The Australian Prudential Regulation Authority (APRA) has warned that the rapid adoption of artificial intelligence (AI) across banking, insurance and superannuation is outstripping organisations’ ability to manage the associated risks, as emerging technologies create new cyber, operational and concentration threats across the financial system.
Speaking at the AFIA Risk Summit in Melbourne, APRA member Therese McCarthy Hockey said frontier AI represents a fundamental shift in the risk landscape and requires financial institutions to strengthen governance, cyber security and operational resilience practices.
APRA’s concerns follow a targeted review of 11 representative entities across banking, superannuation and insurance, which found AI is increasingly being embedded into critical business functions, including software engineering, fraud detection, loan processing, claims triage and customer interactions.
While the regulator acknowledged AI presents significant opportunities to improve efficiency and customer outcomes, Hockey said risk management frameworks had failed to keep pace with the technology’s growing use.
“The pace of change in the scale, speed, and complexity of AI adoption has been relentless, and what we found is that governance, risk management, assurance and operational practices are not keeping up,” she said.
Hockey also highlighted the increasing concentration risk emerging from widespread reliance on a small number of AI providers, warning that disruption to a major provider could have broad implications across the financial system.
“Frontier AI is not just a cyber risk issue. It’s third-party risk, a concentration risk and a sovereign access risk. A critical business process, control or cyber-defence capability that depends on a single offshore frontier AI model may be disrupted not only by an outage or cyber incident but by a regulatory decision made overseas,” Hockey said.
The warning comes after recent developments involving advanced AI models, including restrictions on access to some frontier systems, heightened concerns among global cyber security agencies and growing scrutiny of the technology’s ability to identify software vulnerabilities.
Hockey said financial institutions should not delay strengthening cyber defences while waiting for access to the latest AI technologies, instead focusing on existing security controls, governance arrangements and operational resilience measures.
“As we race to identify and patch vulnerabilities before they can be exploited by bad actors, nothing will achieve this faster than AI – whether frontier models or the advanced models already in circulation. By harnessing AI to build the fire breaks we need to keep the flames from spreading, we can fight fire with fire,” she added.
The regulator is also encouraging greater collaboration across the financial sector, particularly as large institutions gain early access to advanced AI models.
“We expect to see organisations granted early access to frontier AI models sharing information and insights with peers and suppliers. Where one institution learns something material about AI-enabled vulnerabilities, model limitations, jailbreak techniques or defensive use cases, the system as a whole benefits when that knowledge is shared quickly and safely,” Hockey said.
Beyond AI, APRA warned that advances in computing power could accelerate the arrival of practical quantum computing, creating a separate threat to the encryption standards underpinning financial systems and customer data.
“Until recently, the hypothetical day when quantum computers become powerful enough to break the cryptographic security that currently protects global digital infrastructure was thought to be more than 10 years away. But advancements in computing technology, including AI, have led to speculation that cryptographically relevant quantum computing could become a reality much sooner – years earlier in fact,” Hockey said.
APRA expects regulated entities, including super funds, to begin mapping where cryptography is used across their systems and to develop plans for transitioning to post-quantum security standards in line with guidance from the Australian Signals Directorate.
