What It Is

Regulation (EU) 2024/1689, the EU AI Act, is a comprehensive horizontal regulation establishing a risk-based framework for AI systems. It prohibits unacceptable-risk practices, regulates high-risk systems via lifecycle controls, mandates transparency for limited-risk AI, and leaves minimal-risk unregulated. Scope covers providers, deployers, and third-country entities using outputs in the EU.

Key Components

• **Four risk tiersprohibited, high-risk (Annex I/III), limited-risk, minimal-risk.
• High-risk obligations: risk management (Article 9), data governance (Article 10), documentation (Articles 11-13), human oversight (Article 14), cybersecurity (Article 15).
• GPAI rules (Chapter V), conformity assessments, CE marking, EU database registration.
• Hybrid enforcement: AI Office, national authorities, fines up to 7% global turnover.

Why Organizations Use It

Mandatory compliance ensures EU market access, mitigates fines and bans. Enhances trust, reduces risks in high-stakes sectors like employment and biometrics. Builds competitive edge via certified safety and transparency.

Implementation Overview

Phased rollout (6-36 months). Inventory AI assets, classify risks, build QMS, conduct assessments. Applies to all sizes targeting EU; requires audits, post-market monitoring. Cross-functional: legal, engineering, governance.

What It Is

APRA Prudential Standard CPS 234 (Information Security) is a binding regulation issued by the Australian Prudential Regulation Authority. Effective from 1 July 2019, it mandates APRA-regulated entities like banks, insurers, and super funds to maintain information security capabilities commensurate with threats to protect confidentiality, integrity, and availability of information assets, including those managed by third parties. It adopts a risk-based, assurance-driven approach focused on governance, controls, and resilience.

Key Components

• 11 core requirements spanning governance, asset classification, controls, testing, incident response, and APRA notifications.
• Pillars include Board accountability, systematic testing, internal audit assurance, and 72-hour incident reporting.
• Built on CIA triad principles with commensurability to risks; no fixed controls but evidence-based compliance.

Why Organizations Use It

• Mandatory for APRA-regulated entities to avoid penalties, enforcement, and reputational damage.
• Enhances cyber resilience, stakeholder trust, and operational continuity.
• Provides competitive edge through robust third-party oversight and incident readiness.

Implementation Overview

• Phased approach: gap analysis, policy frameworks, asset inventories, testing programs.
• Applies to all sizes in Australian financial sector; requires independent audits, no formal certification. (178 words)