The government has now told APRA and ASIC to prioritise AI - here's what that changes
On 16 July 2026, the Treasurer issued updated Statements of Expectations to APRA and ASIC. Both statements name responsible AI oversight as an explicit government priority, paired with an equally explicit instruction to keep regulation proportionate. Read alongside the APRA and ASIC letters already covered here, the sequence is now: regulator warnings in April and May, then a government mandate in July - a narrative that is far harder for a board to treat as optional.
The challenge
A Statement of Expectations does not create new law or a new direct obligation on regulated entities - it directs the regulator, not industry. That distinction matters, but it should not be mistaken for the document being low-stakes. Both APRA and ASIC have now been told, in near-identical language, that promoting and monitoring responsible AI use is a government priority. For boards that have been waiting to see whether AI oversight was a passing regulatory concern or a durable one, this removes the ambiguity - and it does so with a whole-of-government mandate behind it rather than a single regulator acting alone.
Key insights
AI named as a priority, in near-identical terms
Both statements instruct their regulator to promote and monitor responsible use of AI technologies to maintain safety and stability in the financial system. The wording is close to identical across both documents - a coordinated position rather than either regulator acting independently. For entities regulated by both APRA and ASIC, there is now no daylight between the two mandates on AI.
Proportionality is a repeated, explicit instruction - not a footnote
Both statements direct a proportionate, risk-based approach that actively minimises unnecessary burdens on industry. APRA's statement adds a principles-based approach to regulation. Government has explicitly told both regulators not to over-reach. This gives entities a legitimate basis to expect regulatory engagement that is calibrated to their actual risk profile - not a blanket compliance burden.
Both regulators are told to lift their own technology and cyber capability
Alongside the AI clause, each statement separately instructs APRA and ASIC to advance their own technological capability and match their culture of innovation to emerging threats - APRA aligned to the Government's broader cyber security framework; ASIC alongside its role in the Council of Financial Regulators' cyber security work. The expectation cuts both ways: as regulators sharpen their own capability, their ability to identify gaps in industry practice sharpens with it.
Growth and productivity frame the whole document - AI sits inside that, not above it
AI is one of twelve named priorities in each statement, alongside areas such as superannuation, climate, cyber security and payments reform. Both statements frame the regulators' work around building a more productive, more resilient economy. The instruction is proportionate AI oversight within a growth mandate - not AI governance at any cost. This is a useful framing for boards weighing how much to invest: the expectation is credible controls, not maximalist caution.
This is directional, not a new direct obligation - but the signal is what matters
A Statement of Expectations does not itself create a new compliance requirement for regulated entities. Its value is as a signal: AI oversight now carries a whole-of-government mandate behind it, reinforcing the urgency of the APRA and ASIC letters already in front of boards. Entities that treated those earlier letters as one regulator's individual concern no longer have that reading available to them.
What this means for your organisation
For entities already working through APRA's April 2026 letter or ASIC's May 2026 cyber letter, this Statement of Expectations does not introduce new work - it removes the option of waiting to see whether AI oversight sticks as a regulatory priority. Boards should treat it as confirmation that the direction of travel is government-backed and durable, and use it to test whether their AI governance investment is proportionate to what is now a whole-of-government expectation, not just a single regulator's.