Lead signal
APRA and ASIC now want frontier AI cyber risk handled with tested playbooks, not awareness. Access to director details on the companies register is also being tiered from mid-2027, which reaches every verification workflow that pulls it.
Regulatory changes on the radar
Show radar
Regulatory radar overview
Select a numbered signal to read its detail. Size and colour show severity.
Zoom and drag to explore. The radar stays open until you hide it.
Regulators want AI cyber plans tested
- Who it affects
- CISOs and privacy officers at regulated financial firms
- What it can disrupt
- incident playbooks, escalation paths and third-party maps never tested at the speed of AI-enabled attacks
- Why it matters now
- Board checklist published. APRA and ASIC point to existing standards, so the test is evidence, not new rules.
Company register access is being tiered
- Who it affects
- data and privacy teams whose workflows rely on companies register data
- What it can disrupt
- KYC, credit and collections workflows that pull director details from open register searches
- Why it matters now
- Proposed, not final. Consultation closed 12 October; new access settings planned from 1 July 2027, fully in place by 1 August 2028.
Compiled with care from public sources; errors and omissions excepted. Always check the linked source before acting. Regulatory Radar is general information, not legal or compliance advice.