ASIC outlined plans on 30 September 2026 to examine Australian banks’ new and proposed uses of artificial intelligence, including customer interactions, decision-making and lending. Its supervisory letter says the review is expected to begin in the second quarter of the 2026–27 financial year, covering October to December 2026. For customers, the central issue is how banks remain accountable when software contributes to services and decisions.
The review is a planned supervisory exercise, rather than a published finding that particular banks have breached the law. ASIC says it will work with the Australian Prudential Regulation Authority to avoid unnecessary duplication. Its stated scope reaches beyond customer-facing chatbots to uses that may influence how a bank assesses information and delivers financial services.
That breadth matters because different AI uses create different consequences. A tool helping an employee draft a routine response requires different checks from one contributing to a lending decision. The useful questions concern the task being performed, the information used, how errors are detected and who can change an outcome. The presence of AI alone does not answer those questions.
ASIC has previously identified a gap between adoption and governance. Its 2024 report examined 624 AI use cases across 23 financial services and credit licensees, based on information current to December 2023. The regulator warned that governance arrangements were not keeping pace with adoption. That earlier sample provides background to the new review, not a current measurement of every Australian bank’s systems.
Privacy obligations also apply when organisations introduce commercially available AI. The Office of the Australian Information Commissioner’s AI guidance covers matters including due diligence, personal information, accuracy and human oversight. It encourages organisations to consider how inputs and outputs are handled rather than assuming that buying a tool resolves their responsibilities.
For a banking customer, this makes the handling of information a practical concern. An answer that sounds confident can still be wrong, while an automated process may be difficult to question if the bank cannot explain what information it used. Clear records and an identifiable team responsible for resolving problems can help customers raise a concrete issue. These are questions to ask about a service, not findings that ASIC has already made about a particular bank.
Existing complaint routes remain relevant while the review is being prepared. ASIC’s Moneysmart guide advises customers to contact the financial business first, then make a formal written complaint if the problem remains unresolved. Keeping the relevant messages, dates and the outcome sought gives the business a clearer basis for investigating what happened.
Unresolved matters may be eligible for the Australian Financial Complaints Authority. AFCA considers banking, payments and credit complaints within its rules, limits and exclusions; its remit is not unlimited. Customers do not need to wait for ASIC’s AI review to finish before using an applicable complaint process. The forthcoming review will add scrutiny of how banks manage these technologies, while responsibility for the service continues to sit with the financial business.
A different Australian example is NSW Health using AI to prepare staff-access recommendations, with specialists reviewing the results. That case illustrates why the specific task and the person responsible for checking it matter when assessing an AI deployment.
