APRA CPS 230
Operational risk management applied to AI.
CPS 230 has applied to APRA-regulated entities since 1 July 2025. It does not mention AI by name, but AI now sits inside critical operations, and AI vendors are service providers.
| CPS 230 asks you to | For AI | In Cogna8 |
|---|---|---|
| Manage operational risk with clear accountability | Every AI system in a critical process has an owner and a tier | Inventory, risk tiers, review dates |
| Identify critical operations and set tolerances | Know which operations depend on AI | Systems linked to the operations they support |
| Maintain business continuity | Plan for an AI system failing or misbehaving | Continuity controls and incident records per system |
| Manage material service providers | Model providers and AI in vendor software are service providers | Vendors and models linked to systems |
This page is general information, not legal advice.
Last reviewed October 2026Suggest a change