Guide
AI for financial services in Australia: the uses and the rules
By Brett Raven, APAC Lead & Board Member, AIREPublished
Australian banks, insurers, advisers and brokers can use AI under the rules they already follow. APRA expects an inventory of AI use, a person involved in high-risk decisions, trained staff and tested plans if a critical AI supplier fails. ASIC says existing obligations apply to AI. From 10 December 2026, your privacy policy must disclose decisions that programs make or inform. Start with low-risk internal uses and build governance before AI touches customer decisions.
Where AI helps in financial services
AI is already doing real work in Australian financial services, mostly in narrow, high-volume tasks with a person checking the result. ASIC's 2024 review of 23 licensees found 624 AI use cases in use or in development (ASIC, 2024).
| Part of the industry | Where AI helps | What's in production |
|---|---|---|
| Banking and lending | Checking payslips and transactions in loan applications; engaging scammers; staff assistants | Westpac runs 5 AI agents in lending, with bankers reviewing their output. CBA's scam bots have held over 350,000 conversations with scammers. |
| Financial advice | File notes, client engagement, marketing and drafting advice documents | 86% of advice practices using AI use it for file notes (Adviser Ratings, 2025). AMP's North platform offers an AI file note assistant. |
| Mortgage broking | Drafting, research and client communication | The MFAA has published a discussion paper and checklist on safe, ethical AI use in broking. |
| Across every firm | Drafting, summarising, research and analysis in general assistants | Westpac has rolled Microsoft 365 Copilot out to 35,000 staff; CBA has a partnership with OpenAI. |
The large banks lead. Westpac's Andrew McMullan said in August 2026 that 5 AI agents check payslips and transactions in its lending process, with bankers reviewing their work, saving "more than 150,000 hours" (iTnews, 2026). CBA told its October 2026 AGM that its AI bots had held more than 350,000 conversations with scammers (CBA, 2026).
Advice practices are close behind. In Adviser Ratings' 2025 report, 74% of advice practices used or planned to use AI, up from 45% a year earlier (Adviser Ratings, 2025).
What advice practices use AI for, 2025
- File notes
- 86%
- Client engagement
- 53%
- Marketing
- 48%
- Statements and records of advice
- 46%
Share of advice practices using AI that use it for each task.
There's no credible published figure for AI use at mutuals, super funds or mid-sized lenders. If your firm is one, assume you're earlier than the big four and that APRA expects the same discipline anyway.
AI tools financial services firms use
Most firms start with a general assistant on a business plan, then add AI inside the industry software they already use. Check what each vendor says about your data before customer information goes near it.
| Tool | What it's used for | What the vendor says about your data |
|---|---|---|
| Microsoft Copilot | Works inside Word, Excel, Outlook and Teams, on the files and email your Microsoft 365 tenant already holds. | Prompts, responses and data accessed through Microsoft Graph aren't used to train foundation models. It follows your permissions, sensitivity labels and retention policies. |
| ChatGPT Business or Enterprise (OpenAI) | A separate assistant for drafting, analysis and research, with connectors to Microsoft 365 and other tools. | No training on business data by default. Enterprise can store data at rest in Australia for new workspaces; processing can happen overseas. |
| Claude Team or Enterprise (Anthropic) | Reading long documents and careful drafting, with Claude Code on every Team seat. | No training on commercial inputs or outputs by default. Data is stored in the US. |
| Marloo (advice practices) | Captures client meetings on Teams, Zoom or phone and writes the file notes and documents an adviser needs. | Marloo says it doesn't use client data to train models, and that it is SOC 2 Type 2 compliant. |
Choosing between the general assistants? See ChatGPT vs Claude for business in Australia and ChatGPT Enterprise vs Copilot vs Claude.
Your regulatory obligations, and what they mean in practice
General information, not legal advice. Check how these obligations apply to your licence and your business.
No regulator has written AI-specific rules for financial services. The existing ones apply, and the regulators have said what they expect.
| Regulator | Who it covers | What it expects |
|---|---|---|
| APRA | Banks, mutuals, insurers and super trustees | An inventory of AI use, human involvement in high-risk decisions, staff training, tested exit plans for critical AI suppliers, and fallback processes for critical operations. CPS 230 and CPS 234 apply to AI. |
| ASIC | AFS and credit licensees, including advisers and brokers | Existing obligations apply to AI. ASIC is reviewing AI in banks' customer-facing activities in 2026-27. |
| OAIC (Privacy Act) | Organisations covered by the Privacy Act | From 10 December 2026, your privacy policy must disclose decisions that programs make or inform, such as loan and insurance decisions, even with human review. |
| MFAA | Mortgage brokers (industry body) | Guidance and a checklist on safe, ethical AI use, keeping the human element of broking. |
APRA
APRA's April 2026 letter to all regulated entities found governance "not keeping pace" with AI adoption. It saw "a tendency to treat AI risk as 'just another technology'", boards "still developing the technical literacy required to provide effective challenge", staff using AI tools "outside approved control frameworks", and assurance that relied on "point in time and sample based" methods ill suited to models that change over time (APRA, 2026).
It expects an inventory of AI tooling and use cases, human involvement for high-risk decisions, staff training on AI use and misuse, tested exit and substitution plans for critical AI providers, and "credible fallback processes" where AI supports critical operations. APRA isn't adding new requirements, but said it will take stronger supervisory action and, where appropriate, pursue enforcement (APRA, 2026). An APRA member has since said AI risk management should be consistent with CPS 234 and CPS 230 (APRA, 2026).
ASIC
ASIC says existing laws are technology-neutral (ASIC, 2025). Its 2024 review of 23 licensees found "nearly half" had no policies considering consumer fairness or bias, and "even fewer" had policies on disclosing AI use to consumers (ASIC, 2024). For 2026-27, ASIC will review the use of AI in banks' customer-facing activities (ASIC, 2026).
Privacy
From 10 December 2026, organisations covered by the Privacy Act must disclose in their privacy policy the kinds of decisions that programs make or substantially inform, where the decision could significantly affect someone and uses their personal information. The OAIC's examples include a bank's loan assessment and an automated life insurance approval, and it says a decision can be in scope even when a person reviews the output (OAIC, 2026).
Advice and broking
Advisers and brokers stay responsible for what they give clients, whatever tool drafted it. For brokers, the MFAA says "maintaining and retaining the human element of broking and the client interaction will be essential" (MFAA, 2024).
The risks, and the controls that deal with them
Each risk below matches something APRA, ASIC or the OAIC has flagged. The controls are our recommendations.
| Risk | How it happens | The control |
|---|---|---|
| A wrong decision about a customer | A credit, claims or advice decision informed by AI that is wrong, or unfair to a group of customers. | A named person reviews every high-risk decision. Test outcomes across customer groups before go-live and after every model change. |
| Shadow AI | Staff using AI tools outside the approved ones, with customer data. | Approve the tools first, on business plans with single sign-on. Train staff on what may go in, and keep the list current. |
| Dependence on one supplier | Several critical uses running on one AI provider, with no tested way out. | List AI suppliers in your service provider register. Test substitution and exit for the critical ones, and write audit rights into contracts. |
| Models that drift | A model that worked at go-live degrades, and a point-in-time review doesn't catch it. | Monitor outputs continuously, with thresholds that trigger review, not just an annual sample. |
| A board that can't challenge | Directors relying on vendor presentations for AI decisions. | Brief the board on how your AI works and fails, and give it the inventory and the risk reports, not the sales deck. |
| An undisclosed automated decision | A program informs a significant decision about a customer, and your privacy policy doesn't say so. | Map every program that informs a significant decision before 10 December 2026, and update the privacy policy. |
A rollout that holds up
- Build the inventory. List every AI tool and use case, including AI switched on inside software you already pay for.
- Approve the tools. Business plans only, single sign-on, and suppliers added to your service provider register.
- Start with internal, low-risk uses. Drafting, summarising and file notes, with a person checking every output.
- Train staff and brief the board. Staff on use, misuse and limits; directors on how your AI works and fails.
- Put a person in every high-risk decision. Credit, claims and advice decisions stay with a named human, and you test outcomes for fairness.
- Monitor continuously and plan the exit. Watch outputs over time, and test what happens if a critical AI supplier goes.
- Update your privacy policy before 10 December 2026. Disclose the decisions programs make or inform.
Need a policy to start from? See our AI policy template. For a management system an auditor can check, see ISO/IEC 42001 for Australian organisations.
How AIRE helps financial services firms
- Governance: the AI inventory, policy and controls, written against APRA's expectations and your existing standards, through our AI advisory work.
- Board and executive briefings: the technical literacy APRA says boards are still building, through executive AI coaching.
- Staff training: hands-on AI training for teams on your approved tools and your own documents.
- Builds: narrow agents and automations with a person in the loop, through AI automation and agent builds.
Working out where AI fits under APRA, ASIC and the Privacy Act? We'll build the inventory and the controls with you.
Frequently asked questions
Does APRA allow banks and insurers to use AI?
Yes. APRA hasn't introduced new rules for AI, and says its existing prudential standards apply. In its April 2026 letter to industry it set out what it expects: an inventory of AI use, human involvement in high-risk decisions, staff training, and tested plans if a critical AI supplier fails. It also said it will take stronger supervisory action, and enforcement where appropriate, against entities that don't manage AI risk.
Does ASIC have rules for AI?
Not AI-specific ones. ASIC says existing laws are technology-neutral, so licensees' current obligations apply when they use AI. Its 2024 review of 23 licensees found nearly half had no policies on consumer fairness or bias in AI, and its 2026-27 priorities include reviewing AI in banks' customer-facing activities.
Do we have to tell customers we use AI?
From 10 December 2026, if a program makes or informs a decision that could significantly affect a customer, using their personal information, your privacy policy must say so. The OAIC's examples include loan assessments and life insurance approvals, and it applies even when a person reviews the program's output.
Can financial advisers use AI for file notes?
Many do. In Adviser Ratings' 2025 report, 74% of advice practices used or planned to use AI, and 86% of those using it used it for file notes. The adviser stays responsible for the advice and the record, so check every AI-written note against the meeting before it goes on file.
Can banks use ChatGPT or Microsoft Copilot?
Yes, on business plans with the right controls. Westpac has rolled Microsoft 365 Copilot out to 35,000 staff, and CBA has a partnership with OpenAI. Business plans of both tools don't train on your data by default. APRA expects the tools to be on an approved list, with staff trained on their limits.
Sources
We read each source on the date shown beside it. Prices, plans and rules change, so check anything that matters before you act on it.
- Australian Prudential Regulation Authority, APRA Letter to Industry on Artificial Intelligence (AI) (30 April 2026). Read 21 October 2026.
- Australian Prudential Regulation Authority, APRA calls for step change in AI-related risk management and governance (30 April 2026). Read 21 October 2026.
- Australian Prudential Regulation Authority, APRA Member Therese McCarthy Hockey's remarks to the 2026 AFIA Risk Summit, "Fighting fire with fire" (24 June 2026). Read 21 October 2026.
- Australian Securities and Investments Commission, REP 798 Beware the gap: Governance arrangements in the face of AI innovation (29 October 2024). Read 21 October 2026.
- Australian Securities and Investments Commission, 24-238MR ASIC warns governance gap could emerge in first report on AI adoption by licensees (29 October 2024). Read 21 October 2026.
- Australian Securities and Investments Commission, AI: A blueprint for better banking? (speech by Joe Longo). Read 21 October 2026.
- Australian Securities and Investments Commission, 26-232MR ASIC releases 2026-27 supervisory priorities (30 September 2026). Read 21 October 2026.
- Office of the Australian Information Commissioner, Chapter 1: APP 1 Open and transparent management of personal information (version 2.0, 30 September 2026). Read 21 October 2026.
- Office of the Australian Information Commissioner, APP 1.7-1.9 Transparency Obligation Fact Sheet (September 2026). Read 21 October 2026.
- Mortgage & Finance Association of Australia, MFAA discussion paper sets out guidance for the use of AI in broking (24 July 2024). Read 21 October 2026.
- iTnews, Westpac plugs five AWS AI agents into core lending processes (4 August 2026) (Westpac's Andrew McMullan, as reported). Read 21 October 2026.
- Westpac, Westpac equips workforce with Microsoft AI (5 February 2026). Read 21 October 2026.
- Commonwealth Bank, 2026 Commonwealth Bank AGM: CEO's address (14 October 2026). Read 21 October 2026.
- Commonwealth Bank, CommBank and OpenAI embark on Australia-first strategic partnership to advance AI solutions (13 August 2025). Read 21 October 2026.
- Adviser Ratings, 74% of advice practices now use AI, surpassing global average (19 May 2025) (2025 Financial Advice Landscape report). Read 21 October 2026.
- AMP, North unveils innovative AI FileNote assistant for advisers (20 March 2025). Read 21 October 2026.
- Marloo, AI for Financial Advisers in Australia. Read 21 October 2026.
- Microsoft, Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat (last updated 19 August 2026). Read 21 October 2026.
- OpenAI, Data residency and inference residency for ChatGPT. Read 12 October 2026.
- Anthropic, Is my data used for model training?. Read 12 October 2026.
Related guides
- AI for accounting firms in Australia: the tools and the rules
Where AI saves time in an Australian accounting firm, which tools suit client work, and what APES 110 and the TPB's 2026 AI guidance require of you.
- A one-page AI policy template for Australian organisations
Copy a one-page AI policy for Australian organisations: approved tools, what data may go in, who checks output, who owns AI risk, and how to roll it out.
- ISO/IEC 42001 for Australian organisations: what it asks and whether to certify
ISO/IEC 42001 is voluntary in Australia. What the AI management system standard asks of an organisation, and when certification is worth the audit.