APRA CPS 230
APRA CPS 230 Operational Risk Management. AI now sits inside critical operations, and AI vendors are service providers. CPS 230 does not name AI, but it covers it.
CPS 230 has applied since 1 July 2025. Service provider contracts that existed before then must comply from their next renewal or 1 July 2026, whichever came first.
| The rule asks you to | For AI | In CognaOne |
|---|---|---|
| Manage operational risk with clear accountability | Every AI system in a critical process has an owner and a risk tier | Inventory with owners, tiers and review dates |
| Identify critical operations and set tolerance levels | Know which critical operations depend on AI, and the disruption you can tolerate | Systems linked to the operations they support |
| Maintain business continuity | Plan for an AI system failing or behaving wrongly | Continuity controls mapped to each system |
| Manage material service providers | Model providers and AI features in vendor software are service providers | Vendors and models linked to the systems that use them |
41 controls in the registry. APRA operational risk management
This page is general information, not legal advice. Sources checked October 2026.
Last reviewed October 2026Suggest a change