An AI agent platform that supports a critical operation is very likely a material service provider under CPS 230, and the model provider behind it is a fourth party you must understand. Before relying on either, do due diligence, sign an agreement with the terms the standard expects, notify APRA where required, and monitor them.
What does CPS 230 require of service provider arrangements?
In substance, the standard asks each APRA-regulated entity to keep a policy for managing service providers, to identify which are material, and to manage those with particular care. A material service provider is one the entity relies on to deliver a critical operation, or one that exposes it to material operational risk.
For material arrangements the entity must do due diligence before entering, have a formal, legally binding agreement, monitor performance and risk throughout, and plan for the arrangement ending. The agreement should cover the services and service levels, rights of access and audit for the entity and for APRA, notification of incidents and changes, use of subcontractors, liability and termination. APRA must be told about material arrangements, with stricter expectations for those involving offshoring, and entities report their material service providers to APRA.
The wider standard is summarised in CPS 230 and AI agents: operational risk management.
Who has to manage agent vendors this way?
Every APRA-regulated entity that uses a third party's agent platform, model or hosting in a way that touches a critical operation or creates material operational risk. That includes banks using a vendor's servicing agent, insurers using a claims intake platform and superannuation trustees using an administrator whose agents handle member requests.
It also includes the indirect case. If your outsourced administrator deploys agents on your members' accounts, those agents are inside your service provider chain, and you should know about them.
What makes agent platforms different from other providers?
Three features.
First, the chain is longer. Your contract is with the platform; the platform relies on one or more model providers; the model provider may rely on cloud hosting. The standard expects you to understand material fourth parties, and for an agent the model provider almost always is one.
Second, the service can change without a release. A provider updating its model can change how your agent behaves overnight. Contracts should require notice of model changes and give you time to re-test before the change applies to your work.
Third, the evidence lives with the provider. If the platform holds the record of what the agent did, your ability to reconstruct a decision depends on the agreement. Access to, and export of, that record must be a contract term, not a goodwill gesture.
Whether an agent supports a critical operation is decided by the mapping in CPS 230 critical operations and AI agents.
How do you meet the service provider duties for agent platforms?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Identify material service providers | Assess each agent platform and model provider against critical operations and risk | Materiality assessment per provider |
| Due diligence before entering | Review provider controls, model provenance, data location and incident history; test the agent on your own cases | Due diligence file and your own test results |
| Formal agreement with required terms | Contract covers service levels, audit and APRA access, incident notice, subcontractors, termination | Signed agreement mapped to the standard |
| Agent-specific terms | Notice of model changes, access to and export of action records, right to re-test | Contract schedule for agent controls |
| Understand fourth parties | Provider discloses model providers and hosting locations | Subcontractor list, refreshed on change |
| Notify APRA where required | Material and offshore arrangements assessed for notification | Notification records |
| Ongoing monitoring | Service levels, incidents and certification results reviewed on a cycle | Monitoring reports and review minutes |
| Plan for exit | Records, configurations and agent briefs exportable in usable form | Tested exit plan |
The record of each action should belong to you. If an agent's verdicts and evidence can be exported in a usable format, you can change provider without losing the history that explains past decisions.
What will APRA or auditors ask?
- Which agent platforms and model providers have you classified as material, and why?
- Where is the model run, and where is your data processed?
- What notice will you get before the provider changes the model behind your agent?
- Can you obtain the record of every action the agent took for a given customer, without the provider's help?
- What have you told APRA about these arrangements?
- If the provider failed tomorrow, what would you do?
What does the service provider part not cover?
It does not ban offshore or cloud-hosted models. It does not shift accountability to the vendor, so a vendor's assurance report supplements your own testing rather than replacing it. It does not deal with privacy, which sits with the Privacy Act 1988. And it does not settle obligations in other markets: groups operating in the EU face similar demands under DORA, which makes agent providers your ICT third parties, and some platforms also face cybersecurity duties, as covered in whether NIS2 applies to AI agent platforms. For the full regulatory map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is the model provider behind an agent a material service provider?
Often it is a material fourth party rather than a direct provider, because your contract is with the platform. If the agent supports a critical operation, you need enough visibility into the model provider to manage that risk, which usually means contractual disclosure and change notice.
Can we rely on the vendor's SOC 2 report?
It is useful evidence about the vendor's controls. It does not test how the agent behaves on your cases or within your limits, so combine it with your own certification of the agent.
Do free or low-cost AI tools used by staff count?
If staff use them in a critical operation, or put customer data into them, they can create material operational risk. Bring them into the service provider policy or stop the use.