Over the past few months, four different Australian regulators have written to the sectors they oversee about AI. Different regulators, different sectors, same message: adoption has outpaced governance, and the regulator now expects evidence of that gap closing.
If you run a mid-market firm, you may have seen none of these. Each one was addressed to a specific regulated population, not to mid-market businesses generally. But look at them side by side and a pattern emerges that is worth your attention regardless of which sector you are in.
APRA and ASIC’s AI letters to financial services
On 30 April, APRA wrote to every bank, insurer, and super trustee it regulates. The finding, based on a supervisory review: “governance, risk management, assurance and operational resilience practices are not keeping pace with the scale, speed, and complexity of AI adoption”. One line stood out. Boards, APRA said, are showing “an over reliance on vendor presentations and summaries without sufficient examination of key AI risks”. A vendor demo is not due diligence.
Eight days later, ASIC followed with its own letter to AFS licensees and market participants, a category that includes insurance brokers as well as banks and advice firms. Commissioner Simone Constant did not soften it: “The clock is at a minute to midnight – if you aren’t on top of your cyber resilience already, the time to act and prepare is right now”.
The Tax Practitioners Board’s draft AI guidance for accounting
On 24 March, the Tax Practitioners Board released draft guidance on how the Code of Professional Conduct applies when tax practitioners use AI. The core message is unambiguous: using AI does not reduce or transfer a tax practitioner’s professional responsibility. Practitioners remain fully accountable for accuracy whether they used AI or not. CPA Australia has since lodged a submission responding to the draft, which means the guidance is still moving and the final version is not yet settled.
The TGA’s ruling on AI scribes in healthcare
On 30 January, the Therapeutic Goods Administration published a clarification on which AI scribing tools count as a regulated medical device. This matters well beyond hospitals: AI scribes have spread quickly through general practice and allied health clinics. AHPRA’s standing position underneath all of this is plain: regardless of what technology is used, the practitioner remains responsible for delivering safe care, and TGA approval of a tool does not remove that responsibility.
The pattern across every regulated sector
Different regulators, different sectors, same shape: AI adoption has moved faster than the rules anyone wrote down, and the body responsible for the sector has now said so, in writing, with an expectation that the people in charge can show evidence rather than offer assurance. Both APRA and ASIC have also flagged frontier AI models by name as a reason this matters more now than it did a year ago.
You do not need to be a bank, a tax agent, or a GP to recognise the gap these letters describe. Most mid-market firms I talk to are using AI somewhere, staff have adopted tools faster than anyone wrote a policy for them, and nobody has been given the job of keeping across what their regulator expects this year versus what it expected last year.
That is the actual cost of AI adoption that gets left out of the productivity conversation. The tools save time. Staying across what you are now expected to know does not save time, it just accumulates as something else on your plate.
This is precisely the kind of thing that is easy to miss if you are not reading regulator releases as a matter of course, and entirely reasonable not to be reading them, because running a firm is the job, not monitoring every regulator’s letterhead.
It is also exactly the kind of thing I flag for clients before they have to ask.
