ASIC's regulatory framework for AI in financial services
ASIC has not published a dedicated AI regulatory framework, but its position on AI governance is clear from the combination of its existing regulatory instruments, its published guidance, and its enforcement actions. ASIC's approach is that the obligations of financial services licensees — to act efficiently, honestly, and fairly; to maintain competence to provide the financial services authorised; and to have adequate risk management systems — apply to AI systems used in those services.
This means that a financial services licensee using AI in credit assessment, financial advice, insurance underwriting, or customer service cannot point to the AI as the decision-maker in a way that insulates the licensee from liability. The licensee is responsible for the AI's outputs as if they were the licensee's own decisions. The AI is a tool — a sophisticated tool, but a tool — and the licensee's obligations attach to the decisions made using that tool.
Robo-advice and the best interests duty
ASIC's regulatory guide on digital financial product advice (RG 255) makes clear that AI-generated financial advice must satisfy the same statutory obligations as human advice: the best interests duty, the appropriate advice obligation, and the requirement to warn of significant risks. An AI advice system that recommends a product because it optimises for a metric that does not reflect the customer's best interests is not compliant — the fact that an algorithm made the recommendation does not change the applicable standard.
The specific AI governance implications of this position are significant. The AI advice system must be designed with the best interests duty in mind — not just optimising for an objective function that happens to correlate with customer outcomes in testing, but demonstrably producing advice that reflects each customer's specific circumstances. The documentation of how the AI reaches its advice outputs must be sufficient for ASIC to assess compliance. And the firm must have a process for reviewing advice outputs for compliance, not just for accuracy.
