logs, retrieval indexes and tool outputs: they hold personal information, need access controls like any other store, and need a retention rule.

The OAIC's guidance on commercially available AI products states that privacy obligations apply to personal information input into an AI system and to output data containing personal information, and recommends as best practice that organisations do not enter personal information, particularly sensitive information, into publicly available generative AI tools¹⁶. For agents, whose memory and retrieval can accumulate personal information across tasks, the input and output framing is the practical one.

When something does go wrong, the Notifiable Data Breaches scheme applies. An APP entity that suspects an eligible data breach, such as an agent exposing or disclosing personal information without authorisation, must take all reasonable steps to complete an assessment within 30 calendar days, and the OAIC treats that as a maximum. If the breach is likely to result in serious harm and cannot be remediated, the entity must notify affected individuals and the OAIC as soon as practicable^29,30. Logs that show exactly what an agent accessed and sent are what make that assessment fast.

9. Scams, consumer law and government agencies

The Scams Prevention Framework requires businesses in designated sectors to take reasonable steps to prevent, detect, disrupt, respond to and report scams, with penalties of up to $50 million²⁰. Banks, telecommunications providers and digital platforms are the first designated sectors. It applies in stages: covered entities have had to be members of the Australian Financial Complaints Authority (AFCA) since 1 September 2026, most obligations commence on 31 March 2027, and further obligations are expected by the end of 2027, with the codes and rules still being finalised²¹. The framework is not about AI. It matters for agents in two directions: agents deployed by banks to detect and disrupt scams, and customer-side or bank-side agents that initiate payments and could be manipulated into sending money where they should not.

For customer-facing agents, the Australian Consumer Law is the nearer constraint. Treasury's October 2025 review of AI and the Australian Consumer Law notes that the prohibitions on misleading or deceptive conduct and false or misleading representations apply regardless of the technology used, and that misleading conduct can be contravened without fault²². An agent that describes products, prices or eligibility inaccurately exposes the business even if no person wrote the words.

For Commonwealth agencies, the Policy for the responsible use of AI in government version 2.0 took effect on 15 December 2025 for non-corporate Commonwealth entities. Each in-scope use case must have a clearly assigned accountable officer and be recorded in an internal register, and AI impact assessments are mandated; the first new mandatory requirement began on 15 June 2026 and the remaining requirements take effect in December 2026^25,26. Suppliers to government should expect the same structure in their contracts.

10. Where the Australian obligations converge

The instruments come from different regulators and different decades. For an organisation running agents, they converge on the same small set of controls. The mapping below is our analysis.

Product description. CognaOne is building controls of this kind: an agent and AI asset register, controls held with their regulatory provenance, including CPS 230, a deterministic action gate and decision records. The Global Focus edition sets out that design in Section 6 of that edition.

11. A worked example: a supplier payment agent

The instrument map is easier to use when it is applied to one workflow. Take an accounts-payable agent at an APRA-regulated bank. It reads supplier invoices, matches them to purchase orders and proposes payments. This is a higher-consequence design example: it goes beyond the Five Eyes guidance's cautious recommendation to use agents only for low-risk, non-sensitive tasks², and shows what the controls have to carry once an organisation chooses to go past that line. Each step is marked as required by an instrument, expected by a supervisor, recommended in guidance, or our design response.

No single instrument requires this exact design. Together they make it hard to justify a design without these steps.

12. The Australian dates that matter

These are the dates that create or change an obligation, plus the supervisory statements that tell regulated entities how existing obligations apply.

13. Questions for the board and the accountable executive

An organisation that cannot answer these should narrow its agents' action space before expanding their autonomy.

14. Conclusion

Australia's approach is spread across regulators, but it is consistent. APRA supplies the operational and information security framework and has now said where AI breaks it. ASIC supplies the licence obligation and a court decision that makes proportionate, demonstrably effective controls enforceable. The cyber agencies supply the technical control set, written specifically for agents. Privacy law adds a dated transparency obligation for automated decisions. None of it waits for an AI Act.

The obligations already exist. What is missing in most organisations is the evidence that each agent's actions sit inside them.

About the author and CognaOne

AI use: research and drafting for this review were supported by AI tools. Multiple models were used for research and to cross-check facts, and every factual statement was verified by the author against the cited sources. The author is responsible for the content.

References