ASIC and APRA Discuss Frontier AI, Cyber Resilience With Superannuation CEOs

Key Takeaways

• ASIC and APRA have published notes from joint roundtables held with superannuation fund CEOs in June 2026, covering frontier AI adoption, cyber and operational resilience, and crisis preparedness.
• While non-binding, these notes signal clear supervisory focus areas that superannuation trustees should expect to inform future guidance, surveillance, and enforcement priorities.

Deep Dive

This update reflects ongoing coordinated supervisory engagement between ASIC and APRA with the superannuation sector's senior leadership. Although the released notes are not a formal rule, guidance, or legislative instrument, they are an important signal of regulatory priorities and provide insight into the issues regulators consider most pressing for trustee boards and executives. Compliance teams should treat these roundtable notes as an early indicator of where supervisory attention—and potentially future formal guidance or thematic reviews—will be directed.

The three thematic areas discussed—frontier AI, cyber and operational resilience, and crisis preparedness—align with existing regulatory trends, including APRA's CPS 230 (Operational Risk Management) requirements and ASIC's increasing scrutiny of AI governance across financial services. Superannuation trustees should anticipate that regulators will expect robust governance frameworks around AI deployment (including model risk management, explainability, and third-party AI vendor oversight), alongside demonstrable cyber resilience and incident response capabilities consistent with CPS 230 and related prudential standards.

No specific deadlines or new compliance obligations are introduced in this document; however, the timing is notable given APRA's CPS 230 came into effect from July 2025, meaning operational resilience and crisis preparedness are already live supervisory expectations. The AI discussion suggests regulators may be gathering intelligence ahead of potential future guidance or consultation on AI use within superannuation, a sector increasingly adopting AI for member services, fraud detection, and investment decision-making.

Recommended actions for compliance professionals include: (1) reviewing current AI governance frameworks and ensuring board-level oversight of frontier AI use cases; (2) validating that operational resilience frameworks meet CPS 230 requirements, including business continuity and third-party risk management; (3) stress-testing crisis preparedness and incident response plans, particularly for cyber events; and (4) monitoring for follow-up guidance, consultations, or thematic reviews from ASIC/APRA stemming from these discussions. Risk implications are moderate in the near term given the informational nature of this release, but trustees failing to proactively address these themes risk being outliers in future supervisory reviews or enforcement sweeps.

Source: Australian Securities and Investments Commission