Australia’s prudential regulator has warned super funds are embedding artificial intelligence into critical business functions faster than governance and cyber controls can keep pace, raising concerns about operational resilience and concentration risk across the financial system.
Speaking at the AFIA Risk Summit in Melbourne, APRA member Therese McCarthy Hockey said the rapid uptake of AI across banking, superannuation and insurance had exposed weaknesses in governance, risk management and operational oversight, as institutions increasingly rely on the technology for decision-making and customer-facing activities.
The warning follows APRA’s targeted review of 11 representative entities across banking, superannuation and insurance, which found AI is now being deployed in software engineering, fraud and scam disruption, loan application processing, claims triage and customer interaction.
The regulator said adoption has accelerated markedly over the past two years as AI moves from experimentation into operationally embedded and decision-critical roles.
“The pace of change in the scale, speed, and complexity of AI adoption has been relentless, and what we found is that governance, risk management, assurance and operational practices are not keeping up,” Hockey said.
APRA also identified growing concentration risk, warning some regulated entities had become heavily dependent on a single provider for multiple AI applications, potentially leaving the financial system exposed if those services were disrupted.
“Frontier AI is not just a cyber risk issue. It’s third-party risk, a concentration risk and a sovereign access risk. A critical business process, control or cyber-defence capability that depends on a single offshore frontier AI model may be disrupted not only by an outage or cyber incident but by a regulatory decision made overseas,” Hockey said.
The regulator said super funds and other financial institutions should not delay strengthening cyber security while waiting for access to the latest frontier AI models, instead focusing on governance, operational resilience and existing information security controls.
“As we race to identify and patch vulnerabilities before they can be exploited by bad actors, nothing will achieve this faster than AI – whether frontier models or the advanced models already in circulation. By harnessing AI to build the fire breaks we need to keep the flames from spreading, we can fight fire with fire,” Hockey said.
APRA is also urging greater collaboration across the financial sector as advanced AI capabilities become more widely available, arguing that institutions with early access should share intelligence on vulnerabilities and defensive techniques to strengthen resilience across the system.
“We expect to see organisations granted early access to frontier AI models sharing information and insights with peers and suppliers. Where one institution learns something material about AI-enabled vulnerabilities, model limitations, jailbreak techniques or defensive use cases, the system as a whole benefits when that knowledge is shared quickly and safely,” Hockey said.
Alongside AI, APRA warned advances in quantum computing could accelerate threats to the encryption standards protecting bank accounts, superannuation balances and sensitive financial data, prompting the regulator to step up engagement with regulated entities over their preparedness.
“Until recently, the hypothetical day when quantum computers become powerful enough to break the cryptographic security that currently protects global digital infrastructure was thought to be more than 10 years away. But advancements in computing technology, including AI, have led to speculation that cryptographically relevant quantum computing could become a reality much sooner – years earlier in fact,” Hockey said.
APRA said it expects regulated entities to begin mapping where cryptography is used across their systems and third-party providers and to develop plans to transition to post-quantum cryptography, warning boards will need to demonstrate they understand the emerging risk and are taking action before the threat materialises.
