The FAR names no technology. It requires accountable persons to take reasonable steps across their areas of responsibility, and AI systems can run inside those areas. This page sets out what the regime requires, where AI enters it, and what a company can hold on file.
01 · What the FAR requires
The Financial Accountability Regime imposes a strengthened responsibility and accountability framework on APRA-regulated entities, their directors and their most senior executives. It is established by the Financial Accountability Regime Act 2023, replaces the Banking Executive Accountability Regime, and is jointly administered by APRA and ASIC. The Regulators publish the primary guidance at Financial Accountability Regime: information for accountable entities.
The regime's four core obligation sets cover accountability, key personnel, deferred remuneration and notification. The accountability obligations are where reasonable steps lives: an accountable person must conduct their responsibilities with honesty, integrity, and due skill, care and diligence, and must take reasonable steps to prevent matters arising that would adversely affect the entity's prudential standing or prudential reputation, or that would result in a material contravention of specified laws. Accountable entities owe parallel obligations, including taking reasonable steps to ensure each of their accountable persons meets theirs.
| Applies to | From |
|---|---|
| Authorised deposit-taking institutions and their authorised non-operating holding companies | 15 March 2024 |
| Insurers, their licensed non-operating holding companies, and superannuation trustees | 15 March 2025 |
02 · Where AI enters
The FAR names no technology. It requires that accountable persons' responsibilities collectively cover all areas of the entity's operations, and it attaches the reasonable-steps obligations to the conduct of those responsibilities. Where AI systems operate inside an accountable person's area, the obligations extend to how those systems are governed, because the regime attaches to the responsibility, not to the tool.
The regime's own register architecture points the same way. The Regulator rules prescribe key functions for the FAR register, and the prescribed ADI key functions include technology management, covering technology strategy, lifecycle management and information security, as well as data management and operational risk management. AI systems in production sit inside exactly these functions. Reading AI into the FAR through them is kn0w's reading of the regime's structure, not a statement by the Regulators.
The Regulators' supervisory attention on AI under the existing framework is a matter of record. APRA's letter to industry of 30 April 2026 sets out its observations and minimum expectations on AI risk. The letter is not a FAR instrument and does not reference the regime; what it demonstrates is that AI risk sits inside the supervision entities already answer to. What the letter expects is set out at What does APRA's AI letter to industry expect?.
03 · The evidence layer
Reasonable steps is judged after the fact, on the record that exists. A privacy policy names a disclosure; an org chart names a person; neither shows what AI is running, who is accountable for it, what oversight applies, or what was spent and measured. That record is a separate document.
The Automation Report records part of it, for the whole company. Seven recorded sessions, with the CEO and six function heads, become six readings: Workflows, Tools, Skills, Oversight, Spend and Outcomes. For each, the report states the gap between the CEO's reading and the function heads'. For Australian companies, the Financial Accountability Regime is among the report's regulatory references. The report is fixed at issue, and the company's board is entitled to rely on it. Reading it into a reasonable-steps record is kn0w's reading of the regime, not a statement by the Regulators. How each reading is made is published at kn0w.co/methodology.
04 · Frequently asked questions
No. The regime is technology-neutral. Its obligations attach to accountable persons' areas of responsibility, whatever operates inside them.
Authorised deposit-taking institutions and their authorised non-operating holding companies from 15 March 2024, and insurers, their licensed non-operating holding companies and superannuation trustees from 15 March 2025. The regime is jointly administered by APRA and ASIC.
No. APRA's 30 April 2026 letter to industry sets out expectations on AI risk under the existing prudential framework, and is not a FAR instrument. No new prudential standard has been introduced.
No. It requires accountable persons to take reasonable steps, judged on the record that exists. It does not prescribe what that record contains.
The Regulators' joint information paper and supporting materials are published at Financial Accountability Regime: information for accountable entities.
Published 24 August 2026. Updated 2 October 2026. Verified against the Regulators' joint FAR information paper on 24 August 2026.