Last updated: September 5, 2026

ASIC’s 2026–27 Corporate Plan: What Banks Must Prove About AI-Enabled Customer Services

ASIC’s 2026–27 corporate plan puts artificial intelligence oversight at the center of how Australia’s financial regulator will supervise banks this year, alongside longstanding priorities like scams and debt collection. Published on August 26, 2026, the plan signals that banks deploying AI in call centers, loan decisions, and other customer-facing services can no longer treat model performance in development as sufficient evidence of good conduct — ASIC wants proof that harm is being monitored after deployment, not just predicted before it. This article explains what the plan actually requires, how it fits ASIC’s broader enforcement posture, and what bank compliance and AI governance teams should do this financial year.

Key Takeaways

What does ASIC’s 2026–27 plan say about AI?

ASIC will scrutinize how banks use AI in customer-facing services, assess impacts on consumers and investors, and target AI-enabled deepfakes and misinformation that could distort market integrity.

What is ASIC’s stated strategy behind the plan?

Chair Sarah Court described the approach as making compliance “easier to deal with” for businesses following the law and “harder to avoid” for those causing harm — pairing simplified processes with tighter scrutiny.

What enforcement record sits behind the new plan?

ASIC reports a record $830 million in civil penalties and $644 million returned to Australians in 2025–26, the enforcement backdrop against which the 2026–27 priorities were set.

What Is ASIC’s Corporate Plan and Why Does the 2026–27 Edition Matter?

ASIC’s corporate plan is the regulator’s annual statement of supervisory and enforcement priorities, published under the “26-200MR” media release on August 26, 2026, ahead of the financial year it covers.

What sets the 2026–27 edition apart is how explicitly it names artificial intelligence as a standalone area of focus rather than folding AI risk into general technology or conduct supervision. The plan directs ASIC to examine bank usage of AI in customer-facing services, assess how AI affects consumers and investors, and address AI-enabled manipulation, deepfakes, and misinformation that could undermine market integrity — three distinct AI risk categories under one regulator’s remit. Kurums has separately covered how AI governance has become the biggest blind spot on corporate boards in 2026, and ASIC’s plan is a concrete example of a regulator moving to close exactly that gap from the outside.

What Does ASIC’s AI Priority Actually Require From Banks?

Banks must be able to show that AI-enabled customer services do not produce misleading information, obscure accountability, or disadvantage particular groups of customers — and that harm is monitored after deployment, not only assessed during model development.

This is a meaningful shift in evidentiary standard. A model that tested well in a lab or pilot environment is no longer, by itself, a defensible answer to a supervisory question about AI-driven customer harm. Chair Sarah Court put the underlying principle directly: “AI can improve services, productivity and decision making, but its use must not weaken accountability.” For a bank, that means a named accountable individual or committee for each customer-facing AI system, a live monitoring process capable of catching emerging harm patterns after launch, and documentation that can answer why a given AI-driven outcome occurred for an individual customer — not just how the model performs in aggregate.

How Does This Fit Into ASIC’s “Easier to Deal With, Harder to Avoid” Strategy?

ASIC has framed its entire 2026–27 posture around a single line from Chair Sarah Court: strong regulation and economic growth are not opposing objectives, delivered through simpler processes for compliant firms and tighter scrutiny for the rest.

In practice, this means ASIC is simultaneously simplifying guidance and regulatory instruments, speeding up licensing, and improving digital service delivery for firms with clean compliance records — while increasing scrutiny in areas including scams, debt collection, buy now pay later regulation, superannuation advice fee deductions, and insurance-claims intermediaries operating in disaster-affected regions. AI oversight of banks sits inside the “harder to avoid” half of that framing, alongside market integrity and private-market supervision, rather than inside the deregulatory half.

What Enforcement Track Record Is Behind This Plan?

ASIC enters the 2026–27 financial year having secured a record $830 million in civil penalties and returned $644 million to Australians during 2025–26, the strongest enforcement result the regulator cites in its own plan.

That track record matters for how seriously banks should weigh the AI priority: ASIC is not naming AI oversight as an aspirational goal inside a plan with no enforcement follow-through — it is naming it as a priority immediately after a financial year with its largest civil-penalty total on record. Firms that assume a new “priority area” is mostly a messaging exercise are reading the wrong signal from an agency whose enforcement activity, by its own figures, materially increased the year before.

What Other Priorities Does the 2026–27 Plan Cover?

Beyond AI, the plan sets out a wider consumer-protection and market-integrity agenda that touches several financial-services sectors at once.

The following list covers the other named priorities in ASIC’s 2026–27 corporate plan:

• Scams and debt collection enforcement
• Insurance claims handling by intermediaries in disaster-affected regions
• Buy now pay later regulation
• Superannuation advice fee deductions
• Managed investment scheme supervision
• Public and private market integrity, including AI-enabled manipulation and deepfakes
• Digital finance and responsible innovation support

The presence of buy now pay later regulation and superannuation advice fees on the same list as AI oversight is a signal in itself: ASIC is treating AI-driven customer harm as a consumer-protection issue of the same order as fee mischarging and predatory lending patterns, not as a specialized technology concern separate from its core mandate.

What Should Bank Compliance and AI Governance Teams Do Now?

Banks operating in or reporting into the Australian market should treat this financial year as the point at which AI governance moves from an internal best practice to a supervisory expectation with enforcement backing.

The following checklist covers the priority steps for compliance and AI governance teams responding to the 2026–27 plan:

• Inventory every customer-facing AI system and assign a named accountable owner for each one
• Build or upgrade post-deployment monitoring so emerging harm is caught in production, not only in pre-launch testing
• Prepare individual-outcome documentation — the ability to explain why an AI system produced a specific result for a specific customer
• Review market-surveillance controls for AI-enabled manipulation, deepfakes, and misinformation, not only for traditional trading misconduct
• Brief the board on ASIC’s AI priority as a distinct governance risk item, alongside existing scams and BNPL exposure
• Avoid relying on vendor model-validation reports as standalone proof of compliance

How Does This Compare to Other Regulators’ AI Oversight Moves in 2026?

ASIC’s plan is part of a broader pattern of financial and market regulators tightening AI and conduct oversight within the same year, rather than an isolated Australian development.

In the UK, the FCA’s COCON 1.1.7FR rule extended Conduct Rules on bullying and harassment to roughly 37,000 non-bank firms from September 1, 2026 — a move Kurums covered in what COCON 1.1.7FR means for bullying and harassment cases outside banking — and while that rule targets workplace conduct rather than AI directly, both regulators are converging on the same underlying theme: individual accountability cannot be diluted by scale, whether the scale comes from a large organization or an automated system. Boards weighing how much AI-governance responsibility belongs at their level, rather than inside compliance teams alone, may also find it useful to review Kurums’ guide on the Accredited Asset Management Specialist credential, which reflects the kind of documented, individually accountable expertise regulators increasingly expect around complex financial products — AI-driven or otherwise.

Frequently Asked Questions

When was ASIC’s Corporate Plan 2026–27 published?

ASIC published the Corporate Plan 2026–27 on August 26, 2026, under media release 26-200MR.

What does ASIC’s AI priority focus on?

ASIC will examine how banks use AI in customer-facing services, assess AI’s impact on consumers and investors, and target AI-enabled manipulation, deepfakes, and misinformation affecting market integrity.

Is model-validation testing enough to satisfy ASIC’s AI expectations?

No. ASIC’s stated focus is on monitoring that identifies emerging harm after deployment, not solely on a model’s performance during pre-launch development or testing.

What enforcement results does ASIC cite alongside the 2026–27 plan?

ASIC reports a record $830 million in civil penalties and $644 million returned to Australians during the 2025–26 financial year.

What other areas does ASIC’s 2026–27 plan prioritize besides AI?

The plan also prioritizes scams and debt collection, buy now pay later regulation, superannuation advice fee deductions, insurance claims handling in disaster-affected regions, and managed investment scheme supervision.

Written by the Kurums Finance & Regulatory Editorial Team, based on ASIC’s published Corporate Plan 2026–27 and its accompanying media release. This article is educational and not a substitute for advice from a qualified compliance or financial-regulatory professional.