Actuaries & UTS launch AI risk guidance for finance

The Actuaries Institute and the UTS Human Technology Institute have launched guidance on managing AI risk in financial services, aimed at organisations expanding their use of AI.

The publication sets out a framework that can be integrated into existing enterprise risk management processes rather than replace them. It focuses on four questions for firms using AI: who is accountable for AI risks, how those risks should be classified, how they might be quantified, and which controls suit common use cases.

The launch comes as financial institutions adopt AI far faster than they build oversight around it. In a survey by the UTS Human Technology Institute, 93% of financial services organisations said they were already using AI and the rest planned to do so. Yet fewer than half said they conduct risk assessments on internal AI use, and fewer than one in three had AI-specific items on their risk register.

That gap has drawn regulatory scrutiny. Earlier this year, the Australian Prudential Regulation Authority and the Australian Securities and Investments Commission each urged the industry to strengthen governance and risk management around AI.

Risk gap

The institutes argue that AI introduces different problems from earlier technologies because its behaviour can be less predictable and harder to trace through fixed rules. They also point to the rise of agentic AI systems, which can create more distance between the staff responsible for decisions and the systems carrying them out.

Victor Bajanov, Co-lead Author from the Actuaries Institute, said many firms had not adapted their controls to match that shift.

"Despite the growing use and importance of AI, many financial services organisations are ill-equipped to manage the scale, complexity, and evolving risk profile of AI systems. Organisations that choose to do nothing in this space will be exposed to new risks they are not equipped to deal with," Bajanov said.

He said existing approaches to traditional risk could not simply be applied without adjustment.

"The financial services sector has well-established processes for managing traditional risks, but AI creates a vastly different risk profile. Organisations need to go back to first principles when deciding how to manage AI risks and assign responsibility for oversight. Managing AI risk needs to be much more than a tick-box exercise," Bajanov said.

Framework design

The framework is intended for both large institutions with substantial AI investment and smaller organisations at an earlier stage of adoption. It was designed to remain relevant as the technology changes while still fitting within the sector's current regulatory structure.

That reflects a practical problem for banks, insurers and superannuation providers: few can afford to rebuild risk systems from scratch, but many need a clearer way to fit AI oversight into board governance, compliance functions and internal controls. The guidance positions AI as an extension of enterprise risk management while recognising that it may require new accountabilities and new methods of assessment.

Nicholas Davis, Co-director of the UTS Human Technology Institute, said the stakes were high because AI systems are being used in services that shape household finances and access to products.

"Financial services shapes how we save and spend, who receives credit or insurance and on what terms, and what retirement looks like. As AI becomes increasingly embedded in these decisions and services, effective risk management and governance are vital to maintaining trust and confidence in the sector. This collaboration between the Actuaries Institute and UTS HTI brings together deep expertise in financial risk management and human-centred AI governance to help the sector respond to the opportunities and risks presented by AI," Davis said.

Sector pressure

Financial services has emerged as an early testing ground for AI governance because institutions already operate under detailed prudential, conduct and consumer obligations. The sector also uses automated systems in areas where errors or bias can affect lending, insurance pricing, claims handling, fraud detection and retirement outcomes.

Weak governance around AI can therefore create operational, compliance and reputational risks at the same time. It also means boards and senior executives may be pushed to identify where responsibility sits when AI tools are bought from third parties, embedded in legacy systems or used internally by staff without a single control framework.

Elayne Grace, Chief Executive Officer of the Actuaries Institute, said the profession had a role in helping firms make decisions as AI becomes more deeply embedded in operations.

"AI in this sector can offer significant benefits for institutions and customers alike, improving efficiency, speed, and quality of service. Yet failures in these systems risk significant harm. As experts in data-driven analysis, risk management, and long-term thinking, actuaries are well placed to support financial services organisations with decision making as they embed AI into their operations," Grace said.

She added: "We're proud to have worked together to develop this flexible framework that will help financial services organisations of all sizes safely, responsibly and effectively unlock the benefits of AI to support innovation."