--- title: "AFS or credit licensee AI governance policy" url: "https://ailawframework.com/precedents/financial-services-regulation/licensee-ai-governance-policy" type: "precedent" site: "AI Law Framework" id: "a28-licensee-ai-governance-policy" area_id: "A28" kind: "policy" ai_level: "yellow" version: 1 law_stated_as_at: "2026-10-17" --- # AFS or credit licensee AI governance policy > Board-level policy that sets accountability, an AI inventory, risk rating, pre-deployment testing, human oversight, consumer transparency, vendor controls and incident escalation for a licensee's use of AI, aligned to… Canonical page: https://ailawframework.com/precedents/financial-services-regulation/licensee-ai-governance-policy Law stated as at: 2026-10-17 Site index for agents: https://ailawframework.com/llms.txt Board-level policy that sets accountability, an AI inventory, risk rating, pre-deployment testing, human oversight, consumer transparency, vendor controls and incident escalation for a licensee's use of AI, aligned to the licence obligations and ASIC REP 798. ## Key facts - Kind: Policy. A policy or procedure for a firm or client. - Practice area: [Financial Services Regulation](https://ailawframework.com/precedents/financial-services-regulation.md) - Jurisdictions: Australia, European Union - AI level: Yellow. AI can help in set ways. A lawyer checks specific points before use. - Law stated as at: 2026-10-17 - Status: Maintained. Checked on 2026-10-17 against the 9 authorities it cites, for Australia and European Union. ## When to use it Use when an AFS or credit licensee uses, buys or builds AI that affects clients, advice, credit, claims, complaints or compliance. Scale it down for a small licensee. Do not adopt it unchanged: the board must own it and the controls it describes must exist. ## How AI may be used AI can draft the policy and map the licensee's AI uses to its headings, but the board must adopt it and the lawyer must check that every control described actually operates. A policy that overstates controls is worse than none. **AI may:** - Map the client's AI inventory and existing policies to the policy headings and REP 798 questions, and mark gaps. - Draft first versions of the inventory, risk-rating and sign-off register schedules from the client's documents. - Flag inconsistencies between this policy and the licensee's risk management framework, privacy policy and outsourcing policy. **AI must not:** - Must not assign accountable persons or risk ratings; those are decisions for the licensee's management and board. - Must not state that testing, monitoring or human review occurs without evidence from the client. - Must not upload confidential model documentation or client data to a tool that is not approved under this policy. **The lawyer checks:** - The policy fits the licence type and whether the licensee is APRA-regulated (CPS 230, FAR) or not. - Every named role, committee and register exists, and the escalation path links to the breach reporting procedure. - Time-sensitive references (privacy ADM rules from 10 December 2026, EU AI Act dates) are current. ## Authorities - [Corporations Act 2001 (Cth) s 912A(1)(a), (d) and (h) (efficiently, honestly and fairly; adequate resources; adequate risk management systems)](https://www.legislation.gov.au/C2004A00818/latest/text) - [National Consumer Credit Protection Act 2009 (Cth) s 47(1)(a) and (l) (credit licensee general conduct obligations)](https://www.legislation.gov.au/C2009A00134/latest/text) - [Corporations Act 2001 (Cth) s 912D (reportable situations)](https://www.legislation.gov.au/C2004A00818/latest/text) - [ASIC Report 798 Beware the gap: Governance arrangements in the face of AI innovation (29 October 2024)](https://www.asic.gov.au/regulatory-resources/find-a-document/reports/rep-798-beware-the-gap-governance-arrangements-in-the-face-of-ai-innovation) - [Australian Securities and Investments Commission v RI Advice Group Pty Ltd 2022 FCA 496](https://www.judgments.fedcourt.gov.au/judgments/Judgments/fca/single/2022/2022fca0496) - [APRA Prudential Standard CPS 230 Operational Risk Management (APRA-regulated entities)](https://www.apra.gov.au/standards/cps-230) - [Financial Accountability Regime Act 2023 (Cth) ss 33, 34 (accountability statements and maps)](https://www.legislation.gov.au/C2023A00067/latest/text) - [Privacy Act 1988 (Cth) Sch 1 APP 1.7 to 1.9 (automated decision transparency, from 10 December 2026)](https://www.oaic.gov.au/news/media-centre/new-resources-on-transparency-for-use-of-ai-and-automated-decision-making) - [Regulation (EU) 2024/1689 (AI Act) Annex III point 5(b), as amended by Regulation (EU) 2026/1744](https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng) ## Official form [Official form](https://www.asic.gov.au/regulatory-resources/find-a-document/reports/rep-798-beware-the-gap-governance-arrangements-in-the-face-of-ai-innovation) ## Full text and drafting notes The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/financial-services-regulation/licensee-ai-governance-policy and through the signed-in MCP connector https://ailawframework.com/mcp/firm. *Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*