AI governance is not just another technology risk - and treating it that way will cost you
APRA's most pointed observation from its late 2025 targeted engagement was that regulated entities are treating AI risk as just another technology risk. This misses fundamental differences that existing frameworks were not designed to handle. AI systems are probabilistic, adaptive and often opaque - characteristics that require a distinct governance approach, not simply an extension of existing IT risk or change management disciplines.
The challenge
Most risk frameworks in regulated entities were built for deterministic systems - technology that behaves predictably and consistently. AI does not work this way. Models learn, drift and degrade over time. Outputs can be unpredictable. Bias can emerge post-deployment. These characteristics demand different controls, different assurance methods and different board oversight - yet the default response has been to route AI through existing frameworks with minor modifications. That default is what APRA has now called out.
Key insights
Deterministic thinking does not apply to probabilistic systems
Traditional IT risk management assumes systems behave consistently if built and tested correctly. AI models do not share this property. A model that performs well at deployment can drift, degrade or produce biased outputs over time as data patterns shift. Point-in-time testing and periodic audits - standard practice for technology risk - are insufficient. AI requires continuous monitoring calibrated to the criticality of each use case, with defined thresholds for intervention.
Model lifecycle governance is where the gaps are
APRA found specific weaknesses in post-deployment monitoring, model behaviour tracking, change management and decommissioning. These are lifecycle stages that traditional technology governance handles poorly for AI. Entities need explicit ownership and accountability across the full AI lifecycle - from design and development through to deployment, ongoing monitoring and eventual retirement. Without this, models continue operating beyond their useful or safe life with no structured oversight.
Bias, ethics and conduct risk are not optional considerations
AI systems can embed and amplify bias present in training data, producing outcomes that create conduct risk, customer harm or regulatory exposure. APRA specifically identified ethical considerations and inherent bias as key differences that entities are underweighting. For ASIC-regulated entities in particular, where consumer outcomes and market integrity are central, the conduct risk dimension of AI decision-making demands explicit treatment in governance frameworks - not a footnote.
An AI inventory is the starting point - and most entities do not have one
APRA's minimum expectation includes a current inventory of AI tooling and use cases across the entity. Without this, it is impossible to assess risk exposure, apply proportionate controls, or respond to a supervisory inquiry with confidence. Many entities have shadow AI use - tools adopted by teams outside approved control frameworks. Establishing a complete, accurate inventory is the foundational step from which all other governance activity flows.
Accountability must be explicit, not assumed
AI governance requires named ownership across the lifecycle - not a shared assumption that existing risk, technology and compliance functions will pick it up collectively. APRA expects defined accountability for AI design, deployment, monitoring and decommissioning. Where high-risk decisions are involved, human accountability must be explicit and documented. Entities that lack clear ownership structures will struggle to demonstrate effective governance when supervisors come looking.
What this means for your organisation
Encompass helps regulated entities move from awareness to operationalised AI governance - designing frameworks, accountability structures and reporting mechanisms that reflect the actual characteristics of AI systems, not just the characteristics of the technology they replaced. The starting point is an honest assessment of where your current frameworks leave gaps. Encompass can help you find them before your regulator does.