Regulators flag governance gaps as AI agent adoption accelerates
australia's prudential regulator warned financial firms about inadequate ai agent governance and assurance during a late 2025 review. it found risk management maturity varied, citing concerns over unpredictable model behavior and insufficient board scrutiny of vendor reliance. apra called for better inventory management, human oversight in high-risk decisions, and updated controls for agentic workflows including privileged access management.
The Australian Prudential Regulation Authority (APRA) released findings from a late 2025 review of large regulated entities, revealing that while AI adoption is widespread in banking and superannuation, risk management maturity varies significantly. The regulator identified specific gaps in monitoring model behavior, change management, and decommissioning, noting that many institutions rely too heavily on vendor summaries rather than scrutinizing risks like prompt injection and insecure integrations. APRA demanded that boards align AI strategy with risk appetite, implement named-person ownership for AI instances, and apply specific controls to autonomous workflows.
Separately, the FIDO Alliance formed an Agentic Authentication Technical Working Group to address security gaps in delegated software actions, reviewing proposals such as Google's Agent Payments Protocol and Mastercard's Verifiable Intent framework. This follows warnings from cybersecurity bodies, including the Centre for Internet Security, regarding the need to map standard controls to non-human identities and Model Context Protocol environments.