The 2026 AI Compliance Checklist for Australian Insurers, Brokers and Underwriting Agencies (MGAs)

AI compliance for Australian insurers, brokers and underwriting agencies (MGAs): the short answer

Australia has no AI-specific prudential standard or AI law for insurance. Existing laws and standards apply, and four of them are binding: the Privacy Act, the AFSL general obligations in s912A of the Corporations Act, APRA's CPS 230 and CPS 234. The one fixed new date is 10 December 2026, when privacy policies must disclose decisions made or driven by software.

APRA's AI letter (30 April 2026) and ASIC's cyber resilience letter (8 May 2026) are not new laws. Both regulators say they will act where AI risk is not managed. This guide sets out what each document is about, what to do, and when it starts.

Overview: AI rules and expectations at a glance

CPS 230 and CPS 234 bind insurers directly. Brokers and underwriting agencies (MGAs) usually meet them through insurer contracts and oversight.

What does the law require for AI in insurance?

Four requirements are binding. Insurers are covered by all four. Brokers and underwriting agencies (MGAs) are covered by the Privacy Act (unless exempt as small businesses) and by s912A, and usually meet CPS 230 and CPS 234 through insurer contracts and oversight.

Privacy Act: automated decision-making disclosure (APP 1.7 to 1.9)

1. List every program that makes or helps make decisions about people, including third-party tools.
2. Test each one against three conditions: the program drives the decision, the decision significantly affects the person, and personal information is used.
3. Add the kinds of decisions and the kinds of personal information used to your privacy policy.
4. Keep the policy accurate as systems change.

Corporations Act s912A: AFSL general obligations

1. Show that your risk management systems, technology and people can handle AI and cyber risk.
2. Keep a risk register entry for AI, with named owners and tested controls.
3. Record board and management oversight.
4. Remember that outsourcing does not move responsibility.

CPS 230 Operational Risk Management

1. Treat AI as both an operational risk and a service provider risk.
2. Register your AI suppliers.
3. Set controls and exit plans for critical AI suppliers.
4. Keep continuity plans for processes that rely on AI.

CPS 234 Information Security

1. Define information security roles and responsibilities.
2. Keep security capability in line with the threats, now including AI-enabled attacks.
3. Notify APRA of qualifying incidents and material control weaknesses.

What do APRA, ASIC and the OAIC expect on AI?

These are letters and guidance, not new laws. APRA says it will take stronger supervisory action, and enforcement where appropriate, where AI risks are not managed. ASIC expects its letter to be tabled at the board.

ASIC open letter on cyber resilience (8 May 2026)

1. Table the letter at your board or risk committee.
2. Reassess cyber plans and decision-making.
3. Identify and protect critical systems.
4. Review user access and insider risk.
5. Tighten patching.
6. Test incident response.
7. Be able to show that controls are proportionate and work.

APRA letter to industry on AI (30 April 2026)

1. Board: build AI literacy and set AI risk appetite, with monitoring and triggers for action.
2. Governance: keep an AI framework, an owner for each AI system across its life, an AI inventory, human involvement in high-risk decisions, and staff training.
3. Security: put AI-specific controls in place, with fallback processes for critical operations.
4. Suppliers: map third and fourth parties, secure audit rights, and plan for concentration and exit.
5. Assurance: monitor continuously rather than at a point in time, and make sure second line and internal audit can assess AI.

ASIC and APRA frontier AI paper and board checklist (27 August 2026)

1. Test cyber fundamentals: asset identification, patching, access, backups and recovery.
2. Have the board settle risk appetite, escalation authority, recovery priorities and communications before an incident.
3. Treat third-party concentration as a sector-wide risk.
4. Join threat-intelligence sharing.

ASIC Report 798 (29 October 2024)

1. Compare your AI policies and disclosure arrangements with the report's findings.
2. Update governance as AI use grows, rather than waiting for AI-specific law.

OAIC guides on AI and privacy (22 October 2024)

1. Check the privacy risks of AI tools before you buy them.
2. Limit the personal information put into them.
3. Be open with customers about AI use.

OAIC guidance on GenAI tools in the workplace (December 2025)

1. Do not enter personal or sensitive information into public GenAI tools.
2. Prohibit uploads, or the tool itself, where the risk is too high.
3. Write a policy on approved tools and on checking outputs for errors.
4. Train staff on responsible use.
5. Consider technical controls that flag uploads of personal information.

AI compliance checklist: where should insurers, brokers and underwriting agencies (MGAs) start?

Start with the two items that regulators can check quickly: board evidence and a list of the AI and software you use.

Before 10 December 2026

• ☐ Table the ASIC letter at your board or risk committee and minute the discussion.
• ☐ Confirm whether the Privacy Act applies to you, then audit every program that makes or helps make decisions about people.
• ☐ Update your privacy policy for each decision that qualifies.
• ☐ Build an inventory of AI tools and use cases, with a named owner for each.

Next

• ☐ Show that cyber basics work: critical asset list, patch timeframes, access reviews, tested backups and an incident response exercise.
• ☐ Write a short AI policy covering approved tools, what staff must not enter, and when a person must review the output.
• ☐ Record which suppliers use AI, what data they receive, and whether contracts cover audit rights and incident notification.
• ☐ Brief the board on risk appetite, who can authorise major actions in an incident, recovery priorities and communications.

Ongoing

• ☐ Review AI controls on a schedule rather than once.
• ☐ Keep records of decisions, tests and board papers.

By audience: insurers should add CPS 230 and CPS 234 evidence. Brokers and underwriting agencies (MGAs) may be asked by insurers for evidence on AI suppliers and cyber controls.

Frequently asked questions about AI compliance in Australian insurance

Is there an AI law for insurers in Australia?

No. There is no AI-specific prudential standard or statute. Existing laws and standards apply, and the APRA and ASIC letters explain how the regulators read them for AI.

What changes on 10 December 2026?

Privacy policies must disclose decisions made or substantially driven by a computer program that significantly affect people and use their personal information. The OAIC released its guidance on 30 September 2026.

Does the automated decision-making rule apply only to AI?

No. The OAIC reads "computer program" broadly. It includes rule-based processes, machine learning, generative AI and everyday software.

Are the APRA and ASIC letters mandatory?

They are not new law. ASIC expects its letter to be tabled at the board, and APRA says it may take enforcement action where AI risks are not managed. Treat both as expectations a supervisor will test.

Does the APRA AI letter apply to brokers and underwriting agencies (MGAs)?

It is addressed to APRA-regulated entities, such as insurers. Brokers and underwriting agencies (MGAs) are not APRA-regulated, but the letter is a useful benchmark and insurers may pass similar expectations to them through contracts.

Can staff put customer information into ChatGPT or similar tools?

The OAIC advises organisations not to enter personal or sensitive information into publicly available generative AI tools. Set a policy on approved tools and train staff.

What should we do first?

Table the ASIC letter at your board, then list every program that makes or helps make decisions about people, ahead of 10 December 2026.

Sources

• OAIC: new resources on transparency for AI and automated decision-making (30 September 2026)
• ASIC: AFS licensee obligations and Regulatory Guide 104
• APRA: CPS 230 Operational Risk Management and CPG 230
• APRA: CPS 234 Information Security (PDF)
• ASIC media release 26-092MR (8 May 2026)
• APRA letter to industry on artificial intelligence (30 April 2026)
• ASIC and APRA media release 26-201MR (27 August 2026) and information paper
• ASIC Report 798
• OAIC: new AI guidance for business (22 October 2024)
• OAIC: GenAI tools in the workplace

Author:

Tetiana George, CEO of Curium, Co-Chair of Insurtech Australia and member of ASIC Digital Finance Advisory Committee. LinkedIn Profile.