Most Australian organisations deploying AI agents in financial processes – including insurance – cannot adequately explain those agents’ actions to a regulator, and nearly one in five cannot identify who would be held accountable if something went wrong. The findings emerge at a moment when both Australia’s prudential regulator and the insurance industry’s own peak body have publicly flagged that governance is failing to keep pace with deployment.
The report, “Agents of Change: How the Race to Deploy AI Agents is Outrunning Financial Governance,” was published by tax and compliance technology company Avalara on July 22, 2026. It surveyed 250 CFOs and senior finance leaders in Australia – including those in financial services and insurance – who had deployed, piloted, or actively evaluated AI agents in financial processes over the past 12 months. The research was conducted by Censuswide between June 15 and June 22, 2026.
The survey’s most pointed finding for insurance professionals concerns accountability. Some 18% of respondents said that if a significant AI agent error occurred, accountability would either be unclear or belong to no one. A further 18% believed the executive who approved the AI investment would ultimately bear personal responsibility – a pattern that suggests formal accountability structures are absent in many organisations. That gap is compounded by a skills deficit: 75% of respondents said they lack in-house expertise to understand how their AI agents function, relying instead on IT teams or external vendors. Only 59% were even somewhat confident they could explain an AI agent’s actions to an auditor or regulator – a level of assurance that falls well short of what prudential authorities now require.
Hugo Sarrazin, chief executive officer at Avalara, said the findings reflect a structural conflict between executive pressure and operational reality. “Australian finance leaders are right to move quickly to capitalise on agentic AI opportunities, but speed without accountability creates new forms of risk, and speed without rethinking workflows limits ROI. The organisations that realise the greatest value from AI won’t simply deploy more agents. They’ll leverage agents with trusted data, governed workflows, and clear controls that enable automation with confidence,” Sarrazin said.
The survey found that 59% of respondents said the pressure to deploy AI agents is focused primarily on speed, while only 12% said their organisation prioritises governance over speed. Some 88% reported moderate or significant career pressure to demonstrate that AI agent investments are delivering a return on investment, with half calling that pressure significant. When evaluating AI-powered solutions, respondents ranked vendor ROI evidence (23%) ahead of auditability and explainability evidence (18%) and governance and control documentation (17%) as their primary proof points – an ordering that sits in tension with the governance-first posture now expected by the Australian Prudential Regulation Authority (APRA).
The governance shortfalls identified in the survey are consistent with findings from both APRA’s own supervisory review and a 2025 report produced jointly by the Insurance Council of Australia (ICA) and CSIRO. On April 30, 2026, APRA published an open letter signalling a shift in its stance on the adoption of AI tools by Australian insurers and the associated prudential risks, after its targeted review found that there was an increasing lag between the adoption of emerging AI technologies and the implementation of appropriate risk management strategies. APRA said current approaches to governance, risk management, assurance, and operational resilience are not keeping pace with the “scale, speed, and complexity” of AI adoption across the financial system.
APRA called for a step-change in AI risk management and highlighted third-party AI supply-chain risk as a significant area of concern, warning that some entities remained heavily reliant on single providers without robust exit or substitution arrangements. The letter set out APRA’s AI-specific expectations for boards and accountable executives following a targeted supervisory engagement with selected large banks, insurers, and superannuation trustees. It came on top of Prudential Standard CPS 230, which took effect on July 1, 2025, requiring regulated entities to identify material business processes, set disruption tolerances, and strengthen oversight of material service providers – requirements with direct implications for AI governance.
The ICA and CSIRO had flagged the same tension nearly a year earlier. Their August 2025 joint report, “AI for Better Insurance: Enhancing Customer Outcomes amid Industry Challenges,” acknowledged the opportunity AI presents while calling for governance structures to accompany it. The report identified five priority AI use cases for Australian insurers – automated claims processing, fraud detection, enhanced underwriting, natural disaster impact prediction, and operational compliance – and stated that the transformation needs to be managed responsibly, with appropriate governance frameworks and guardrails to protect consumer privacy and ensure equitable outcomes. ICA chief executive officer Andrew Hall said at the time of the report’s release: “This report provides a practical roadmap for insurers to harness AI responsibly while keeping customer outcomes front and centre. The industry is committed to prioritising safe adoption by addressing privacy and safety concerns and AI system biases so that these technologies serve all Australians fairly.”
Independent legal analysis reinforces the practical weight of these obligations. According to DLA Piper, APRA has made its supervisory scope clear: insurers deploying AI in underwriting, claims handling, or risk modelling will be squarely in view, and board governance must provide line-of-sight into AI system design and deployment. The firm also noted that resilience testing, credible exit plans, and stronger oversight of material service providers are now mandatory expectations under CPS 230, with vendors that can demonstrate CPS 230-ready controls likely to enjoy a commercial advantage.
Despite the governance gaps, the survey’s respondents said they are not looking to slow deployment. They pointed to specific capabilities that would increase their confidence in expanding AI agent use: 32% cited AI agents operating within existing systems of record, 31% cited audit trails documenting every AI action, and 30% cited outputs grounded in verified compliance data. The capability identified as most valuable overall – selected by 37% of respondents – was “audit-ready documentation for every AI-driven action,” an expectation now embedded in CPS 230.
Jim Lundy, founder, CEO, and lead analyst at Aragon Research, said the central question for organisations has shifted from capability to control. “AI agents are now moving into business processes that require trust, transparency, and governance by design. As enterprises scale agentic AI, the question becomes less about whether the technology can act and more about whether organizations can understand, control, and explain those actions. In finance, where workflows are auditable and outcomes carry real business consequences, governance and explainability will become essential requirements for adoption,” Lundy said.
For insurers, the convergence of the Avalara survey, APRA’s supervisory findings, and the ICA and CSIRO’s own industry research points to a consistent diagnosis: AI deployment in the sector is accelerating, governance readiness is lagging, and the consequences – regulatory, operational, and reputational – are now a live consideration rather than a future risk.
