ASIC’s 2026 risk radar is out, and for the first time artificial intelligence sits alongside cyber, superannuation, and banking as a top-tier regulatory concern.
The message is clear: AI governance is no longer a thought-leadership topic. It is a compliance obligation.
For startups building or deploying AI in financial services, this changes the calculus. The window for “we’ll figure out governance later” is closing.
What ASIC Is Actually Saying
ASIC’s FY26 corporate plan and risk outlook name AI as a priority surveillance area. The regulator is not waiting for new legislation. It is using existing powers — the AFSL obligation to act efficiently, honestly, and fairly — to scrutinise how licensees use AI.
Three specific signals from the first half of 2026:
-
ASIC and APRA sent joint letters to industry outlining their expectations for AI governance. These letters, analysed by Corrs Chambers Westgarth and Ashurst, make clear that boards and executives are expected to own AI risk — not delegate it to engineering teams and forget about it.
-
ASIC has publicly flagged concerns about AI governance at licensee level. In testimony and public remarks, ASIC officials have questioned whether AFSL holders have adequate controls around AI-driven advice, AI-assisted claims handling, and AI-powered customer communications.
-
The enforcement posture is shifting from “monitor” to “expect.” Industry publications are describing FY26 as a “year of accountability” for AI usage. The regulator expects licensees to demonstrate that they understand what their AI systems are doing and can explain those decisions.
This is not a distant horizon. ASIC is building capability now. If you are an AFSL holder, or a startup whose product touches regulated financial services, ASIC expects you to be building capability too.
Norton Rose Fulbright’s Practical Compliance Primer
In response to this shifting landscape, Norton Rose Fulbright published a detailed compliance primer: Artificial Intelligence in the Australian financial services sector: a practical compliance primer.
The primer is significant not just for its content but for what it signals: major law firms see enough demand from clients to justify producing detailed AI compliance guidance. The questions that banks, insurers, and wealth managers are asking their lawyers about AI are the same questions startups should be asking themselves.
The primer walks through the regulatory framework that applies to AI in Australian financial services — not a single AI-specific statute, but a web of existing obligations that AI systems trigger:
- The AFSL general obligations (s912A of the Corporations Act)
- The duty to provide financial services efficiently, honestly, and fairly
- Privacy Act obligations around automated decision-making
- Anti-discrimination law where AI models produce biased outcomes
- APRA’s CPS 230 operational risk management standard
The message: you do not need a dedicated AI Act to have AI compliance obligations. The existing framework already applies.
What This Means For Startups
There is a common startup instinct that regulation is for incumbents. That ASIC won’t come after a 15-person team building an AI-powered compliance tool or a robo-advice platform.
That instinct was probably right in 2023. It is becoming wrong in 2026.
ASIC’s risk radar names AI as a cross-cutting concern. The regulator’s approach is principles-based, which means size does not exempt you — your obligations scale with the risk your product creates, not the size of your team.
Here is what practical AI governance looks like for a startup:
If you are building AI that touches financial services, you need to be able to answer five questions:
-
What decisions is the AI making, and what decisions is it only informing? The distinction matters. ASIC will treat an AI that autonomously approves a loan differently from one that flags a document for human review.
-
How do you test for fairness, accuracy, and safety before deployment? A demo that works for the founding team is not the same as a system that works for all customers. ASIC expects evidence of testing.
-
What happens when the AI gets it wrong? Do you have monitoring, alerting, and rollback paths? Can you reconstruct what happened and explain it to a customer — or a regulator?
-
Who owns AI risk inside the company? If the answer is “the engineers, I guess,” you have a governance gap. ASIC and APRA expect board and executive ownership.
-
Can you show your working? When ASIC asks how your AI system made a particular decision, can you produce evidence? Audit trails, model cards, test results, and decision logs are not optional extras — they are your defence.
The Clock Is Ticking
In The Docker Moment for AI Agents, I wrote that the infrastructure around agents matters more than the models themselves. Governance is part of that infrastructure.
In The Human-AI Partnership, I argued that accountability must be explicit before production. ASIC’s 2026 posture makes that argument operational.
If you are building AI for financial services in Australia, here is your checklist for the rest of 2026:
- Document where AI sits in your product workflow (assist vs. decide)
- Implement basic model testing for fairness and accuracy
- Set up decision logging that would survive an ASIC information request
- Assign named ownership of AI risk at the executive level
- Review your AFSL obligations as they apply to automated decisions
None of this requires a compliance team of twenty. It requires treating AI governance as a product requirement, not a legal distraction.
ASIC has put AI on the radar. The startups that respond now will be the ones still standing when the radar turns into enforcement.
Written by Haris Habib from Sydney, Australia | June 2026