34.8%of corporate data going into AI tools is now classified as sensitive.
And in May 2026, ASIC published the clearest signal yet about what that means for Australian businesses.
The Digital Finance Cooperative Research Centre, commissioned by ASIC, released a landscape review of innovation in financial technology and RegTech. It covers credit, insurance, payments, and the governance infrastructure around all of it. The headline finding, buried in chapter 8: “The deployment of AI-driven decision systems has outpaced governance frameworks.”
That’s not a think tank opinion. That’s a regulator-commissioned research centre telling ASIC, on the record, that the industry has a gap.
Three gaps the report names that most firms haven’t closed
The report identifies three priority areas where international regulators are converging. Each one maps directly to obligations Australian firms already have, or will have by December.
1. Accountability for automated decisions
The Privacy and Other Legislation Amendment Act 2024 introduces transparency obligations for automated decision-making that commence on 10 December 2026. If your organisation uses AI for decisions that significantly affect someone’s rights (loan approvals, insurance claims, triage), you’ll need to explain how that decision was made. Not in theory. In evidence. Per decision.
2. Third-party and platform dependence
The report warns that “a small number of vendors provide compliance infrastructure to large portions of the sector” and flags the concentration risk that creates. APRA’s CPS 230, effective July 2025, already requires entities to manage material third-party technology dependencies with documented oversight. If your AI calls go through a US-hosted API and you can’t tell your board which provider processed which data, that’s a gap.
3. AI governance
The report notes that Australian RegTech is currently concentrated in AML/CTF and transaction monitoring. The five-year outlook says it needs to expand into AI governance, validation, and supervisory analytics. The tools most firms use today (content moderation gateways, generic logging) weren’t designed for regulatory evidence. They were designed for content safety.
The gap between “we have a policy” and “here’s the evidence”
Every mid-market financial services firm I’ve spoken to has an AI policy. Most have an acceptable use framework. Some have named their approved providers.
Almost none can answer this question: for any given AI call made by any employee on any day, what data was in the prompt, which provider processed it, and which regulatory obligations were triggered?
That’s the gap the DFCRC report is pointing at. Not the absence of policy, but the absence of continuous, per-interaction evidence that the policy is being enforced.
APRA’s letter to industry on 30 April 2026 said the same thing differently: “Monitoring should be continuous and proportionate to the criticality of the use case.” Point-in-time assessments aren’t enough anymore. The evidence needs to be live.
What this means in practice
The firms that will be ready for the ADM deadline in December aren’t the ones writing longer governance documents. They’re the ones putting the right infrastructure in place to generate compliance evidence automatically, per AI call, mapped to specific regulatory obligations.
That means Australian PII detection that actually validates what it finds (not regex that flags every nine-digit number as a TFN). Per-call attestation that’s cryptographically signed. Regulatory mapping that ties each interaction to CPS 234, APP 8, and ADM transparency controls. A tamper-evident audit trail that holds up to a seven-year retention obligation.
The DFCRC report calls this “business-side RegTech” and distinguishes it from regulator-side SupTech. The report says these systems need to be “governed and supervised.” That’s harder to do when the compliance layer is something you built internally, with no external validation and no standardised evidence format.
Where this is heading
The report compares Australia’s position to the UK (FCA Digital Sandbox), Singapore (FEAT/Veritas), and the EU (AI Act, DORA). Each of those jurisdictions has structured validation environments for AI in financial services. Australia doesn’t, yet.
What Australia does have is a deadline. 10 December 2026. Civil penalties up to $50 million.
That’s why we built 40 South Guard.
Guard is compliance middleware that sits in the AI data path, between your application and the upstream provider. Every AI call is intercepted, scanned for Australian PII (TFN, Medicare, ABN, BSB, with checksum validation, not regex guesswork), checked for prompt injection, and logged with a cryptographically signed attestation mapped to CPS 234, APP 8, and ADM transparency controls. The evidence vault retains those records for seven years in a tamper-evident, immutable audit trail.
One API change. No application rebuild. Live in a day.
The DFCRC report describes the gap. Guard closes it. Not with another governance framework or a quarterly assessment, but with continuous, per-call compliance evidence that’s there when APRA, ASIC, or your board asks for it.
The firms that treat this report as a signal will be the ones that aren’t scrambling in November. If you want to see what that evidence looks like for your use case, book a 30-minute walkthrough.