AI Governance for Australian Financial Services
The board wants AI in production. The regulator wants evidence it is governed. Between those two pressures sits a question most financial services firms cannot yet answer: where is AI already in use across the business, and who signed off on it?
The Enforcement Climate in Numbers
Adaca analysed a decade of ASIC enforcement data obtained under Freedom of Information. The regulator collected $830 million in civil penalties across the 2025-26 financial year, more than in any single full financial year on record, and close to the $887.2 million it collected across the entire preceding decade combined. The previous peak was $229.9 million in FY2021-22.
The case count has not moved. ASIC lodged 29 civil proceedings in the ten months to April 2026, roughly in line with the 33-a-year average across the previous decade. What has changed is the size of the penalty each action produces, and the pace of investigation: 226 commenced in ten months, approaching the decade high of 252 with two months of the year still to run.
The full analysis is published in ASIC's FY26 civil penalties are already a record. Covering the findings, ifa.com.au reported ASIC is setting a new standard on AI governance and data sovereignty (ifa.com.au).
Where AI Changes the Exposure
AI enters a financial services business faster than its governance does. At Adaca's May 2026 executive roundtables, only 4 of 50 Australian businesses placed themselves at the governance stage of AI maturity, and staff at many of the rest were using personal AI accounts with no sanctioned alternative. Ungoverned use is not hypothetical: it is the default state of a business that has adopted AI informally.
Most firms lean on existing data policies to cover AI use. They rarely stretch. A data policy written before generative AI says nothing about which models may see customer information, who approved a use case, or what evidence exists that a control is still operating after the pilot ended.
The roundtable data is published in full in AI Maturity in Australian Businesses, 2026.
What a Governance Layer Contains
Governing AI use starts with a register: every initiative and its risks recorded, each control scored, and a dated record that survives audits. We build this on Adaca RED, our governance framework. The register answers the questions an auditor, a board or a regulator actually asks: what is running, what could go wrong, what is in place to stop it, and when was that last checked.
Around the register sit the working parts: an acceptable-use policy people can follow, a commercial agreement with a model provider so staff are not on consumer accounts, and visibility of where AI is already in use across the business.
Delivery in Regulated Environments
Adaca has built for regulated financial services since 2015. During the Banking Royal Commission we delivered the CRO risk dashboard ANZ used to navigate investigator enquiries, with zero reporting incidents. For ClearView we built the advisor portal that serves thousands of financial advisors at 99.9% uptime. For IAG we unified data across independent insurance brands into a single executive view.
The full stories are in our financial services case studies. If you are putting AI to work in your business and need the governance layer alongside it, Develop AI Solutions covers how we run that work.
Common Questions
How much did ASIC collect in civil penalties in FY26?
$830 million across the 2025-26 financial year, according to Adaca's analysis of ASIC enforcement data obtained under Freedom of Information. That is the highest of any financial year on record; the previous peak was $229.9 million in FY2021-22.
Is ASIC filing more enforcement cases?
No. ASIC lodged 29 civil proceedings in the ten months to April 2026, in line with the decade average of 33 a year. The record total comes from larger penalties per action, not more actions.
What does AI governance actually involve?
A register of AI initiatives and their risks, controls that are scored rather than assumed, and a dated record that survives audits. Around it sit an acceptable-use policy, a commercial agreement with a model provider, and visibility of where AI is already in use.
How many Australian businesses have reached the AI governance stage?
At Adaca's May 2026 executive roundtables, 4 of 50 businesses placed themselves at Walk, the governance stage of Adaca's Crawl, Walk, Run maturity model. 45 placed themselves at Crawl.