APRA CPS 230 for AI systems and agents
CPS 230 Operational Risk Management has applied to APRA-regulated entities since 1 July 2025. It does not mention AI by name, but AI now sits inside critical operations, and AI vendors are service providers.
| CPS 230 asks you to | What that means for AI | In Cogna8 |
|---|---|---|
| Manage operational risk with clear accountability | Every AI system in a critical process has an owner and a risk tier | Inventory with owners, tiers and review dates |
| Identify critical operations and set tolerance levels | Know which critical operations depend on AI, and how much disruption is tolerable | Systems linked to the operations they support |
| Maintain business continuity | Plan for an AI system failing or behaving wrongly | Continuity controls and incident records per system |
| Manage material service providers | Model providers and AI features in vendor software are service providers | Vendors and models linked to the systems that use them |
41 controls in the registry. This page is general information, not legal advice.
Let's connect
Tell us where your AI programme is today. We start with a short, scoped pilot on your own AI estate, and every enquiry is handled in confidence.