At a glance
| Jurisdiction tier | Tier B - Specified; enforcement stated, not yet live. AI is specified as for Tier A, and a mechanism to check or sanction it has been stated but is not yet shown to be live. |
| Case examined | QBE Insurance Group - generative-AI assistants for underwriters |
| Band for this case | Watching |
| Rules reach | Insurers: directly · Reinsurers: not stated · Intermediaries: not stated |
| Last verified | [actual date of the launch-window check] |
The Australian Prudential Regulation Authority (APRA) wrote to all APRA-regulated entities about AI on 30 April 2026. The letter sets expectations for AI supplier risk and says APRA will apply its supervisory focus; it also says APRA is finalising its forward plan.
Prudential Standard CPS 230, which sets requirements for material service providers, is binding and in force. It does not name AI.
Who these rules reach
- Insurers: directly. APRA's letter is addressed "To: All APRA-regulated entities". The entry treats QBE's Australian insurer as one of them.
- Reinsurers: not stated. The letter does not list the kinds of entity it covers.
- Intermediaries: not stated.
This band describes how clearly the rules meet the AI use that QBE Insurance Group has itself published. It is not a finding that QBE Insurance Group has breached any rule.
Why QBE Insurance Group: QBE's 2025 Impact Report and its July 2025 newsroom article describe generative-AI underwriting assistants deployed across its divisions.
The question
In briefQBE's 2025 Impact Report says generative-AI solutions have been deployed "to assist underwriters in other lines of insurance throughout QBE's divisions", with underwriters retaining "the final decision-making authority"; its centrally built Cyber Underwriting AI Assistant "has now been rolled out across Europe and Asia" (July 2025). APRA's letter on AI of 30 April 2026 sets expectations for AI supplier risk, and CPS 230's material-service-provider requirements are now fully in force. Where those underwriting assistants run in QBE's Australia Pacific division, does the APRA-regulated entity assess and own their supplier and concentration risk itself, or does it rely on a Group assessment made elsewhere?
Why this band: Both points are less firm: APRA's AI letter is not binding and CPS 230 does not name AI, and the entry cannot say which QBE entity uses the assistants in Australia.QBE has spread generative-AI underwriting assistants across its divisions from the centre, and APRA now expects the regulated entity to own its AI supplier risk - the public record neither confirms the tools are in use in Australia nor shows whose assessment governs them there.
3. The same question for other firms in Australia
Any APRA-regulated insurer in Australia that uses underwriting tools built or assessed by its wider group faces the same point: whether the Australian entity assesses and owns the supplier and concentration risk of those tools itself, or relies on a group assessment made elsewhere. This entry gives no band to any firm other than QBE Insurance Group.
4. What this entry does not establish
- Whether QBE's underwriting assistants are in use in its Australia Pacific division. The question states this as a condition; this entry says nothing either way.
- CPS 230 first commenced on 1 July 2025; APRA remade it by a determination of 23 April 2026, in force from 1 July 2026. The remade text was not compared with the original.
- The Impact Report prints a year (2025) but no fuller date.
- No date set: APRA's AI forward plan, which it said it was finalising at 30 April 2026.
Sources
- QBE, newsroom article on its global cyber proposition, 28 July 2025 (printed). Company's own. qbe.com
- QBE, 2025 Impact Report, 2025 (year printed; no fuller date). Company's own. qbe.com PDF
- APRA, letter to industry on artificial intelligence, 30 April 2026 (printed). Regulator. apra.gov.au
- APRA, Prudential Standard CPS 230 Operational Risk Management, determination of 23 April 2026 (F2026L00475), in force from 1 July 2026; it replaced the version that commenced on 1 July 2025. Regulator (binding standard). apra.gov.au
None share a law or regulator with this entry.
________________________________________
Commercial relationship with any party named here: None · Right of reply: indexreport.protocol@fijishi.com; with the sender's agreement, replies are published in full below the entry, dated · Cite as: Fijishi Jurisdiction Index 2026, Entry AU · Corrections: none.