Policy · Financial Services Regulation
AFS or credit licensee AI governance policy
Board-level policy that sets accountability, an AI inventory, risk rating, pre-deployment testing, human oversight, consumer transparency, vendor controls and incident escalation for a licensee's use of AI, aligned to the licence obligations and ASIC REP 798.
- Kind
- Policy. A policy or procedure for a firm or client.
- Where it applies
- Australia, European Union
- AI use
- Yellow AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at
- 17 October 2026
- Status
- Maintained. Checked against the cited sources on 17 October 2026.
- Version
- 1
- Source
- Written for this library
When to use it
Use when an AFS or credit licensee uses, buys or builds AI that affects clients, advice, credit, claims, complaints or compliance. Scale it down for a small licensee. Do not adopt it unchanged: the board must own it and the controls it describes must exist.
How AI may be used
AI can draft the policy and map the licensee's AI uses to its headings, but the board must adopt it and the lawyer must check that every control described actually operates. A policy that overstates controls is worse than none.
AI may
- Map the client's AI inventory and existing policies to the policy headings and REP 798 questions, and mark gaps.
- Draft first versions of the inventory, risk-rating and sign-off register schedules from the client's documents.
- Flag inconsistencies between this policy and the licensee's risk management framework, privacy policy and outsourcing policy.
AI must not
- Must not assign accountable persons or risk ratings; those are decisions for the licensee's management and board.
- Must not state that testing, monitoring or human review occurs without evidence from the client.
- Must not upload confidential model documentation or client data to a tool that is not approved under this policy.
The lawyer checks
- The policy fits the licence type and whether the licensee is APRA-regulated (CPS 230, FAR) or not.
- Every named role, committee and register exists, and the escalation path links to the breach reporting procedure.
- Time-sensitive references (privacy ADM rules from 10 December 2026, EU AI Act dates) are current.
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Official form
Open the official form. Always use the current version from the issuer.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Financial Services Regulation
- Reportable situation (breach) report to ASIC: assessment worksheet and completion guide
- Client notice for AI-assisted or digital financial advice
- Target market determination (template with statutory checklist)
- Responsible lending unsuitability assessment record (credit providers)
- Internal dispute resolution (IDR) final response letter, with delay notification
All precedents for Financial Services Regulation · Tasks and AI use in this area