Chiefly as operational risk. CPS 230 is APRA's standard on operational risk management for the entities it regulates. An AI agent is a source of operational risk, often supports critical operations, and usually runs on material service providers. So the agent must sit inside your risk controls, your continuity planning for critical operations, and your service provider management.
Who does CPS 230 apply to and what does it ask?
CPS 230 applies to APRA-regulated entities: authorised deposit-taking institutions, insurers and superannuation trustees. It is not an AI rule; it is technology-neutral. In substance, it asks entities to:
- Manage operational risk through a framework with effective controls, which are monitored and tested.
- Identify critical operations, the processes whose disruption would materially affect customers or the entity, and set tolerance levels for how much disruption is acceptable.
- Maintain business continuity so critical operations stay within tolerance through severe but plausible disruptions.
- Manage material service providers: keep a register, assess them before and during the relationship, have formal agreements, and manage the risk of relying on them.
- Hold the board accountable for oversight of operational risk.
The critical operations side is set out in APRA CPS 230 critical operations and AI agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What makes an agent a distinct operational risk?
It can fail while appearing healthy. A traditional system that breaks usually stops. An agent that breaks may keep working, wrongly and at speed. Controls must watch what agents do, not only whether they are running.
It moves critical operations onto new dependencies. If an agent handles claims intake or payment exceptions, that critical operation now depends on the agent platform, the model provider and the data feeds the agent reads. Each may be a material service provider.
Its fallback must be real. If the agent is stopped, can people do the work within tolerance? After a year of the agent handling most of the volume, the team that used to do it may be smaller and out of practice.
The broader framework is covered in APRA CPS 230 and AI agents: operational risk management.
What may the agent do, and what stays with a person?
| Activity | Agent | Person |
|---|---|---|
| Triage and route incoming work in a critical operation | Yes, monitored | Decides to stop the agent if tolerance is at risk |
| Execute routine transactions within limits | Yes | Exceptions and anything above limits |
| Assess an operational incident | Drafts the assessment | Classifies the incident and decides on notification |
| Invoke business continuity | No | Named owner of the critical operation |
| Change a material service provider | No | Management, under the board-approved framework |
An illustrative example
Take an Australian general insurer that uses an agent to triage motor claims lodged online. Claims intake is one of its critical operations, with a tolerance that customers can lodge and be acknowledged within a set time.
The insurer's CPS 230 review finds three gaps. The model provider behind the agent is not on its register of material service providers. Its continuity plan assumes the agent is always available. And its monitoring checks the agent's uptime, not whether its triage is right. It adds the model provider and the agent platform to the register with assessments and agreements, runs a scenario where the agent is stopped for a day and staff take over, and adds outcome checks that hold the agent if misrouted claims exceed a threshold. The scenario shows staff can meet tolerance for two days, which becomes the planning assumption.
Which controls meet CPS 230 for agents?
- Agents in the operational risk register, with risks and controls per capability.
- Mapping agents to critical operations and their tolerance levels.
- Outcome monitoring that can hold or stop an agent automatically.
- Tested manual fallback for every critical operation an agent supports.
- Material service provider entries for the platform, model provider and key data feeds.
- Board reporting on agent-related operational risk.
Banks also manage agents as models; comparisons with US practice are in whether SR 11-7 applies to AI agents, and a framework for AI-specific risk is described in how the NIST AI RMF applies to AI agents. The full map is in AI agent regulation, mapped to controls.
Where Pryme fits
In Pryme, a failed certification run drops the agent to read-only the same day, and every action passes through the customer's own limits at the moment of action. Both give a CPS 230 control owner a defined, tested way to contain an agent without switching off the operation.
Questions people ask
Is a model provider a material service provider?
Often, if a critical operation depends on it or it handles significant customer data. Assess it on its role in your operations, not on the size of the contract.
Does CPS 230 require us to tell APRA we use AI agents?
Not as such. CPS 230 includes duties to notify APRA about certain service provider arrangements and significant operational events. An agent may bring those into play.
Does the Privacy Act 1988 also apply?
Yes, where agents handle personal information. CPS 230 covers operational risk; the Privacy Act, overseen by the OAIC, covers how personal information is handled.