AI Governance for Australian Financial Services
AI governance records where AI is used, the risks it introduces and the controls in place. Governance support is provided with partners within relevant implementation, with Adaca RED holding the record where included in the scope.
The Enforcement Climate in Numbers
Adaca analysed a decade of ASIC enforcement data obtained under Freedom of Information. The regulator collected $830 million in civil penalties across the 2025-26 financial year, more than in any single full financial year on record, and close to the $887.2 million it collected across the entire preceding decade combined. The previous peak was $229.9 million in FY2021-22.
The case count has not moved. ASIC lodged 29 civil proceedings in the ten months to April 2026, roughly in line with the 33-a-year average across the previous decade. What has changed is the size of the penalty each action produces, and the pace of investigation: 226 commenced in ten months, approaching the decade high of 252 with two months of the year still to run.
The full analysis is published in ASIC's FY26 civil penalties are already a record. Covering the findings, ifa.com.au reported ASIC is setting a new standard on AI governance and data sovereignty (ifa.com.au).
Where AI Changes the Exposure
AI enters a financial services business faster than its governance does. At Adaca's May 2026 executive roundtables, only 4 of 50 Australian businesses placed themselves at the governance stage of AI maturity, and staff at many of the rest were using personal AI accounts with no sanctioned alternative. Ungoverned use is not hypothetical: it is the default state of a business that has adopted AI informally.
Most firms lean on existing data policies to cover AI use. They rarely stretch. A data policy written before generative AI says nothing about which models may see customer information, who approved a use case, or what evidence exists that a control is still operating after the pilot ended.
The roundtable data is published in full in AI Maturity in Australian Businesses, 2026.
What a Governance Layer Contains
The governance record connects each AI initiative to its risks, controls and review history. Adaca RED holds that record, with controls scored and decisions dated.
-
AI Register
Record AI tools and initiatives, their purpose and the data involved.
-
Risk and Control Assessment
Link risks to controls and record the control scores.
-
Review Record
Keep dated decisions and evidence from reviews.
Acceptable-use policies and provider agreements support the register. Finding unrecorded use requires discovery; the Shadow AI guide explains interviews, inventories and authorised technical checks, including their limits.
Delivery in Regulated Environments
Adaca built a CRO risk dashboard for ANZ, an adviser portal for ClearView and a consolidated executive data view for IAG. These examples demonstrate software delivery in financial services.
The full stories are in our financial services case studies. Discovery establishes requirements for Adaca Autopilot workflows, Adaca AI Pods custom technology or both. Governance support is provided with partners within the relevant implementation. For businesses outside financial services, AI Governance for Australian Businesses covers the same record.
Common Questions
How much did ASIC collect in civil penalties in FY26?
$830 million across the 2025-26 financial year, according to Adaca's analysis of ASIC enforcement data obtained under Freedom of Information. That is the highest of any financial year on record; the previous peak was $229.9 million in FY2021-22.
Is ASIC filing more enforcement cases?
No. ASIC lodged 29 civil proceedings in the ten months to April 2026, in line with the decade average of 33 a year. The record total comes from larger penalties per action, not more actions.
What does AI governance actually involve?
An AI register records tools, initiatives, purposes and data. A risk and control assessment links risks to scored controls, while a review record holds dated decisions and evidence. Acceptable-use policies and provider agreements support that record.
Does a governance register detect all AI use?
No. A governance register records supplied or discovered evidence. Staff interviews and authorised technical checks inform it, and ongoing review is needed as tools and uses change.
How many Australian businesses have reached the AI governance stage?
At Adaca's May 2026 executive roundtables, 4 of 50 businesses placed themselves at Walk, the governance stage of Adaca's Crawl, Walk, Run maturity model. 45 placed themselves at Crawl.
Last updated