CPS 230 and AI: the transition period is over

APRA's Operational Risk Management standard, CPS 230, has been in force since 1 July 2025. Transitional relief for pre-existing contracts with material service providers ran to the earlier of each contract's next renewal or 1 July 2026, and that backstop has now passed. The standard never mentions artificial intelligence. It did not need to. In April 2026, APRA wrote to industry to confirm what its own text already implied: where AI supports a critical operation, the standard's requirements for continuity, fallback and supplier management apply to it in full, the same as they apply to anything else running inside that operation.

Credit where it's due

The standard itself is well built. It treats operational risk as more than an information-technology problem, and it recognises that ownership of a critical operation is distributed across an organisation while accountability for it still rests with the Board. Two provisions stand out. Paragraph 39(e) requires a communications strategy to support execution of the continuity plan, something missing from most of the failures we have reviewed: without clear ownership and an endorsed direction, silos form and keep running in their own interest. Paragraph 44 requires the plan to be updated every year for changes to organisational structure. That shows real foresight. It is also exactly where paper and practice part company.

When the loop broke

We have watched a small data science capability slowly degrade after a restructure folded it into a central area. When it worked, it was a handful of experienced people focused on one system: building it, maintaining it, standing behind it. One reporting line. The business area that used the system owned, funded and supported the team that built it, so the team built domain expertise, kept access to users, and could see what the model recommended against what the human decision-maker actually did with it. On paper the arrangement was fragile, a hodgepodge of systems tolerated rather than formally approved. In practice it held, because the business area treated the team's successes and its weaknesses as its own, and spent its own political capital on the approvals and exemptions the work needed.

Well-meaning managers with fresh resources wanted to mature the capability and moved it into a central area. Nothing broke immediately. Specialist talent moved on to new roles. Other people drifted back to the business area. Funding for some positions lapsed because the sustainment cost had never been fully priced in. The business area, which had once argued for the team's budget as its own, now treated the capability as baseline and expected the centre to fund it. Gatekeepers formed at both ends: the business area became the intermediary between the data scientists and the users, so raw feedback stopped; the data scientists lost sight of their own results, and could not say what the model had recommended yesterday or what anyone had done about it.

None of this needed a bad actor. The incentives were structural, and every function involved responded rationally to what was in front of it.

A modern organisation run by humans tends toward silos, and headcount is what lets a function exist and win funding. The business area was freed of responsibility for a capability it no longer owned. Nobody noticed, because senior management had stopped asking for the metrics the original team used to supply. Nobody was told, because blaming the restructure was the easy answer. Nobody could do the work, because the relationships with users had gone opaque. And nobody could say whether the system ultimately failed, because the data that would answer that question had stopped being collected.

Updating the continuity plan after the restructure, as paragraph 44 requires, would have changed nothing. The plan would have described the new org chart. The capability was degrading in the way things actually got done.

Sunlight

What would have fixed it is the same thing that fixes most of these failures: sunlight. Daily, weekly or monthly figures tied to every production model, showing what it recommended and how often the human decision-maker agreed, would have kept everyone honest about results, and would have given the business area the material it needed for its own assurance over individual cases. The numbers are only half of it. The people at the frontline hold the real risk knowledge, and they can see when something is drifting before any metric moves. Sunlight means talking to them regularly and treating what they say as evidence, not the quarterly green-amber-red summary a board is used to receiving.

Where the standard's pressure lands

Paragraph 19 makes the Board ultimately accountable for operational risk, and paragraph 21(a) requires it to receive regular updates on the risk profile. In practice, a board sees a summary grouped to ease the reporting burden, and what rarely reaches it is an honest, evidenced account of what is going wrong, particularly in a culture that does not reward bad news. A related judgement on this site argued that where everyone is responsible, nobody is (see five judgements on where AI capability breaks down). This is where that gap lands, and it tends to land hardest on the people who hold the real risk knowledge, who are often also where savings are sought through automation aimed at reducing headcount.

Paragraph 43 requires testing against severe but plausible scenarios. A continuity plan written only by middle managers and compliance staff tends to respond to what they have already seen. The better exercise brings people from every level of the organisation into a room to imagine what could still happen. The scenarios may never occur. They expose the common weaknesses regardless. Assurance under paragraph 45 comes from internal audit, which is frequently run on a shoestring, with well-meaning generalists who lack the specialist skills or the standing to open the doors they would need to open.

Capital, not capacity

Where APRA finds material weaknesses, paragraph 18(c) lets it require an entity to hold additional capital: money held against losses, not money spent fixing the weakness. We would rather see investment directed at the assurance infrastructure itself: data and AI stewards distributed across the organisation, scenario exercises supplemented by outside expertise where it helps, and modernisation of the systems that currently cannot produce the data a continuity plan needs.

The alternative view

The strongest counter-argument is that a regulator does not know the commercial realities of innovation, and that prescribing spending adds overhead that could damage the systems it is trying to protect. Paragraph 40 goes some way to answering this already: entities must maintain the capability to execute the plan, including people, resources and technology. It covers the point, but it is not watertight, because a plan can still be executed with the bare minimum. AI changes the calculation, because it is a learning capability. Its behaviour changes over time, its results shift as its data shifts, and shift again every time a vendor updates a model. An organisation that uses it has to become a learning organisation in turn, and that takes sustained investment in the people who watch it.

What to watch

• Hiring: whether regulated entities are recruiting data and AI governance officers, and investing in tradecraft tied to their own business, rather than generic governance theory.
• Procurement: whether AI governance becomes a gate and a line item in modernisation projects, rather than an afterthought.
• APRA's own forward plan for AI supervision: whether it addresses the capacity to execute, or only the controls written on paper.

None of this requires a new framework. The challenge for every organisation, APRA-regulated or not, is keeping the org chart on paper and the way things actually get done as close together as possible.