Government bodies and regulators sound warnings on developments in Artificial Intelligence

A number of government bodies and regulators are warning industry and boards that recent developments in artificial intelligence (AI) create new risks and escalate existing challenges. The message from government is clear: industry and boards must act now.

Frontier AI models and their impact on cyber security – the ASD perspective

The Australian Signals Directorate (ASD) has issued two updates on the consequences of advanced ‘frontier AI’ technologies becoming more powerful and widely accessible. Frontier AI models are the most advanced AI systems currently available, representing the cutting edge of current AI capability. They are trained on massive datasets, enabling superior reasoning and emerging capabilities. Examples include OpenAI's GPT-4, Google DeepMind's Gemini, and Anthropic's Claude.

The ASD acknowledges that frontier AI technology will create significant new capabilities and opportunities, and notes that independent evaluations have confirmed meaningful increases in AI capability in newer models. However, the ASD is concerned that these uplifts will contribute to a rapidly changing cyber threat environment.

This threat comes from the increasing ability for frontier AI models to identify vulnerabilities in existing systems. Frontier models are dramatically increasing the speed and scale at which vulnerabilities can be identified and exploited . Combined with rapidly falling costs, this means that organisations cannot assume that malicious actors will not remain far behind these capabilities for long.

The ASD says the implication is clear: advanced AI enabled cyber capabilities will soon be widely available and cannot be treated as rare or unique. The ASD is calling on organisations to act now in preparation for a future where the  tools and computing power needed to run advanced AI models are broadly available, including to individual threat actors.

What the ASD warning means for Australian boards

The good news is that existing defensive controls, when properly implemented, remain an effective mechanism against AI-enabled attacks. AI can be used to harden cyber defences by identifying and fixing vulnerabilities in systems, and new frontier models can assist in this work.

Boards need to test whether management is considering how to use AI can be used to identify, strengthen and protect their systems.

The ASD’s guidance is that organisations should:

• Strengthen cyber security fundamentals by regularly reviewing and validating core controls;

• reduce unnecessary exposure of systems and services to untrusted networks;

• patch systems promptly, recognising that AI is accelerating the discovery and exploitation of vulnerabilities;

• implement layered security controls that assume breaches may occur and limit the spread of attacks within systems;

• Prepare for incident response by maintaining and exercising incident response plans and playbooks; and

• Use AI for defensive purposes, where appropriate, including identifying vulnerabilities and securing software before release.

Strong cyber security practices help organisations stay resilient, even as threats evolve. Boards need to challenge management on the strength of existing cyber controls, particularly the organisation’s speed in patching vulnerabilities.

The ASD updates can be accessed here and here.

ASIC shares concerns and calls for urgent cyber uplift

The ASD’s concerns about frontier AI models have been echoed and amplified by the Australian Securities and Investments Commission (ASIC). ASIC reiterates the concern that these models will lower the barrier to sophisticated cyber activity and will increase the speed and scale of malicious cyber-attacks.

The scale of ASIC’s concern is spelt out in an open letter to industry. The key message is that organisations must act immediately, and with focus and discipline, to strengthen their cyber resilience fundamentals and ensure these controls are robust, properly resourced and working effectively.

ASIC believes that urgency, focus, and accountability are all required to deal with the heightened threat level.

ASIC emphasises that governance of cyber risks should not rely solely on assurances, but must be supported by evidence, appropriate capability and resourcing.

The letter sets out the steps ASIC expects organisations to take. In summary, these steps include:

• reassessing cyber plans and preparing for incident response;

• confirming cyber risk, governance and overall risk and decision-making frameworks consider the cumulative impact of interrelated vulnerabilities;

• identifying and protecting critical assets and systems and regularly reviewing and validating core controls and user access privileges;

• minimising ‘attack surfaces’ – the unnecessary exposure of systems and services – and promptly patching  vulnerabilities;

• implementing layered security controls, sometimes referred to as ‘defence-in-depth architectures';

• actively managing third-party risks; and

• using AI for defensive purposes, where appropriate.

In a telling signal of how seriously ASIC views this issue, it is requiring all financial service licence holders and market participants to table and discuss its letter.

ASIC notes that cyber risk management starts with organisational leadership and asks entities to ensure that the letter is tabled and discussed at board meetings and risk governance committees. 

APRA calls for a step-change in AI-related risk management and governance

The Australian Prudential Regulation Authority (APRA) has similarly called for a step-change in how banks, insurers and superannuation trustees manage AI-related risks in light of rapidly evolving technology.

In a letter to industry published on 30 April 2026, APRA warns that the governance, risk management, assurance and operational resilience practices at entities are not keeping pace with the scale, speed, and complexity of AI adoption. This view is based on targeted engagement conducted by APRA in late 2025.

The letter sets out in detail APRA’s expectations for overseeing and managing AI-related risks, including:

• strong privileged access management, timely patching, hardened configurations, automated vulnerability discovery, penetration testing, and controls over increasingly autonomous ‘agentic’ AI systems and workflows;

• Robust security testing across AI‑generated code, software components and libraries; and

• consideration of third-party and concentration implications in relation to AI platforms, services, and providers.

With respect to boards, APRA observed strong interest in AI’s potential benefits but noted that many boards are still developing the  technical understanding required to effectively challenge management and oversee AI-related risks. APRA also noted an overreliance by boards on vendor presentations and summaries without sufficient examination of underlying risks.

APRA expects boards, at a minimum, to:

• maintain sufficient understanding and literacy with respect to AI in order to set strategic direction and provide effective challenge and oversight; and

• oversee an AI strategy which is consistent with the entity’s risk appetite and tolerance settings, supported by effective monitoring and reporting. The strategy is also expected to contain clearly defined triggers aligned to resilience objectives to enable timely action when systems are not operating as expected.

While APRA is not currently proposing additional requirements, it expects to see a significant improvement in how organisations monitor and control increasingly powerful AI technologies. 

Conclusion – a real and present danger

These recent communications emphasise the scale of the threat presented by developing AI technologies but also set out concrete steps that organisations and boards can take to address the threat. They provide a timely reminder that AI presents significant opportunities, but those opportunities must be pursued alongside careful management of considerable cyber and governance risks.