How does Commonwealth Bank govern AI responsibly?
Commonwealth Bank treats AI as a material risk type under its Risk Management Framework, so the board sets an annual risk appetite for it as it does for other material risks and holds CEO Matt Comyn and the executive team accountable for AI risks and opportunities. Its governance was published on February 4, 2026 in Our Approach to Adopting AI, which the bank called an Australian first: a Model Risk Governance Committee approves models including AI models, and a dedicated AI Risk Committee oversees the AI risk framework and challenges higher-risk use cases. Six principles, drawn from Australia's AI Ethics Principles and the OECD AI Principles, cover environmental and social impact, fairness, transparency, privacy and data protection, reliability and security, and accountability ('human oversight of AI Systems is necessary'). In practice that means guardrails-as-a-service for the Ceba chatbot, purpose-built guardrails that route Companion users raising gambling, financial abuse or hardship to human teams, analyst approval of every rule the fraud agent proposes, and AI Risk Indicators in the Group Risk Appetite Statement. The bank also licenses news content for staff prompts (October 2026) and studies public trust with Melbourne Business School.[1][2][3][4][5][6][7][8]
Data as of Oct 16, 2026 · Commonwealth Bank profile updated Oct 13, 2026 · 14 sources cited on this page · 140 banks profiled on this site · Markdown
Which bodies at Commonwealth Bank oversee AI risk?
As set out in the bank's December 2025 AI report and the 2026 annual report.
| Body | Role in AI | Source date |
|---|---|---|
| Board | Ultimate responsibility for risk governance; sets annual risk appetite for AI as a material risk type; holds the CEO and executive team accountable for AI risks and opportunities; spent 'considerable time' on AI in 2026 | February 2026; October 2026[1][9] |
| AI Risk Committee | Management-level committee that oversees the design and operation of the AI risk framework, gives risk challenge and advice on higher-risk AI use cases and advises on changes to the Group AI Policy | February 2026[1][2] |
| Model Risk Governance Committee | Draws its authority from the executive Financial Risk Committee; oversees the Model Risk Framework and supports approval of models, including AI models | February 2026[1] |
| Business unit risk committees | Financial and non-financial risk committees in each business may review and evaluate AI models deployed in their areas | February 2026[2] |
| Chief AI Officer | Ranil Boteju is accountable for standard guardrails, evaluation and observability across a single enterprise AI platform | September 2026[10] |
| Risk appetite metrics | Group AI Policy and Standard, GenAI guardrails and AI Risk Indicators defined in the Group Risk Appetite Statement | August 2026[6] |
What are Commonwealth Bank's AI principles?
Informed by the bank's Code of Conduct, Australia's AI Ethics Principles and the OECD AI Principles; wording as in the report.
| Principle | What it says |
|---|---|
| Environmental and social | Impacts on environmental and social issues, including human rights, should be considered in the approach to AI[1] |
| Fairness | AI System outputs should not unfairly discriminate[1] |
| Transparency | What an AI System does should be understandable[1] |
| Privacy and data protection | AI Systems should comply with privacy and data protection laws[1] |
| Reliability and security | AI Systems should perform consistently with their specifications and intended purpose, with security proportionate to the risks[1] |
| Accountability | Human oversight of AI Systems is necessary[1] |
How do the principles show up in Commonwealth Bank's AI systems?
Controls the bank has described on named systems, in date order.
| Practice | What it is | Date |
|---|---|---|
| Australia's AI Ethics Principles pilot | Shared how it applied its risk frameworks to the Bill Sense feature in the federal government's 2019 pilot | 2019[1] |
| Responsible AI toolkits | Toolkit with guidance and code notebooks for data preparation, explainability and fairness assessment; a later Gen AI toolkit evaluates quality, robustness and fairness | 2023-2024[1] |
| Ceba guardrails-as-a-service | Internal guardrail service checks retrieval-augmented answers from the Ceba chatbot are appropriate rather than hallucinated | February 2026[2] |
| Human approval of fraud rules | The fraud agent proposes detection rules; analysts review them before implementation | April 24, 2026[5] |
| Companion sensitive-topic guardrails | Detects questions about problem gambling, financial abuse or hardship and offers breakout to specialist human teams; sub-agents are tested centrally before launch; no financial advice | August 11, 2026[4] |
| Copyright licence for prompts | Copyright Agency licence lets staff use eligible Australian news text in workplace GenAI prompts; no training of models permitted | October 2, 2026[7] |
| Public trust research | AI Attitudes Barometer: 45% agree banks using AI give better customer outcomes; 69% more likely to use a bank whose staff are trained in responsible AI | February 4, 2026[8] |
What do regulators expect, and what does Commonwealth Bank not publish?
APRA's April 30, 2026 letter to industry found AI governance and assurance lagging adoption at the large banks, insurers and super funds it reviewed in late 2025 and set expectations for boards and risk, technology and security executives; it does not name the entities, so CBA's inclusion is not confirmed. Comyn told the October 2026 AGM that realising the AI opportunity 'will require regulation to keep pace'.[11][12]
The bank publishes its structure and principles but not their outputs: no count of AI systems reviewed by the AI Risk Committee, no fairness or bias test results, and no figure for how often the Companion guardrails route customers to human teams. Its 2025 AI report notes the environmental impacts of AI are 'being considered at a Group level', without a published measure.[1][4]
What does the Commonwealth Bank profile record on this topic?
The rows below are the entries of the CommBank AI strategy profile that bear on this page, as of Oct 13, 2026; the profile holds the full record of 36 dated moves, 20 use cases and 54 sources.
| Use case | What the record shows | Status | Source |
|---|---|---|---|
| Group AI Policy, Standard and AI Risk Committee | A Group AI Policy and Standard, six responsible AI principles, GenAI guardrails, AI Risk Indicators in the Group Risk Appetite Statement and an AI Risk Committee. | In production | [6][3] |
| AI copyright licence for workplace prompts | A Copyright Agency Business Licence lets staff include eligible Australian news content in GenAI prompts, with fees flowing to creators and no permission to train models. | In production | [7] |
| Generative AI dispute management | A generative AI model, launched in 2024, holds a tailored conversation to collect the information needed to speed up non-fraud dispute resolution; the contact-centre orchestration layer routes regulated journeys such as fraud disputes down deterministic paths with guardrails. | In production | [6][13] |
| Central AI platform, guardrails and token-cost control | The Chief AI Officer is accountable for a single enterprise platform for engineers and data scientists, standard guardrails, evaluation and observability, and tracking of token usage and forecast costs, including use of small language models and open-source models; customer-facing capabilities are tested with staff, then small customer groups. | Rolling out | [10] |
| Date | Move | Detail | Source |
|---|---|---|---|
| Oct 14, 2026 | AGM: Comyn calls for AI regulation to keep pace | Comyn tells the AGM that effective regulation should build trust in AI and keep more of its economic value in Australia, and reports 5.9 million intelligent first-time-payment warnings since September 2024; the Chair says the Board spent considerable time on AI risks and opportunities. | [12][9] |
| Oct 2, 2026 | AI copyright licence signed | CommBank becomes the first major Australian bank to sign a Copyright Agency Business Licence covering use of eligible Australian news content in workplace GenAI prompts; the licence does not permit training or improving AI models. | [7] |
| Sep 18, 2026 | Chief AI Officer sets out remit and costs | In an interview Ranil Boteju says the role covers a single enterprise AI platform, standard guardrails, evaluation and observability, token-cost tracking and an AI science lab, and repeats about A$200 million of measured FY26 gross benefit. | [10] |
| Apr 30, 2026 | APRA letter to industry on AI | APRA tells all regulated entities that its late-2025 engagement with selected large banks, insurers and superannuation trustees found governance and assurance lagging AI adoption, and sets expectations for boards and for risk, technology and security executives; the letter does not name the entities reviewed, so CBA's inclusion is not confirmed. | [11] |
| Feb 4, 2026 | Australian-first AI adoption report | CBA publishes Our Approach to Adopting AI: six responsible AI principles, over 27,600 employees engaged with its AI learning series, scam-detection AI over more than 20 million daily payments, and Compass AI having answered more than 500,000 questions since July 2024. | [3][14] |
Does Commonwealth Bank have AI principles?
Yes, six: environmental and social impact, fairness, transparency, privacy and data protection, reliability and security, and accountability, which says human oversight of AI systems is necessary. They were informed by the bank's Code of Conduct, Australia's AI Ethics Principles and the OECD AI Principles, and were published in the bank's Our Approach to Adopting AI report released on February 4, 2026.
Does Commonwealth Bank have an AI risk committee?
Yes. A management-level AI Risk Committee oversees the design and operation of the AI risk framework and gives risk challenge and advice on higher-risk AI use cases, alongside a Model Risk Governance Committee that supports approval of models including AI models. AI is classed as a material risk type, so the board sets an annual risk appetite for it, and AI Risk Indicators sit in the Group Risk Appetite Statement.
How does Commonwealth Bank stop its chatbots giving bad answers?
For the Ceba chatbot it uses an internal guardrails-as-a-service layer that checks answers drawn from the bank's website by retrieval-augmented generation are appropriate rather than hallucinated. For Companion it built guardrails that detect sensitive topics such as problem gambling, financial abuse or hardship and offer a route to specialist human teams, and it does not let Companion give financial advice.
Which regulator oversees Commonwealth Bank's use of AI?
APRA supervises CBA as an authorised deposit-taking institution and ASIC supervises conduct. APRA's April 2026 letter to industry on AI set expectations for boards to build AI literacy and oversee AI strategy within risk appetite and flagged prompt injection and agent misuse as cyber risks; it did not name the banks it reviewed. The bank says it participates in government inquiries on safe and responsible AI.
- Our approach to adopting AI (report, December 2025)
- CBA sets up dedicated AI risk committee for governance
- CommBank releases Australian-first report outlining how it is adopting AI
- CBA's AI Companion is expected to face some hard questions
- CommBank develops AI agent that spots new fraud and helps build defences
- 2026 Annual Report
- Copyright fees to flow back to Australian creators under new CommBank AI agreement
- CommBank launches research partnership with Melbourne Business School to explore attitudes towards AI in banking
- 2026 Commonwealth Bank AGM: Chair's address
- Interview: CBA AI chief on scaling A$400m in AI value with humans in loop
- APRA Letter to Industry on Artificial Intelligence (AI)
- 2026 Commonwealth Bank AGM: CEO's address
- How Commonwealth Bank and Microsoft are reimagining the future of customer service
- CommBank bids to ease customer fears over AI adoption
When Commonwealth Bank moves on AI, you'll read it here first.
when one of the banks we cover moves on AI, it is in the next morning's brief · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning