The Australian Prudential Regulation Authority (APRA) has warned that the scale and concentration of artificial intelligence (AI) investment is testing conventional approaches to underwriting risk and the size of some projects is stretching the insurance capacity available to cover them. Today, APRA published its twice-yearly System Risk Outlook which sets out the risks the prudential regulator sees in the domestic and international environments.
APRA said advances in AI are accelerating a transformation of insurance markets as insurers integrate the technology in underwriting, pricing and claims. The investment behind that transformation is also changing what insurers are asked to cover.
The report gave data centres as its example. Clusters of facilities and high-value equipment within individual centres mean a single event, such as a natural disaster, could cause substantial losses, APRA said. The scale of some projects is also stretching available insurance capacity.
The finding comes three days after APRA member Suzanne Smith told the Insurance Council of Australia's annual conference in Sydney that sharper AI-driven risk pricing could narrow insurance pools.
The report said frontier AI models, including those from Anthropic and OpenAI, are demonstrating increasingly advanced capabilities to find software vulnerabilities, develop ways to exploit them and automate complex cyber tasks. It also noted that major United States technology companies have reported a sharp increase in public disclosures of vulnerabilities since April 2026. As advanced AI capabilities become more widely available, APRA said, malicious actors may be able to exploit vulnerabilities sooner, leaving financial institutions and material service providers less time to assess exposures, apply patches and contain cyber-attacks.
Read next: Insurers grapple with data centre risks as AI drives soaring demand — report
APRA also pointed to autonomous agents pursuing assigned goals through actions that are not authorised, citing an incident in June 2026 in which an OpenAI agent circumvented controls to access an Australian Government website.
The regulator said its prudential framework is technology neutral and that it does not regulate AI technology itself. It assesses AI-related risk through four connected channels: use within institutions, which can affect decisions, customer outcomes, risk management and critical operations; use against institutions, through faster and more sophisticated cyber-attacks, fraud and other threats; shared dependencies, where a failure or compromise involving a common model, technology platform or service provider could affect multiple institutions; and broader effects on employment, asset prices, competition and business models.
Between June and July 2026, APRA and the Australian Securities and Investments Commission (ASIC) held nine industry roundtables on frontier AI involving more than 380 entities and 600 attendees. The central message was that awareness and plans are not enough. The roundtables built on letters APRA and ASIC issued earlier in 2026. APRA's April 2026 letter found that governance, risk management, assurance and operational resilience practices were not keeping pace with AI adoption, as covered in our earlier reporting on the regulators' AI governance letters.
Five priorities emerged from the discussions:
Data collected under Prudential Standard CPS 230 Operational Risk Management showed the typical significant insurer identified 28 material service providers, compared with 52 for the typical bank and 23 for the typical superannuation fund.
Of the top 100 material service providers reported by APRA-regulated institutions, 80 are headquartered or have their principal operations outside Australia. Some individual providers support institutions that collectively account for more than half of APRA-regulated financial assets.
In a statement accompanying the report, APRA chair John Lonsdale (pictured) said resilience would depend on banks, insurers and superannuation trustees combining financial strength, operational readiness and crisis preparedness.
“Australia's financial system remains resilient, but the risk environment is becoming less forgiving,” Lonsdale said.
“Rapid advances in AI are supporting economic activity but also accelerating cyber and operational threats and increasing reliance on a relatively small number of material service providers.”
APRA is running targeted readiness assessments across large and complex insurers, banks and superannuation funds, drawing on the Council of Financial Regulators' Geopolitical Risk Program. The assessments consider whether existing arrangements can work together during severe disruption and where further improvement is needed.
Insurers remain well capitalised, the report said. Declines in asset values from higher bond yields are partly offset by falls in liabilities, and higher yields can support investment income over time. Insurers' investment exposures to private credit are relatively small but are expected to increase.
APRA's 2027 System Stress Test will explore how AI-driven economic disruption could affect life insurers, banks and superannuation funds. The exercise will look at severe but plausible downside scenarios in which rapid AI adoption disrupts some business models, or AI-related asset valuations are sharply reassessed.
