When the only model in scope was the actuarial one.
Drova's AI Disruption Index scores CPS 230 and Financial Accountability Regime model risk as the highest AI-driven risk for Australian specialty insurers, at 93 out of 100. Under APRA's CPS 230 and the FAR, the AI-augmented inputs now inside underwriting, pricing and claims are operational and model risk that must be inventoried, validated, and owned by a named person.
The AI tool is not the risk; an uninventoried, unowned AI input is. Under CPS 230 and the FAR, each AI-augmented input in underwriting, pricing or claims is an operational and model risk that must be identified, controlled, and owned.
What CPS 230 expects
APRA's CPS 230 Operational Risk Management took effect on 1 July 2025. It requires a firm to identify its material operational risks, maintain effective controls for them with board oversight, and manage the risk of its material service providers. Technology and model risk sit squarely inside that.
When an AI claims-triage tool, a broker-integrated pricing feed, or staff drafting notes in an external AI assistant enter the workflow, each becomes an operational input the standard expects to see identified, controlled, and evidenced. See the APRA CPS 230 solution overview for how firms meet it.
The FAR
The Financial Accountability Regime has applied to insurers since March 2025. It requires a named accountable person for each material risk area. The gap that keeps surfacing is that no one has been formally named accountable for AI-driven or fast-moving operational risk, because the accountability map was drawn before those inputs existed.
Naming that owner is the step that turns AI model risk from an unassigned exposure into a governed one. The FAR is jointly administered by APRA and ASIC; the Financial Accountability Regime solution page sets out how firms map accountable persons.
In production
APRA books a prudential engagement and asks the CEO to walk the firm's CPS 230 plan through technology and model risk. The plan is there. The AI input inventory is not, and neither is a validation schedule for the AI-augmented components, nor the name of the accountable person for that domain.
Nothing in the plan is wrong. It was simply written for a slower world, and the supervisory letter changes shape as a result.
What to do
The practical first step is to inventory where AI-augmented inputs already sit in the operation, decide who is accountable for each, and set a validation cadence, so the answer exists before a reviewer asks for it.
Managing this is a controls problem: keeping an inventory, an accountable-person map, and a current view of controls as the work changes. RunSafe, Drova's objective-led risk and controls layer, is built for exactly that. For the wider picture, see the hub overview and the AI Disruption Index, Australian edition.
FAQs
Often, indirectly. An APRA-regulated capacity provider must assess and monitor its material service providers under CPS 230, which draws MGAs, underwriting agencies and coverholders into the standard through the binder relationship, even where they are not directly APRA-regulated. The evidence request tends to arrive from the binder holder, not from APRA.
No. CPS 230 is about operational resilience generally. AI matters because AI-augmented inputs are now material operational and model risks that the standard expects to be identified, controlled, and evidenced like any other.
The regime requires a named accountable person for each material risk area. For AI-driven operational risk that is a firm-specific decision, but the common failure is that no one has been named at all.
CPS 230 and FAR model risk is one of three AI-driven forces the free AI Disruption Index, Australian specialty insurer edition, sets out for the sector.
Related reading
AI risk for Australian specialty insurers
The hub: the three AI-driven forces reshaping the sector's register.
APRA CPS 230
Operational risk management expectations that reach AI inputs.
Financial Accountability Regime
Naming an accountable person for each material risk area.
RunSafe risk and controls
The risk and controls layer the Index sits inside.
CPS 230, a value opportunity for insurers
How CPS 230 can be a commercial advantage, not only a cost.
