What Are ASIC's AI Requirements for Directors?

What ASIC Report 798 Found

Published 29 October 2024, "Beware the Gap" is ASIC's most detailed examination of AI governance in Australian financial services. The findings:

• 624 AI use cases reviewed across banking, credit, insurance, and advisory
• Nearly 50% of licensees lacked policies for consumer fairness or bias
• Even fewer had policies governing AI disclosure to consumers
• One licensee ran "black box" credit scoring where variables influencing outcomes couldn't be explained
• Technology-neutral regulation applies: no AI exemptions to existing obligations

The message is direct. ASIC doesn't care whether decisions are made by humans or algorithms. The same consumer protection standards apply. If your AI discriminates, the liability is identical to human discrimination, with one critical difference: ASIC can audit AI decision patterns at scale.

The Four Director Obligations

1. Know your AI. Directors must be able to identify what AI systems their organisation uses and which ones make decisions affecting customers or employees. Most boards I speak to can't produce this list.

2. Govern your AI. Board-approved policies covering fairness, transparency, and accountability. Not the 80-page framework that nobody reads. Practical, ASIC-defensible policies that match your operational reality.

3. Oversee your AI. Human accountability for AI system design, operations, and outcomes. Regular review of AI performance against fairness and accuracy benchmarks.

4. Document your AI. If ASIC investigates, your evidence is the paper trail. Board minutes showing governance discussions. Risk assessments. Bias testing reports. Documented human interventions.

What Happens if Directors Don't Comply

Director liability under ASIC's framework follows a clear chain: AI causes consumer harm, ASIC investigates, ASIC finds governance gaps, directors face personal liability under Section 180 for failing to exercise reasonable care.

The cost of a governance framework is director liability insurance. A $5M class action, ASX reputation damage, and personal director liability make that investment look trivial.

But governance doesn't eliminate all risk. It demonstrates you took reasonable steps. The distinction matters in a regulatory investigation. No framework prevents every AI error. The framework proves your board acted responsibly.

Practical Steps for Directors

Start with these five actions:

1. Request a complete inventory of AI systems from your CTO or CIO
2. Ask which systems make decisions affecting customers or employees
3. Verify that fairness and bias policies exist for each system
4. Confirm a named human is accountable for each AI system's outcomes
5. Ensure AI governance appears in board minutes at least quarterly

If you can't complete all five within 30 days, you have a governance gap. That gap is the risk.

Related Questions

• What is AI governance in Australia?
• How does the Privacy Act apply to AI in Australia?
• AI Risk for Boards
• AI Governance Framework