Why APRA's AI Warning Changes the PMO Agenda in Financial Services
What APRA’s warning means for PMOs
PMOs need to know where AI is entering the portfolio, clarify who owns the outcome and strengthen the evidence used to approve and govern AI-enabled change.
This does not make the PMO the owner of AI risk. It makes the PMO responsible for ensuring that delivery, risk, technology, vendors and the business are not operating with different versions of accountability.
At a KPMG roundtable last year, I was surprised by how uneven the approaches to AI governance appeared to be. Some organisations had established clear controls and approved environments. Others seemed to be relying heavily on individual judgement about which tools to use, what information could be shared and how outputs should be checked.
My own experience has generally been in environments where AI has received good oversight. Even there, the controls are only part of the answer. People also need enough education to recognise when information should not be entered into a tool, when an output needs to be challenged and when a polished response is masking weak analysis.
That discussion came back to me when APRA issued its warning to banks, insurers and superannuation trustees in April 2026. APRA found that AI adoption was moving faster than governance, risk management, assurance and operational resilience. It called for a step-change in how regulated entities manage the risks.
It would be easy for PMO leaders to read the letter and conclude that the response belongs mainly with risk, cyber, data and technology. I think that would be a mistake.
APRA’s concerns reach directly into the way change is selected, funded, delivered, assured and moved into operation. They also expose a problem that already exists in many large organisations: accountability becomes fragmented across the business, technology teams, control functions and vendors.
The PMO should not take over the responsibilities of those functions. It should, however, be able to see where AI-enabled change is occurring, whether ownership is clear and whether the evidence being presented is good enough to support a decision.
That is a different agenda from consolidating status reports.
AI is moving into the operation, not just the innovation portfolio
APRA’s review covered 11 entities across banking, insurance and superannuation. It found that AI had moved well beyond early experimentation and was being introduced into areas including software engineering, fraud and scam disruption, claims triage, loan processing and customer interaction. In APRA’s words, some of these uses are now decision-critical, customer-facing and operationally embedded.
That changes the nature of the risk.
An internal tool that helps an employee improve the wording of an email is not the same as a capability that influences a lending decision, prioritises an insurance claim or supports the operation of a payment service. Organisations need to apply judgement and proportionate control rather than treating every use of AI as equally significant.
The difficulty is that AI will not always enter an organisation through a clearly labelled AI program. It may arrive as a feature in an existing platform, a vendor upgrade, a development tool or a locally adopted productivity solution. A project can begin without AI in its original scope and acquire an AI dependency later.
A PMO looking only for projects with “AI” in the title will miss a large part of the exposure.
This is why APRA’s warning changes the portfolio conversation. Before leaders can make sensible decisions about risk, investment or assurance, they need a reliable view of where AI is being introduced and what it is being used to do.
I am not advocating for another register that is completed once, reported to a committee and then allowed to become stale. The inventory needs to be connected to portfolio intake, delivery governance and change control. When a project introduces an AI-enabled feature, changes its use case or becomes more dependent on a vendor capability, the governance approach should evolve with it.
The largest risk sits between the owners
Most financial institutions already have teams responsible for the individual components of AI governance.
Cybersecurity teams consider access, security and threats. Data teams consider privacy, lineage and quality. Risk and compliance teams interpret obligations and risk appetite. Technology teams implement platforms. Business leaders own customer and operational outcomes.
The weakness is often found in the hand-offs.
An AI-enabled change can cross several functions without any single one having an end-to-end view. The business may assume technology has validated the capability. Technology may depend on assurances provided by the vendor. Risk may have reviewed the initial proposal but not a later change in scope. The vendor may expect the customer to provide the controls, data or decisions needed to make the solution work safely.
AI will not fail neatly within one function. It will fail across the joins between them.
PMOs are often close to those joins. They can see dependencies across projects, unresolved decisions, vendor commitments, changes in scope and the gap between an approved business case and what is actually being delivered.
That does not make the PMO the owner of AI risk. The business still owns the outcome. Technology remains responsible for the platform. Control functions retain their specialist accountabilities.
The PMO’s contribution is to stop the responsibility from becoming so distributed that no one can explain who owns the final decision.
“Human in the loop” is a good example. It sounds reassuring, but it is incomplete. Which human is expected to intervene? What are they reviewing? Do they understand the limitations of the output? Can they override it? Are they accountable for the decision, or are they simply confirming that a review occurred?
Unless those questions have clear answers, human oversight risks becoming a phrase in a governance paper rather than an effective control.
Portfolio intake needs to become more demanding
A large part of the current AI conversation is focused on adoption and productivity. Organisations count users, pilots, generated documents and estimated hours saved.
These measures can be useful, but they are not the same as sustainable business value.
A project can save time in one team while adding review effort, risk or operational complexity elsewhere. A vendor capability can appear efficient during a pilot but create a dependency that is difficult to manage at scale. An AI-generated document can be produced quickly and still require an experienced person to reconstruct the underlying analysis.
The PMO should bring more discipline to how AI-enabled change enters the portfolio.
An investment proposal should explain the problem being solved, why AI is an appropriate part of the solution and what result the organisation expects to achieve. It should also identify the information the capability will use, the decisions it will influence, the people expected to review its outputs and the internal and external dependencies needed to operate it.
The benefit case should extend beyond an assumed productivity percentage. Leaders need to know whether the change will improve a customer, risk, operational or financial outcome, how that improvement will be measured and what ongoing cost will be required to maintain it.
This is familiar territory for a good PMO. The principles of a sound business case have not disappeared because AI is involved. What has changed is the need to examine areas that may previously have been treated as technical implementation details.
APRA’s current CPS 230 standard reinforces that operational risk includes change, technology, data, people, processes and external service providers. It requires entities to assess the effect of new technologies on their operational risk profile, maintain effective controls and understand the resources and interdependencies supporting critical operations.
For an AI-enabled project, those obligations should be visible from the investment decision onwards, not added shortly before implementation.
Better reporting will not solve weak governance
PMOs have traditionally placed significant effort into producing governance artefacts. Business cases, status reports, steering papers, risk registers and dependency logs all serve a purpose.
The problem is that completion is often treated as a proxy for quality.
I have seen projects maintain a full set of documents while traceability between requirements, decisions and outcomes remained incomplete. I have seen risks described without meaningful mitigation and dependencies reported without a clear commitment from the party expected to deliver them. I have also seen strong focus placed on delivery cadence and milestone achievement while benefits realisation received much less attention.
AI can make this harder to detect because it improves presentation so quickly.
A weak risk can be rewritten into professional language without becoming a better risk. A business case with unsupported assumptions can be turned into a convincing executive paper. A status report can be made clearer without resolving the underlying inconsistency between what different teams are reporting.
The output looks more mature, but the decision may still be based on poor information.
PMOs need to spend less time asking whether a document has been completed and more time asking whether the underlying evidence supports the position being presented.
For a risk, that means understanding the cause, the possible consequence, the mitigation, the owner and the evidence that the mitigation is progressing. For a dependency, it means confirming that the other party has accepted the commitment and can deliver it when required. For a benefit, it means following the result beyond project closure rather than assuming that implementation created value.
This is also where AI can be genuinely useful to the PMO.
I can see a practical role for a controlled internal GPT or similar capability that has been grounded in the organisation’s RAID framework and delivery standards. It could review draft risks for missing causes, consequences or owners. It could identify mitigations that are too vague, dependencies that lack commitments or inconsistencies between a project report and the underlying data.
It could also review business cases and governance papers for missing assumptions or incomplete sections before they reach an approval forum.
That would improve the quality of the first review and reduce some of the administrative effort placed on delivery teams. It would not prove that the information is correct, and it would not make the decision.
The project leader would still need to validate the assessment. The risk owner would still need to accept the exposure. The steering committee would still need to apply judgement.
The value of AI in governance is not that it removes accountability. It gives accountable people a better opportunity to exercise it.
Vendor governance cannot be treated as a procurement exercise
AI also increases the importance of vendor and service-provider governance.
I have worked on both sides of vendor relationships and have seen the same accountability problem arise repeatedly. The vendor is waiting for a decision, access or data from the customer. The customer believes the vendor has taken responsibility for the outcome. Both continue to report progress, while the unresolved dependency places delivery at risk.
With AI, the questions become more complex. The institution may need to understand how its data is being used, whether the service can change without notice, which subcontractors or cloud providers support it, how the capability is tested and how the institution can exit if the arrangement no longer meets its needs.
CPS 230 requires regulated entities to manage the risks associated with service providers, including the fourth parties on which those providers rely. It also requires clear contractual responsibilities, monitoring of performance and controls, and the ability to continue critical operations or exit an arrangement when necessary.
These responsibilities cannot be addressed only when the contract is signed. They need to be managed through delivery and into operation.
The PMO has a role in making sure that vendor obligations are visible alongside internal dependencies, that agreed evidence is produced and that issues do not remain unresolved because each party assumes the other owns them.
A financial institution can outsource a capability. It cannot outsource responsibility for the effect that capability has on its customers or operations.
What should change in the PMO agenda?
I would start with three changes.
First, PMOs need a better view of AI-enabled change across the portfolio. This should include purpose-built AI programs, AI introduced through vendors and AI capabilities added to existing projects or platforms. The level of governance can be proportionate, but the use should not be invisible.
Second, investment and change approval should place greater emphasis on ownership, operational impact, information use, vendor dependencies, human review and benefits. A productivity claim should not be enough to justify scaling a capability.
Third, PMOs should use AI to improve the quality of delivery evidence. Business cases, risks, dependencies and status reports can all be reviewed more consistently with the right internal tools. The aim should be stronger analysis and earlier challenge, not simply faster document production.
None of these changes requires the PMO to become a new control function. They require it to become better at connecting the existing ones.
The PMO has a choice
APRA has recognised that AI offers real opportunities for financial institutions and that failing to use it may create a strategic disadvantage. Its warning is directed at the gap between that opportunity and the maturity of the governance supporting it.
The wrong response would be to add another layer of reporting and declare the issue addressed.
The better response is to improve visibility across the portfolio, clarify ownership and demand stronger evidence before AI-enabled capabilities are allowed to scale.
PMOs that remain focused mainly on document collection and retrospective status reporting will struggle to add value in that environment. PMOs that can connect investment, delivery, risk, vendors and benefits will become more important.
APRA’s warning is ultimately not about whether financial institutions should use AI. They already are.
It is about whether they can show that the right people remain accountable for what happens next.
About the author Steven Gabris is a delivery, governance and transformation leader with experience across financial services, payments, regulatory change and complex enterprise programs. [Read more about Steven Gabris and his work.]
Reference material
This article draws on APRA’s April 2026 letter to industry on artificial intelligence and Prudential Standard CPS 230: Operational Risk Management.
Comments