APRA CPS 230 does not prescribe AI training, but it does expect an APRA-regulated entity to manage operational risk through controls that operate. Once an AI agent drafts or executes work inside a critical operation, the person who reviews its held actions is the control. Staff capability means that person can read the agent's decisions, intervene, and prove they did.
What does CPS 230 ask of the people around an AI agent?
CPS 230 is APRA's standard on operational risk management. In substance it asks three things: manage operational risk across people, processes, systems and external events; keep critical operations running within the tolerance levels you set, even through disruption; and manage the risk that comes from relying on service providers. The board is accountable, and senior management must make the framework work in practice.
The standard is about outcomes, not courses. It does not tell you how many hours of training a reviewer needs. What it does say, in effect, is that a control you rely on must be designed well and must operate as designed. Once an agent sits inside a process, many of your controls are people: the reviewer who approves a held payment, the team lead who stops an agent, the risk owner who signs off a new capability. If those people cannot do the job, the control exists on paper only.
So the capability question under CPS 230 is narrow and testable. Can each person named in a control perform it, and can you show that they can? That is the same question our guide to AI literacy and certification for people who work with agents starts from.
Which entities and roles does it reach?
CPS 230 applies to APRA-regulated entities: banks and other deposit-taking institutions, insurers, and superannuation trustees. Inside those entities, the people who matter for agents fall into four groups.
- Reviewers and operators who approve, edit or decline what an agent drafts or what the platform holds for them.
- Process owners for each critical operation where an agent works, who set the agent's limits and the tolerance assumptions behind them.
- Risk and compliance staff who test controls, investigate incidents and report upwards.
- Directors and senior executives, who need enough literacy to challenge what management tells them about agents.
If a third party runs agents for you, the service provider expectations in CPS 230 still leave accountability with you. You cannot outsource the competence to judge whether the provider's controls work.
What changes when the system is an agent that acts?
A reporting tool that produces a wrong number creates a problem someone may catch later. An agent that executes routine work, or proposes a payment that a person then approves, changes the state of the business. Operational risk moves to the moment a person accepts or declines the agent's proposal.
Three features of a governed agent shape what staff must understand. First, depth: an agent may read at depth 1, draft at depth 2, execute routine work within bounds at depth 3, and move money or take hard-to-undo actions at depth 4. A reviewer must know which depth applies to the capability in front of them, because the review is different at each. Second, the verdict: an action can be allowed, held for a named person, refused because it falls outside the agent's bounds, or withheld at the platform floor. A held action is the reviewer's decision to make; a refusal is not a fault to work around. Third, the agent's certificate lapses after 90 days, and a run that clears no depth drops it to depth 1 the same day.
That third point is a CPS 230 point in its own right. If an agent drops to depth 1 on a Tuesday morning, can your team absorb its work within tolerance? Staff capability planning is part of the continuity answer, not separate from it. A capability and depth matrix for each agent shows, per capability, the depth granted and the named people who can cover the work by hand.
How do you meet CPS 230 for the staff who oversee agents?
Treat each human step around an agent as a control and give it what any control gets: an owner, a design, a test and evidence.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Controls are designed and operate effectively | Only certified reviewers may approve held actions at depth 3 or 4 | Approval records naming each approver, matched to their credential status on that date |
| Critical operations stay within tolerance | Named fallback staff trained to do the work if the agent drops to depth 1 | Cover rota, results of a practice exercise, timings against the tolerance level |
| Incidents are identified and escalated | Reviewers trained to recognise agent errors, refusals and drift, and to report them | Incident log entries raised by reviewers, with time from detection to escalation |
| Service providers are managed | Staff able to read the agent's certification evidence and challenge it | Review notes on certificates, lapses and renewal decisions |
| The board oversees operational risk | Directors briefed on depth, verdicts and the record | Board papers and minutes showing the questions asked and answered |
The record is what makes this auditable. Every verdict on a governed platform is filed in an append-only record, including who approved a held action and when. Your training records should line up against it: a reviewer whose credential lapsed last month should not appear as an approver this month. For the wider framework this sits in, see operational risk management for AI agents under CPS 230.
What will APRA or an internal auditor ask?
Expect questions that test whether the human control is real rather than assumed:
- Which critical operations use agents, and at what depth for each capability?
- Who may approve held actions, and how do you know each of them is competent?
- Show a sample of approvals alongside the reviewer's training status on each date.
- What happens to the operation if the agent's certificate lapses or a run fails?
- How does the board know any of this is working?
The weak answer is a spreadsheet of course completions. The strong answer joins three records: the agent's certificate and depth, the reviewer's credential and its expiry, and the decisions that reviewer made. For the first question in detail, see critical operations and AI agents under CPS 230.
What does CPS 230 not cover?
CPS 230 is not an AI law. It does not classify AI systems, set rules for automated decisions about individuals, or prescribe a curriculum. Personal information an agent handles falls under the Privacy Act 1988, overseen by the OAIC, and conduct towards consumers falls to ASIC. The government's voluntary AI safety standard offers guidance but binds no one. CPS 230 also does not tell you which depth an agent should hold; that is your judgement, informed by evidence from the agent's own certification on your cases.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy trains reviewers and team leads on the Operator track, which ends in a written exam and a two-week practicum of real review decisions signed off by a Pryme assessor. The credential is valid for 12 months and can be checked at source through VerifyDoc.ai, so an auditor can match each approval in the record to a current credential, date by date.
Questions people ask
Does CPS 230 require formal certification of staff?
No. It requires controls that work. Certification is one way to show a person can perform a control, and an expiring credential gives you a date to check against, which a one-off course completion does not.
Do directors need training on AI agents?
The board is accountable for operational risk, so directors need enough literacy to ask the right questions: what depth agents hold, what happens on a lapse, and who reviews held actions. They do not need operator skills, but they should understand the decision chain well enough to test management's answers.
How often should reviewer competence be refreshed?
Whenever the agent's capabilities or depth change, and on a fixed cycle otherwise. Aligning the refresh with the agent's 90-day recertification means reviewers learn what changed in the work they review before they approve it.