CPS 230 applies to your AI.
That is the problem: it applies to your agents anyway. In force since 1 July 2025. Answer eight questions about one process. Get a signed result. We store nothing.
Is the process your AI touches a critical operation — or does it feed one?
Critical operations are processes whose disruption would have a material adverse impact on depositors, policyholders, beneficiaries or the financial system. APRA classifies a minimum list (payments, settlements, claims processing and others) as critical regardless of the entity's own view.
Open any obligation.
A readiness tool that scores everything green is worth nothing to the person signing the board paper.
Your own work Nothing — this is a scoping judgement your risk function makes. It decides whether the rest of CPS 230 applies at all.
CPS 230 ¶35–36 Critical operations are processes whose disruption would have a material adverse impact on depositors, policyholders, beneficiaries or the financial system. APRA classifies a minimum list (payments, settlements, claims processing and others) as critical regardless of the entity's own view.
Your own work Nothing — but this is the question most AI deployments have never been asked. A model API inside claims, credit or fraud is a material service provider on the plain reading of ¶49.
CPS 230 ¶49–50 Material service providers are those the entity relies on to undertake a critical operation, or that expose it to material operational risk. The definition is technology-agnostic — it does not need to name AI for a model provider inside a critical operation to meet it.
Your own work Nothing. The register is a governance artifact your risk function owns, and no observability or evidence tool can create it for you.
CPS 230 ¶49 An APRA-regulated entity must identify and maintain a register of its material service providers and manage the material risks associated with using them. APRA may require the register to be submitted.
Runback evidences Every agent decision is captured as it happens and written to an append-only, hash-chained ledger — including the near misses, where a policy rule blocked a tool call before it executed.
CPS 230 ¶32 Operational risk incidents and near misses must be identified, escalated, recorded and addressed in a timely manner, and taken into account in the assessment of the operational risk profile and control effectiveness.
Runback evidences Replay reconstructs the exact decision — the same inputs, the same model, the same context — so the facts of the incident are recoverable rather than reconstructed from memory. The record is signed and hash-chained, so it can be shown not to have been edited after the fact.
CPS 230 ¶33 An entity must notify APRA as soon as possible, and not later than 72 hours, after becoming aware of an operational risk incident likely to have a material financial impact or a material impact on its ability to maintain critical operations.
In part The tolerance itself is a board-level decision Runback has no view on. What it supplies is enforcement and evidence: policy rules stop a tool call that would breach a limit, and the ledger records every block.
CPS 230 ¶38 For each critical operation the entity must establish tolerance levels: the maximum period of disruption it would tolerate, the maximum extent of data loss it would accept, and the minimum service levels to be maintained during a disruption.
Runback evidences A machine-readable compliance export, generated from the same ledger the incidents were recorded in — so the number in the board paper and the number in the record are the same number, and the paper can cite the evidence it came from.
CPS 230 ¶41, ¶27 The entity must monitor compliance with its tolerance levels and report any failure to meet them, together with a remediation plan, to the Board. It must also maintain information systems able to compile and analyse operational risk data and facilitate reporting to the Board and senior management.
Your own work Nothing directly — this is contract work. Worth knowing: self-hosting Runback inside your own perimeter removes one material arrangement from the chain entirely, which is a simpler answer than negotiating one.
CPS 230 ¶54 For all material arrangements the entity must maintain a formal agreement that sets out the services, service levels, liability, and the entity's and APRA's rights of access to documents, records and information.
This page maps Runback's capabilities to named controls. It is not legal advice and not an assessment of your compliance — whether an obligation applies to you, and whether you meet it, is your assessor's or regulator's determination.
Paragraphs cited from APRA CPS 230, July 2025.
The same static map the app's Regulatory tab checks against your own data. No verdict here: that depends on your data.
Swipe to see all columns →
| Clause | Requirement | Runback capability | Evidence |
|---|---|---|---|
| Operational risk management — incident identification & escalation | Identify, assess, and escalate operational risk incidents with timely internal reporting. CPS 230 is technology-agnostic — it does not name AI specifically — but the same obligation applies wherever an AI agent is part of a material business process. | Alert rules + tamper-evident run record | An entry in the signed, tamper-evident audit log See it in the dashboard → |
| Operational risk management — incident recording | Maintain a complete, tamper-evident record of operational risk incidents sufficient to support APRA notification obligations. | Signed, tamper-evident audit trail | A captured run, step by step See it in the dashboard → |
| Business continuity — critical operations | Maintain the ability to continue critical operations through disruption, with tested continuity arrangements. | Policy engine fail-open/fail-closed configuration | A policy rule evaluated on a real tool call See it in the dashboard → |
| Operational risk management — review & reporting | Regular review of the operational risk profile and reporting to the board or governing body. | Compliance report export (machine-readable) | Aggregated from real run data into a compliance report See it in the dashboard → |
These are the obligation questions' long form. Citations are section-level, not re-verified paragraph by paragraph against the current standard: confirm the paragraph before citing this map in a regulator-facing document.
Two deadlines. One record.
Both need a record of what your AI did.
- 72 hours¶33: to notify APRA of a material operational risk incident, from becoming aware of it.
- 24 hours¶42: for a disruption to a critical operation outside tolerance.
Neither clock waits while you work out what a non-deterministic system did three weeks ago.
The standard is technology-agnostic, so a model API inside a critical operation is a material service provider on the plain reading of ¶49 — no one has to agree that AI is special for the obligation to land. It has applied since 1 July 2025, and the transition for existing arrangements ended 1 July 2026.
That is the whole argument for capturing the decision rather than the log line. Replay reconstructs the exact call — same inputs, same model, same context — and the record is hash-chained and signed, so it can be shown not to have been edited after the incident it describes.
We become one of these too.
Adopt Runback, and we are a provider you have to assess. Our diligence is already written down. Or self-host, and the arrangement never exists.
- Eight questions is a triage, not an assessment. CPS 230 runs to sixty-odd paragraphs and covers people, testing and continuity that no tool touches. This narrows to the obligations an AI agent inside a material process actually engages.
- Scope is your determination. Whether a process is a critical operation is a judgement for your risk function, informed by APRA's minimum classification list — which binds regardless of the internal view.
- Runback is not certified. No SOC 2, no ISO 42001, no third-party penetration test yet. The security page states exactly what is shipped and what is not.
- Evidence is not a control. A record proves what happened. It does not set your tolerance levels, write your register, or negotiate your agreements.