APRA CPS 220
APRA CPS 220 Risk Management sets the risk framework and appetite the rest sits in. It does not name AI, but it covers the risks AI creates.
The current version has applied since 1 July 2019. SPS 220 sets the same expectations for superannuation trustees and has applied since 1 January 2020.
| The rule asks you to | For AI | In CognaOne |
|---|---|---|
| Keep a risk management framework covering every material risk | AI risk sits in the framework under the material risk it belongs to | Each AI system linked to its material risks |
| Set a Board-approved risk appetite, with tolerances | AI is rated against tolerances the Board has set | Tier rules written against your appetite |
| Give APRA an annual risk management declaration, and review the framework comprehensively at least every three years | The Board needs evidence about AI, not assurances | Register summary, risk profile and evidence kept ready |
| Notify APRA of significant breaches as soon as practicable, and within 10 business days | AI failures can be framework breaches | The affected system, its owners and controls known at once |
This page is general information, not legal advice. Sources checked October 2026.
Last reviewed October 2026Suggest a change