Finance, Consulting, Director ASIC guidance 8 min read

ASIC's guidance on AI: what it means for financial services and consulting

GP
Guru Prasad, Founder, AAAI. Published 19 October 2026.
Share

ASIC has not written a separate rulebook for AI, and it has said it does not need one to act. Its first review of AI use by financial services and credit licensees, Report 798 (October 2024), found governance lagging adoption and told licensees to meet the obligations they already have: provide services efficiently, honestly and fairly, keep adequate risk management and resources, make no misleading claims, and stay responsible for third-party models. For advice businesses, the best interests duty applies to AI-assisted advice exactly as it does to any other advice.

In brief
  • ASIC's position is that existing, technology-neutral law already applies to AI: licensee obligations, consumer protection law, design and distribution obligations and directors' duties.
  • Report 798 reviewed 624 AI use cases across 23 licensees and found that only 12 had AI policies referencing fairness and only 10 referenced disclosing AI use to consumers.
  • In 2026 ASIC has widened its focus: an open letter on AI-driven cyber risk in May, agentic AI named as a key issue in January, and a banking sector AI review flagged in September.
Plain English

An AFS licensee holds an Australian financial services licence and a credit licensee holds an Australian credit licence. Both carry a set of general obligations, the best known being the duty to provide services "efficiently, honestly and fairly" (section 912A of the Corporations Act 2001 for AFS licensees, section 47 of the National Consumer Credit Protection Act 2009 for credit licensees), alongside duties to manage risk and keep adequate resources and competence.

The best interests duty applies to anyone giving personal financial advice to a retail client, and ASIC's guidance on digital advice (Regulatory Guide 255) confirms that the same obligations apply whether the advice comes from a person or an algorithm. Design and distribution obligations require issuers and distributors to define a target market for a product and take reasonable steps to keep distribution consistent with it. If your organisation is also APRA regulated, read this alongside our explainer on APRA CPS 230 and AI.

Australian context

ASIC published Report 798, Beware the gap: Governance arrangements in the face of AI innovation, on 29 October 2024. It reviewed 624 AI use cases in use or in development as at December 2023 across 23 licensees in banking, credit, insurance and financial advice. Use was described as relatively cautious and mostly supported human decisions, but 61% of licensees planned to increase AI use within 12 months, around 30% of use cases relied on third-party models, and governance policies on fairness and disclosure were thin. ASIC's message was to update governance before deploying AI rather than wait for AI-specific law.

ASIC has since kept the same principles-based stance. In a July 2025 speech to the ABA Banking Conference, the Chair said ASIC was not rushing to more AI regulation and that existing laws apply. On 8 May 2026, Commissioner Simone Constant issued an open letter to AFS licensees and market participants calling for urgent cyber uplift as frontier AI accelerates threats, describing cyber resilience as a core licensing obligation. ASIC's Key issues outlook 2026 (January 2026) named harms from advanced technology, including agentic AI, as a key issue, and its 30 September 2026 banking priorities letter flagged a banking sector AI review, coordinated with APRA.

Sources: ASIC Report 798 and media release 24-238MR, 29 October 2024; ASIC speech "AI: A blueprint for better banking?", 23 July 2025; ASIC media release 26-092MR, 8 May 2026; ASIC Key issues outlook 2026, January 2026; ASIC banking sector supervisory letter, 30 September 2026; ASIC Regulatory Guide 255. Checked 19 October 2026.

The risk and the opportunity

Report 798's case studies show where this goes wrong in practice. One licensee kept using a third-party credit risk model for months after an internal review described it as a black box whose scores could not be explained. An insurer used a third-party AI model to index claims documents containing sensitive information without specifically telling consumers. Another licensee recalibrated a credit model without adequate testing or documentation. None of these needed an AI law to be a problem: each touches the duty to act fairly, the duty to manage risk, or the rule that statements to customers must match reality. Where personal information is involved, the same tools also sit under the Privacy Act 1988 reforms, including the automated decision-making transparency requirements that commence on 10 December 2026.

The opportunity is that ASIC has published the questions it is asking. Report 798 closes with eleven, from "Where is AI currently being used in your business?" to "Who is accountable for AI use and outcomes?" and "Are your governance arrangements leading or lagging your use of AI?". A licensee that can answer them with documents, not intentions, is in a strong position for the banking review and any surveillance that follows. For consultants and vendors, those same questions are a practical specification: a tool that cannot be explained, tested, monitored or switched off creates a compliance problem for the licensee that buys it.

From obligation to control: a four-step model

  • Know where AI is used and who owns itKeep an inventory of AI use cases, including vendor features and generative AI used by staff, with a named accountable owner for each. This is the base for adequate risk management and for directors exercising care and diligence, and it answers ASIC's first and fourth questions.
  • Test for fair outcomes before and after deploymentCheck models for bias, unexplained outcomes and effects on vulnerable customers, and check that AI-driven segmentation does not push customers outside a product's target market. This is where "efficiently, honestly and fairly", the ban on unconscionable conduct and the design and distribution obligations meet.
  • Say only what the AI actually doesReview marketing, disclosure and customer communications so that claims about AI use, accuracy and human involvement match how the system operates. Decide, as a documented policy, when customers are told AI is involved and what choices they have.
  • Keep people who can explain and override the outputMake sure staff understand the rationale, risks and rules behind the models they rely on, review AI-assisted advice before it reaches a client, and can suspend a tool when it errs. Outsourcing a model to a vendor does not outsource the licensee's responsibility for it.

What this means for you

Advice businesses: advisers, paraplanners and licensee compliance teams

AI tools that draft file notes, fact finds or Statements of Advice do not change who owes the best interests duty. The adviser still has to be satisfied the advice is appropriate and that the client's relevant circumstances were properly identified, and the licensee still has to supervise and monitor the advice its representatives give.

Do this: write down which advice steps AI may assist with, what an adviser must check before anything reaches a client, and how that check is evidenced on file.

Directors and risk leads at AFS and credit licensees

ASIC has linked AI governance to directors' duties and, in 2026, framed AI-driven cyber resilience as a core licensing obligation. Boards are expected to know where AI is used and to have looked at the foreseeable risks before deployment, not after an incident.

Do this: table Report 798's eleven questions at the next risk committee and ask management to answer each one with evidence.

Consultants and vendors who build or advise on AI for licensees

Your client carries the regulatory obligation, but your design choices decide whether it can be met. Report 798 found licensees struggling to explain and monitor third-party models, and found it common for a large share of a licensee's use cases to depend on third parties.

Do this: ship every AI engagement with documentation of purpose, data, testing, monitoring triggers and a manual fallback, written so a licensee's compliance team can rely on it.

Frequently asked

Has ASIC issued AI-specific rules for licensees?

ASIC's approach has been to apply existing, technology-neutral law rather than create AI-specific rules. Report 798 (October 2024) told AFS and credit licensees to meet their existing obligations when using AI, and ASIC has repeated that stance in later speeches and its May 2026 open letter on AI-driven cyber risk, while noting more regulation may be needed in future.

Does the best interests duty apply if an adviser uses AI to prepare advice?

Yes. The duty attaches to the advice, not the tool. ASIC's Regulatory Guide 255 states that the obligations for traditional and digital advice are the same, and that licensees need people who understand the technology and can review the advice it produces. An adviser who relies on AI-generated content remains responsible for it.

Do licensees have to tell customers they are using AI?

There is no general AI disclosure rule, but any statement about AI must not be misleading, and ASIC has flagged undisclosed AI use as a consumer risk. Report 798 found only 10 of 23 licensees had policies on disclosing AI use. From 10 December 2026, Privacy Act reforms also require privacy policies to describe certain automated decisions that use personal information.

Turning ASIC's questions into working controls is applied governance, and it is what AAAI's certifications are built around for Australian financial services and consulting. If your team is starting to map where AI touches advice, credit or claims, the AI Core financial services track is the place to begin. If you lead AI strategy for a licensee, or advise licensees as a consultant, CAIS: Certified AI Strategist goes deeper.

Explore AI Core Explore CAIS
ASIC guidance Financial advice Financial services AI governance