Artificial intelligence got most of the attention when the Australian Prudential Regulation Authority published its latest System Risk Outlook on Thursday, and with reason. But brokers and insurers heading into renewals with property, construction and financial services clients will find some of the most practical warnings further down the document.
The headline verdict is broadly the same as APRA’s May edition: the system is sound, insurers are well capitalised and nothing has broken. The mood has shifted, though. “Australia’s financial system remains resilient, but the risk environment is becoming less forgiving,” APRA chair John Lonsdale said in a statement accompanying the report.
Read next: Data centre insurance capacity stretched as regulator warns on AI
APRA says it will step up its focus on quantum computing through 2026-27, and it has started talking to a subset of regulated institutions about their readiness for post-quantum cryptography.
The worry is that a sufficiently powerful quantum computer could eventually break the encryption that protects financial data and transactions. Nobody can say when. What regulators can say is that swapping out encryption across a large organisation takes years, plus money and coordination that most firms haven’t budgeted for.
APRA points to guidance from the Australian Signals Directorate, which sets three milestones:
The first of those falls in about seven weeks.
APRA wants banks, insurers and super funds to work out where vulnerable cryptography sits across their systems, their data and their material service providers. It is particularly concerned about information that has to stay secure for years. For a general insurer sitting on claims files, health information and identity documents, that is a long list.
The supply chain makes the task harder. Data collected under CPS 230 shows the typical significant insurer relies on 28 material service providers, and each one needs its own plan. APRA’s reach here is limited: at Thursday’s media briefing, Lonsdale acknowledged that APRA is not the regulator for many of these third parties. In practice, that leaves insurers to push quantum readiness down the chain through contracts and supplier assurance.
Australia’s private credit market is still small. APRA estimates it at around $250 billion, less than 4% of the size of the banking system. Most of it is lent against real estate, particularly property development and construction, rather than the technology loans drawing scrutiny overseas.
That concentration is now under test. APRA points to the recent insolvency of a large property developer that had been backed by many private credit funds, along with temporary limits on investor withdrawals at some funds. The report doesn’t name the developer. It also notes that ASIC has found persistent weaknesses in governance, valuation, disclosure and liquidity management across the sector.
APRA describes insurers’ direct investment exposure as relatively small, though it expects it to rise. For brokers, the more immediate exposure is in the client book. Developers, head contractors and subcontractors funded by these vehicles are the same businesses whose collapses are already testing home warranty and surety cover limits. If funding lines tighten further, directors’ and officers’, trade credit and contract works programmes all carry exposure.
Read next: Construction contractor failures stay high as Lockton issues checklist
Overseas, the shift has been fast. APRA cites OECD estimates that AI-related transactions made up 34% of global private credit deal value in 2025, up from 9% a year earlier. The OECD’s Global Debt Report 2026 describes private credit as already playing an important role in financing the global AI expansion. Through data centre construction finance, Australian funds could pick up some of that exposure too.
Long-term government bond yields across advanced economies are near their highest levels in at least 15 years. APRA attributes this to heavy government borrowing, geopolitical volatility, higher inflation expectations and the growing influence of price-sensitive investors such as hedge funds. It cites an IMF projection that global public debt will pass 100% of GDP by 2030, a level last seen after the Second World War.
For general insurers, the effect is less damaging than it sounds. Falls in asset values are partly offset by falls in liabilities, APRA notes, and higher yields lift investment income over time. The real danger is a disorderly adjustment: a sharp jump in yields, a technology sell-off or stress in global private credit, especially if they arrive together. The large technology companies building AI infrastructure, often called hyperscalers, have more than doubled their corporate bond issuance this year. For more on how insurers are repositioning, see IB’s analysis of the retreat from fixed income.
National home prices have fallen about 6% since March. APRA cites Reserve Bank estimates that fewer than 2% of variable-rate owner-occupiers face a cash flow shortfall. The weak point is household debt, at around 180% of disposable income, which could amplify a sharper downturn if job losses mount. APRA’s debt-to-income limits stay in place as a backstop: since 1 February 2026, new mortgage lending to highly indebted borrowers has been capped at 20% of total new lending.
The banks have also come through a severe test. The 2026 Trans-Tasman Stress Test, run with the Reserve Bank of New Zealand, put the five largest Australian banks and four largest New Zealand banks through the most severe scenario APRA has ever used. It combined an oil shock, a deep recession on both sides of the Tasman, a funding squeeze, market closures and a cyber-attack on a bank-owned offshore operation. Losses were heavy, but the banks kept lending. Detailed findings are due later this year.
Read next: Regulator says AI threat has worsened and governance still lags
APRA’s 2027 System Stress Test will look at how AI-driven economic disruption could hit banks, super funds and life insurers. It will model two scenarios: rapid adoption upending business models, or a sharp fall in AI-related asset valuations. General insurers aren’t named among the participants.
Large and complex insurers are, however, in line for targeted readiness assessments. These draw on the Council of Financial Regulators’ Geopolitical Risk Program and test whether separate crisis plans hold together when several things fail at once.
Lonsdale was candid at the briefing about what resilience now means. Speaking about recovery rather than prevention, he said “it is pretty safe to assume there will be interruptions, there will be problems”. The question APRA is putting to boards is whether they can restore critical services quickly when that happens.
That adds to a busy week of regulatory signals, following an APRA member’s warning at the ICA conference that sharper AI pricing could push some risks out of insurance pools.
