Summary
- Main document: Guidance for AI Adoption (National AI Centre, DISR), published 21 Oct 2025. It is the first update of the Voluntary AI Safety Standard and condenses its 10 guardrails into 6 essential practices:
- Decide who is accountable
- Understand impacts and plan accordingly
- Measure and manage risks
- Share essential information
- Test and monitor
- Maintain human control
- Two versions: Foundations (getting started) and Implementation practices (for governance and technical teams), plus tools such as an AI policy and an AI register template and a crosswalk to the old standard. Audience now covers developers as well as deployers.
- Overlay for finance: APRA Letter to Industry on AI (30 Apr 2026), based on a late-2025 review of large banks, insurers and super trustees. It expects AI literacy on boards, AI strategy within risk appetite, AI inventories, human involvement in high-risk decisions, mapping of AI supply chains including fourth parties, exit plans for critical AI providers, and AI-specific cyber controls (for example identity for AI agents and security testing of AI-written code).
- APRA did not create new rules; it relies on existing, technology-neutral prudential standards.
Who it applies to
- NAIC guidance: any Australian organisation developing or deploying AI; no legal reach.
- APRA letter: all APRA-regulated entities (authorised deposit-taking institutions, insurers, superannuation trustees). Vendors are reached through the supplier and contract expectations.
Key dates
- Voluntary AI Safety Standard (10 guardrails) released (month per NAIC and secondary reports)
- Guidance for AI Adoption published, first update of the Voluntary AI Safety Standard
- APRA Letter to Industry on Artificial Intelligence sent to all APRA-regulated entities
Full date record
| Date | Event |
|---|---|
| 2024-09 | Voluntary AI Safety Standard released (month only) |
| 2025-10-21 | Guidance for AI Adoption published |
| 2026-04-30 | APRA Letter to Industry on AI |
Penalties and enforcement
- NAIC guidance: none.
- APRA: will step up supervisory focus on AI and take "stronger supervisory action" and possibly enforcement where entities fail to manage AI risk for their size and complexity. APRA said it was finalising a forward plan for AI supervision.
What it means for an Indian company
- Selling to Australian banks or insurers: expect APRA-driven due diligence on your AI, including fourth-party model providers you rely on, audit and transparency clauses, and exit or substitution support (SC-AI-007 Third-party and vendor AI due diligence, SC-AI-033 Business continuity and fallback for AI).
- Be ready to show agent identity and access controls and security testing of AI-generated code (SC-AI-030 Access control for AI systems and agents, SC-AI-029 AI-specific security controls (prompt injection, model abuse), SC-AI-018 Robustness and adversarial testing (red teaming)).
- Use the six practices as a light checklist for any Australian client: named accountable owner SC-AI-002 AI roles, accountability and oversight committee, impact assessment SC-AI-006 AI impact assessment (people and society), risk register SC-AI-003 AI system inventory, disclosure SC-AI-025 Public AI transparency statement and notices, testing and monitoring SC-AI-015 Pre-deployment testing and validation SC-AI-020 Performance monitoring and drift detection, human control SC-AI-026 Human oversight and override.
- Serious incident reporting and Notifiable Data Breaches duties are referenced in the implementation guidance; align with SC-AI-031 AI incident management and regulator reporting.
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when Australia AI Guidance (NAIC and APRA) is done.
Glossary
- NAIC: National AI Centre, part of the Department of Industry, Science and Resources.
- VAISS: Voluntary AI Safety Standard, the 2024 predecessor with 10 guardrails.
- APRA: Australia's prudential regulator for banks, insurers and super funds.
- Fourth party: your supplier's supplier, for example the model provider behind a vendor's AI tool.
- Prudential standard: binding APRA rule (for example on operational risk or information security).
Key takeaways
- National guidance is voluntary: 6 practices replacing the 10 VAISS guardrails, published 21 Oct 2025.
- APRA's 30 Apr 2026 letter makes AI governance a live supervisory issue for Australian financial institutions, with enforcement possible under existing standards.
- Vendor impact is mainly through supply chain mapping, contracts, exit plans and AI cyber controls.
Official sources
- Guidance for AI Adoption, DISR (archived copy of 17 Nov 2025 showing publication date), accessed 2026-10-19
- Guidance for AI Adoption, live page (timed out from our network on 2026-10-19; content now also hosted at ai.gov.au)
- APRA Letter to Industry on Artificial Intelligence (30 Apr 2026), accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.