ASIC's Bank AI Review Is a Preview for Every Australian Board

ASIC has told banks what to expect in the year ahead, and the rest of us should read over their shoulder. The headline is about banking. The lesson is about governance, and it applies well beyond financial services.

The signal under the headline

In a letter tied to its 2026-27 corporate plan, ASIC named the use of AI in customer-facing activities as one of five banking priorities. ASIC will review the use of AI in customer-facing activities and will review lender conduct practices, such as incentives, referrer arrangements, and broker oversight. The review is expected to start early in the financial year, and ASIC is immediately prioritising supervision of AI used for customer-facing activities, decision-making and lending. To keep things tidy, ASIC will work with the Australian Prudential Regulation Authority (APRA) to reduce overlap with related work on AI risks.

This builds directly on ASIC's Report 798, 'Beware the gap', from October 2024. The review analysed 624 AI use cases across 23 AFS and credit licensees who operate in the banking, credit, insurance and financial advisory sectors. It focused on use cases where AI directly or indirectly impacted consumers. The finding that matters: the report identifies a growing 'governance gap' in which AI adoption is outpacing risk management and governance frameworks. In plain numbers, 61 per cent of licensees in the review advised they planned to increase their use of AI in the next 12 months, yet nearly half of licensees did not have policies in place that considered consumer fairness or bias, and even fewer had policies governing the disclosure of AI use to consumers.

One detail from the report captures the risk cleanly. ASIC raised concerns about an AI model used by one licensee to generate credit risk scores, describing it as a 'black box'. They noted that this model lacked transparency, making it impossible to explain the variables influencing an applicant's score or how they affected the final outcome. If you cannot explain a decision that affects a customer, you cannot defend it.

Why this matters outside banking

Banks are first because the consumer stakes are highest and the data is richest. They are not the last. The trajectory here is from broad principle to sector-specific supervision, and the mechanism ASIC is using is one most regulators already have.

The key point from Report 798 is that ASIC reminded financial services businesses to consider and comply with their existing regulatory obligations when adopting and using AI. They pointed out that the current regulatory framework for financial services and credit licensees is technology-neutral, meaning it applies equally to both AI and non-AI systems and processes. Read that across the economy. Consumer law, privacy law, director duties and the obligation to act fairly already apply to what your AI does. On directors specifically, their duty to exercise their powers with the care and diligence a reasonable person would use in similar circumstances extends to the adoption, deployment, and use of AI.

And the gap ASIC found in finance looks a lot like the gap across Australian business. One survey of Australian organisations found that 83 per cent have adopted artificial intelligence in at least one area, while only 21 per cent have a formal AI governance or policy framework. A separate global study placed Australia behind the pack: only 22% of Australian organisations said they were mostly or fully ready in AI governance, compared with 33% globally. The commercial read is simple. Adoption has run ahead of the controls, and regulators have noticed.

What adoption with governance actually looks like

None of this calls for slowing down. It calls for being able to answer four questions about any AI touching a customer or a consequential decision.

First, what do we use and where. Keep a current inventory of every AI use case in production and in development, including the tools staff reach for on their own. You cannot govern what you have not written down.

Second, who is accountable. Name an owner for each use case and a clear path for how a tool gets approved before it goes live. ASIC found the more mature licensees took a strategic, centralised approach rather than letting each team run its own race.

Third, how we check for harm. Test consequential models for bias and fairness, keep a person in the loop for decisions that affect people, and make sure you can explain an outcome in words a customer would accept. The 'black box' credit score is the cautionary example.

Fourth, what we tell customers. Disclosure and a route for people to raise concerns are where most organisations are weakest, and they are exactly where ASIC's consumer focus points. Close that gap now, while it is cheap to do.

The work here is not glamorous. It is an inventory, an owner, a test and a disclosure line, written down and kept current. That is the difference between an AI programme you can defend and one you are hoping nobody asks about.

The right next steps for you depend on where you are right now. Our AI Maturity Assessment is an easy place to start. After that, let's have a chat about your next steps.