CPS 230 for AI agents
What operational-risk records look like when the operator is an agent. Four short pages.
CPS 230, operational risk
CPS 230 is APRA’s Prudential Standard on Operational Risk Management. The original standard commenced on 1 July 2025. Following targeted amendments, the current instrument commenced on 1 July 2026.
It requires an APRA-regulated entity to manage operational risk, monitor and test its controls, and ensure operational incidents and near misses are identified, escalated, recorded and addressed. It does not prescribe a dedicated record for every AI-agent run.
APRA's AI letter to industry
On 30 April 2026, APRA published AI-specific expectations for boards and accountable executives, drawn from a targeted supervisory review in late 2025. The letter identifies four areas for action:
Evidence for agent activity
CPS 234, Information Security, requires an entity to maintain information-security capability and controls. CPS 230 addresses operational risk, control effectiveness, incidents and service-provider risk. Neither standard prescribes a complete replay of an agent run.
When an agent takes the action, the organisation still needs evidence that supports its operational-risk and information-security oversight. Arkna can review the available records for that purpose. The compliance judgment stays with the organisation, its advisors and its auditors.
