AI in Australia

In another article in the AI and financial regulation series, we briefly report on events in Australia.

On 26 March 2024, the Australian Senate resolved that the Select Committee on Adopting Artificial Intelligence (AI), be established to inquire into and report on the opportunities and impacts for Australia arising out of the uptake of AI technologies in Australia. The Committee called for written submissions by 10 May 2024 and intends to report to the Australian Parliament on or before 19 September 2024.

A couple of days ago, on 21 May 2024, senior members from the Australian Securities and Investments Commission (ASIC) gave evidence to the Select Committee. Against the backdrop to this evidence is ASIC's stated vision to become a leading digitally enabled and data informed regulator by 2030. To support this vision ASIC has commenced a digital transformation program. Like many other, if not all, financial services regulators the current laws that ASIC administers are technology neutral. This means that they apply equally to outcomes delivered by AI and non-AI systems and processes.

When giving evidence ASIC's chair, Joe Longo, stated that as at late 2023 the regulator was reviewing over 20 entities based on their use of AI and advanced data analytics. Whilst the findings of the review are not due until the second half of 2024, he provided the Committee with some initial observations. Perhaps first and foremost was the observation that AI has shot to the top of Australian board priorities, just in the last six to 12 months. Secondly, not everyone is using the same definition of AI technologies. And thirdly, 'governance,' covering issues around data have become a 'top-of-house' issue.

ASIC's Executive Director of Markets, Calissa Aldridge, described the take-up of AI by the bigger players operating in Australia's financial services industry as "cautious but exploratory" with a lot of focus on internal capability, productivity enhancements and middle- and back-office functions. In terms of client interaction, ASIC has seen firms using chatbots and other types of AI but there is a lot of caution around automating decisions in other parts of client-facing businesses.

A particularly important issue that came up during the evidence was around directors' duties and the deployment of AI. Mr. Longo explained that ASIC expects directors to be informing themselves about this topic:

• Do they know where the data is?
• Is it in the hands of a third-party provider?
• If it is in the cloud, which cloud?
• What are the arrangements for protecting that data?
• A cyberattack is almost inevitable, so what is the response plan?
• What steps have you taken?
• And if steps have been taken, what makes you have confidence in them?

One of the things ASIC has been talking about publicly is the need for more people who are data literate to be on boards.

And finally, when giving evidence ASIC were asked about the need for an enhanced regulatory framework. Mr. Longo noted that there were already a number of models that Australia could choose from including Europe's AI Act. However, for Mr. Longo, a more fundamental question needs to be answered first. He said, "we need to make a deliberate decision as a country whether we're happy to leave it alone or whether we think we need more regulation, and, if so, what that looks like. For the purposes of this morning, my argument is we need more regulation—we just don't know what it looks like yet—so that it works for us culturally, for our way of life and for what we're capable of dealing with."