What regulators are actually asking for on AI governance - and why most entities aren't ready
In April and May 2026, APRA and ASIC wrote directly to regulated entities. APRA's message: AI adoption is accelerating, but governance is not keeping pace. ASIC's: AI is accelerating cyber threats, and the basics must be robust. For boards and executives in APRA and ASIC-regulated entities, these letters are not background reading - they are a direct statement of supervisory expectations, with enforcement consequences for those who fail to act.
The challenge
The problem is not that regulated entities are ignoring AI - they are actively adopting it. The problem is that governance structures, risk frameworks, assurance functions and board oversight have not matured at the same pace. APRA observed that most entities have not operationalised AI governance in practice, despite recognising that existing prudential standards apply. ASIC's message was equally direct: "The time to act is now."
Key insights
Adoption without governance is the identified risk
APRA's targeted engagement across major banks, insurers and superannuation trustees found AI being actively adopted across claims triage, loan processing, fraud disruption and customer interaction. What it did not find was governance keeping pace. Most entities recognised AI risk in theory but had not translated that recognition into policy, accountability structures, lifecycle controls or meaningful board reporting. The gap between adoption and governance is now a live supervisory concern.
Both regulators have moved from guidance to expectation
These letters are not discussion papers. APRA has explicitly stated it will take stronger supervisory action and, where appropriate, pursue enforcement where entities fail to manage AI risks in a way proportionate to their size, scale and complexity. ASIC has directed that its letter be tabled at board and risk governance committees. Regulated entities should treat both documents as minimum baseline statements of what is now expected, not aspirational benchmarks.
Boards are being held to a higher standard of AI literacy
APRA observed that many boards are still developing the technical literacy required to provide effective challenge on AI risks. Overreliance on vendor presentations without independent scrutiny was a specific concern. Boards are now expected to understand AI strategy, set risk appetite for AI, and receive reporting that goes beyond activity updates to demonstrate actual control effectiveness across the AI lifecycle.
Existing frameworks need to be actively extended to cover AI
A common gap APRA identified was entities treating AI as just another technology risk - applying existing change management and assurance frameworks without accounting for the distinct characteristics of AI: adaptive model behaviour, inherent bias, privacy and data risks, and opaque third and fourth-party dependencies. Existing frameworks are a starting point, not a complete answer. They require deliberate extension to be fit for purpose.
The window for a measured response is narrowing
ASIC's instruction was direct: act now, and do not wait. APRA has signalled it is finalising its AI supervisory forward plan and will apply proportional but firm focus to regulated entities' AI risk management. Entities that are still at the planning or awareness stage are already behind. The question for boards and executives is not whether to act - it is whether the pace and depth of their response is proportionate to what regulators have now made plain.
What this means for your organisation
Encompass works with regulated entities to translate regulatory expectations into practical governance uplift - from AI risk frameworks and board reporting structures to lifecycle accountability and assurance design. The APRA and ASIC letters of April and May 2026 provide a clear reference point. Encompass helps entities assess their current position against that standard and build a credible, evidenced response.