CPS 230 for AI agents
What operational-risk records look like when the operator is an agent. Four short pages.
CPS 230, operational risk
CPS 230 is APRA's Prudential Standard on Operational Risk Management. It requires an APRA-regulated entity to manage its operational risk and to keep records that evidence operational-risk events and the controls around them.
When an agent carries out an operational process, the obligation does not move. The entity still has to be able to show what happened and how the control operated, after the event.
APRA's AI letter to industry
On 30 April 2026, APRA published its first AI-specific expectations for boards and accountable executives. They came from a targeted supervisory review in late 2025. It names four areas to act on:
You still owe a record
CPS 234, Information Security, sits next to CPS 230 and covers the security of the systems that hold those records. Read together, they ask an entity to manage the risk and to be able to evidence what happened.
When an agent takes the action, the organisation still needs records that support operational-risk oversight. Arkna can organise observed activity from agreed capture points for that review. The compliance judgment under CPS 230 and CPS 234 stays with the organisation, its advisors and its auditors.
Read it on apra.gov.au
Every claim on this page traces to APRA's own material below.
