What IsAustralian Prudential Regulation

What Is APRA CPS 230?

APRA Prudential Standard CPS 230 Operational Risk Management (commenced 1 July 2025, remade with effect from 1 July 2026) applies to all APRA-regulated entities and has direct implications for how they govern AI systems.

Commenced

1 July 2025

Remade, in force

1 July 2026

Applies to

ADIs, insurers, RSE licensees

Replaced

CPS 231, CPS 232, HPS 231, SPS 231, SPS 232

Regulator

APRA

What CPS 230 requires

CPS 230 consolidates and significantly strengthens APRA's operational risk requirements. It requires regulated entities to identify their critical operations, set tolerance levels for their disruption, identify and maintain the people, technology, information, facilities and service providers those operations depend on, and manage service provider risk, all of which have direct implications for AI governance.

A note on dates, because this is widely misreported. CPS 230 commenced on 1 July 2025, in the form made by the 2023 determination as varied in 2024. APRA remade the standard by determination made on 23 April 2026 (F2026L00475), which revoked the earlier determination; the remade standard commenced on 1 July 2026 and is the version now in force. 1 July 2026 was also the day the last transitional relief for pre-existing material service provider arrangements expired. CPS 230 did not first commence in 2026.

Critical operations

Regulated entities must identify their critical operations, the processes undertaken by the entity or its service provider that, if disrupted beyond tolerance levels, would have a material adverse impact on depositors, policyholders, beneficiaries or other customers, or on the role the entity plays in the financial system.

Tolerance levels

For each critical operation the board must approve tolerance levels covering the maximum period of disruption, the maximum extent of data loss, and minimum service levels. AI system failures must be factored into these tolerances.

Material service providers

Third-party AI providers that a critical operation depends on are material service providers. Due diligence, contracts with audit rights, and transition plans are required.

Supporting resources

Entities must identify, document and maintain the people, technology, information, facilities and service providers their critical operations rely on, so those operations can be kept within tolerance levels through severe disruptions.

Board accountability

Boards must approve the Operational Risk Management framework and receive regular reporting on operational risk, including AI incidents and near-misses.

Notification obligations

An operational risk incident the entity determines is likely to have a material financial impact, or a material impact on its ability to maintain its critical operations, must be notified to APRA as soon as possible and no later than 72 hours after becoming aware of it. A disruption to a critical operation outside tolerance must be notified as soon as possible and no later than 24 hours. An information security incident already reported under CPS 234 does not have to be reported again under CPS 230.

Why CPS 230 matters for AI governance

AI systems embedded in credit decisioning, fraud detection, underwriting, customer service at scale, and investment management are likely to support critical operations, triggering CPS 230's most demanding resilience requirements. Whether any given process is a critical operation is the entity's own determination against the CPS 230 definition.

Third-party AI providers used in these processes are material service providers. APRA expects due diligence before engagement, contracts with audit rights and incident notification requirements, adequate liability provisions, and transition plans for exit.

Boards that have not explicitly addressed AI within their operational risk appetite and governance frameworks, including board approval of disruption tolerances that account for AI failure scenarios, are not meeting CPS 230 expectations.

CPS 230 and AI deep-dive Operational risk management for AI What is a material service provider? Australian AI governance hub

This page is general information about APRA CPS 230, not legal or compliance advice, and does not capture every nuance or exception. Always verify against APRA's own published standard and your own qualified legal counsel before relying on it.

What CPS 230 requires

Why CPS 230 matters for AI governance