# Commonwealth Bank of Australia: Responsible AI

Source: https://www.bankingnewsai.com/banks/commonwealth-bank/responsible-ai
Last updated: Oct 16, 2026

*Part of the [Commonwealth Bank of Australia AI strategy profile](https://www.bankingnewsai.com/banks/commonwealth-bank).*

## How does Commonwealth Bank govern AI responsibly?

Commonwealth Bank treats AI as a material risk type under its Risk Management Framework, so the board sets an annual risk appetite for it as it does for other material risks and holds CEO Matt Comyn and the executive team accountable for AI risks and opportunities. Its governance was published on February 4, 2026 in Our Approach to Adopting AI, which the bank called an Australian first: a Model Risk Governance Committee approves models including AI models, and a dedicated AI Risk Committee oversees the AI risk framework and challenges higher-risk use cases. Six principles, drawn from Australia's AI Ethics Principles and the OECD AI Principles, cover environmental and social impact, fairness, transparency, privacy and data protection, reliability and security, and accountability ('human oversight of AI Systems is necessary'). In practice that means guardrails-as-a-service for the Ceba chatbot, purpose-built guardrails that route Companion users raising gambling, financial abuse or hardship to human teams, analyst approval of every rule the fraud agent proposes, and AI Risk Indicators in the Group Risk Appetite Statement. The bank also licenses news content for staff prompts (October 2026) and studies public trust with Melbourne Business School. ([Commonwealth Bank of Australia](https://www.commbank.com.au/content/dam/commbank-assets/about-us/docs/our-approach-to-adopting-ai-december-2025.pdf), [iTnews](https://www.itnews.com.au/news/cba-sets-up-dedicated-ai-risk-committee-for-governance-623408), [Commonwealth Bank of Australia](https://commbank.com.au/articles/newsroom/2026/02/cba-approach-to-adopting-ai-report-announcement.html), [iTnews](https://www.itnews.com.au/news/cbas-ai-companion-is-expected-to-face-some-hard-questions-628051), [Commonwealth Bank of Australia](https://commbank.com.au/articles/newsroom/2026/04/ai-agent-spots-fraud-in-real-time.html), [Commonwealth Bank of Australia](https://commbank.com.au/content/dam/commbank-assets/investors/2026/CBA-2026-Annual-Report-print.pdf), [Commonwealth Bank of Australia](https://commbank.com.au/articles/newsroom/2026/10/commbank-ai-copyright-fees-creators.html), [Commonwealth Bank of Australia](https://www.commbank.com.au/articles/newsroom/2026/02/melbourne-business-school-partnership.html))

## Which bodies at Commonwealth Bank oversee AI risk?

As set out in the bank's December 2025 AI report and the 2026 annual report.

| Body | Role in AI | Source date | Sources |
| --- | --- | --- | --- |
| Board | Ultimate responsibility for risk governance; sets annual risk appetite for AI as a material risk type; holds the CEO and executive team accountable for AI risks and opportunities; spent 'considerable time' on AI in 2026 | February 2026; October 2026 | [Commonwealth Bank of Australia](https://www.commbank.com.au/content/dam/commbank-assets/about-us/docs/our-approach-to-adopting-ai-december-2025.pdf), [Commonwealth Bank of Australia](https://commbank.com.au/articles/newsroom/2026/10/agm-chair-address.html) |
| AI Risk Committee | Management-level committee that oversees the design and operation of the AI risk framework, gives risk challenge and advice on higher-risk AI use cases and advises on changes to the Group AI Policy | February 2026 | [Commonwealth Bank of Australia](https://www.commbank.com.au/content/dam/commbank-assets/about-us/docs/our-approach-to-adopting-ai-december-2025.pdf), [iTnews](https://www.itnews.com.au/news/cba-sets-up-dedicated-ai-risk-committee-for-governance-623408) |
| Model Risk Governance Committee | Draws its authority from the executive Financial Risk Committee; oversees the Model Risk Framework and supports approval of models, including AI models | February 2026 | [Commonwealth Bank of Australia](https://www.commbank.com.au/content/dam/commbank-assets/about-us/docs/our-approach-to-adopting-ai-december-2025.pdf) |
| Business unit risk committees | Financial and non-financial risk committees in each business may review and evaluate AI models deployed in their areas | February 2026 | [iTnews](https://www.itnews.com.au/news/cba-sets-up-dedicated-ai-risk-committee-for-governance-623408) |
| Chief AI Officer | Ranil Boteju is accountable for standard guardrails, evaluation and observability across a single enterprise AI platform | September 2026 | [Retail Banker International (via Yahoo Finance)](https://finance.yahoo.com/technology/ai/articles/interview-cba-ai-chief-scaling-091319695.html) |
| Risk appetite metrics | Group AI Policy and Standard, GenAI guardrails and AI Risk Indicators defined in the Group Risk Appetite Statement | August 2026 | [Commonwealth Bank of Australia](https://commbank.com.au/content/dam/commbank-assets/investors/2026/CBA-2026-Annual-Report-print.pdf) |

## What are Commonwealth Bank's AI principles?

Informed by the bank's Code of Conduct, Australia's AI Ethics Principles and the OECD AI Principles; wording as in the report.

| Principle | What it says | Sources |
| --- | --- | --- |
| Environmental and social | Impacts on environmental and social issues, including human rights, should be considered in the approach to AI | [Commonwealth Bank of Australia](https://www.commbank.com.au/content/dam/commbank-assets/about-us/docs/our-approach-to-adopting-ai-december-2025.pdf) |
| Fairness | AI System outputs should not unfairly discriminate | [Commonwealth Bank of Australia](https://www.commbank.com.au/content/dam/commbank-assets/about-us/docs/our-approach-to-adopting-ai-december-2025.pdf) |
| Transparency | What an AI System does should be understandable | [Commonwealth Bank of Australia](https://www.commbank.com.au/content/dam/commbank-assets/about-us/docs/our-approach-to-adopting-ai-december-2025.pdf) |
| Privacy and data protection | AI Systems should comply with privacy and data protection laws | [Commonwealth Bank of Australia](https://www.commbank.com.au/content/dam/commbank-assets/about-us/docs/our-approach-to-adopting-ai-december-2025.pdf) |
| Reliability and security | AI Systems should perform consistently with their specifications and intended purpose, with security proportionate to the risks | [Commonwealth Bank of Australia](https://www.commbank.com.au/content/dam/commbank-assets/about-us/docs/our-approach-to-adopting-ai-december-2025.pdf) |
| Accountability | Human oversight of AI Systems is necessary | [Commonwealth Bank of Australia](https://www.commbank.com.au/content/dam/commbank-assets/about-us/docs/our-approach-to-adopting-ai-december-2025.pdf) |

## How do the principles show up in Commonwealth Bank's AI systems?

Controls the bank has described on named systems, in date order.

| Practice | What it is | Date | Sources |
| --- | --- | --- | --- |
| Australia's AI Ethics Principles pilot | Shared how it applied its risk frameworks to the Bill Sense feature in the federal government's 2019 pilot | 2019 | [Commonwealth Bank of Australia](https://www.commbank.com.au/content/dam/commbank-assets/about-us/docs/our-approach-to-adopting-ai-december-2025.pdf) |
| Responsible AI toolkits | Toolkit with guidance and code notebooks for data preparation, explainability and fairness assessment; a later Gen AI toolkit evaluates quality, robustness and fairness | 2023-2024 | [Commonwealth Bank of Australia](https://www.commbank.com.au/content/dam/commbank-assets/about-us/docs/our-approach-to-adopting-ai-december-2025.pdf) |
| Ceba guardrails-as-a-service | Internal guardrail service checks retrieval-augmented answers from the Ceba chatbot are appropriate rather than hallucinated | February 2026 | [iTnews](https://www.itnews.com.au/news/cba-sets-up-dedicated-ai-risk-committee-for-governance-623408) |
| Human approval of fraud rules | The fraud agent proposes detection rules; analysts review them before implementation | April 24, 2026 | [Commonwealth Bank of Australia](https://commbank.com.au/articles/newsroom/2026/04/ai-agent-spots-fraud-in-real-time.html) |
| Companion sensitive-topic guardrails | Detects questions about problem gambling, financial abuse or hardship and offers breakout to specialist human teams; sub-agents are tested centrally before launch; no financial advice | August 11, 2026 | [iTnews](https://www.itnews.com.au/news/cbas-ai-companion-is-expected-to-face-some-hard-questions-628051) |
| Copyright licence for prompts | Copyright Agency licence lets staff use eligible Australian news text in workplace GenAI prompts; no training of models permitted | October 2, 2026 | [Commonwealth Bank of Australia](https://commbank.com.au/articles/newsroom/2026/10/commbank-ai-copyright-fees-creators.html) |
| Public trust research | AI Attitudes Barometer: 45% agree banks using AI give better customer outcomes; 69% more likely to use a bank whose staff are trained in responsible AI | February 4, 2026 | [Commonwealth Bank of Australia](https://www.commbank.com.au/articles/newsroom/2026/02/melbourne-business-school-partnership.html) |

## What do regulators expect, and what does Commonwealth Bank not publish?

APRA's April 30, 2026 letter to industry found AI governance and assurance lagging adoption at the large banks, insurers and super funds it reviewed in late 2025 and set expectations for boards and risk, technology and security executives; it does not name the entities, so CBA's inclusion is not confirmed. Comyn told the October 2026 AGM that realising the AI opportunity 'will require regulation to keep pace'. ([Australian Prudential Regulation Authority](https://apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai), [Commonwealth Bank of Australia](https://commbank.com.au/articles/newsroom/2026/10/agm-ceo-address.html))

The bank publishes its structure and principles but not their outputs: no count of AI systems reviewed by the AI Risk Committee, no fairness or bias test results, and no figure for how often the Companion guardrails route customers to human teams. Its 2025 AI report notes the environmental impacts of AI are 'being considered at a Group level', without a published measure. ([Commonwealth Bank of Australia](https://www.commbank.com.au/content/dam/commbank-assets/about-us/docs/our-approach-to-adopting-ai-december-2025.pdf), [iTnews](https://www.itnews.com.au/news/cbas-ai-companion-is-expected-to-face-some-hard-questions-628051))

## What does the Commonwealth Bank profile record on this topic?

| Date | Move | Detail | Sources |
| --- | --- | --- | --- |
| Oct 14, 2026 | AGM: Comyn calls for AI regulation to keep pace | Comyn tells the AGM that effective regulation should build trust in AI and keep more of its economic value in Australia, and reports 5.9 million intelligent first-time-payment warnings since September 2024; the Chair says the Board spent considerable time on AI risks and opportunities. | [Commonwealth Bank of Australia](https://commbank.com.au/articles/newsroom/2026/10/agm-ceo-address.html), [Commonwealth Bank of Australia](https://commbank.com.au/articles/newsroom/2026/10/agm-chair-address.html) |
| Oct 2, 2026 | AI copyright licence signed | CommBank becomes the first major Australian bank to sign a Copyright Agency Business Licence covering use of eligible Australian news content in workplace GenAI prompts; the licence does not permit training or improving AI models. | [Commonwealth Bank of Australia](https://commbank.com.au/articles/newsroom/2026/10/commbank-ai-copyright-fees-creators.html) |
| Sep 18, 2026 | Chief AI Officer sets out remit and costs | In an interview Ranil Boteju says the role covers a single enterprise AI platform, standard guardrails, evaluation and observability, token-cost tracking and an AI science lab, and repeats about A$200 million of measured FY26 gross benefit. | [Retail Banker International (via Yahoo Finance)](https://finance.yahoo.com/technology/ai/articles/interview-cba-ai-chief-scaling-091319695.html) |
| Apr 30, 2026 | APRA letter to industry on AI | APRA tells all regulated entities that its late-2025 engagement with selected large banks, insurers and superannuation trustees found governance and assurance lagging AI adoption, and sets expectations for boards and for risk, technology and security executives; the letter does not name the entities reviewed, so CBA's inclusion is not confirmed. | [Australian Prudential Regulation Authority](https://apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai) |
| Feb 4, 2026 | Australian-first AI adoption report | CBA publishes Our Approach to Adopting AI: six responsible AI principles, over 27,600 employees engaged with its AI learning series, scam-detection AI over more than 20 million daily payments, and Compass AI having answered more than 500,000 questions since July 2024. | [Commonwealth Bank of Australia](https://commbank.com.au/articles/newsroom/2026/02/cba-approach-to-adopting-ai-report-announcement.html), [Finextra](https://finextra.com/newsarticle/47259/commbank-bids-to-ease-customer-fears-over-ai-adoption) |

## Common questions

### Does Commonwealth Bank have AI principles?

Yes, six: environmental and social impact, fairness, transparency, privacy and data protection, reliability and security, and accountability, which says human oversight of AI systems is necessary. They were informed by the bank's Code of Conduct, Australia's AI Ethics Principles and the OECD AI Principles, and were published in the bank's Our Approach to Adopting AI report released on February 4, 2026.

### Does Commonwealth Bank have an AI risk committee?

Yes. A management-level AI Risk Committee oversees the design and operation of the AI risk framework and gives risk challenge and advice on higher-risk AI use cases, alongside a Model Risk Governance Committee that supports approval of models including AI models. AI is classed as a material risk type, so the board sets an annual risk appetite for it, and AI Risk Indicators sit in the Group Risk Appetite Statement.

### How does Commonwealth Bank stop its chatbots giving bad answers?

For the Ceba chatbot it uses an internal guardrails-as-a-service layer that checks answers drawn from the bank's website by retrieval-augmented generation are appropriate rather than hallucinated. For Companion it built guardrails that detect sensitive topics such as problem gambling, financial abuse or hardship and offer a route to specialist human teams, and it does not let Companion give financial advice.

### Which regulator oversees Commonwealth Bank's use of AI?

APRA supervises CBA as an authorised deposit-taking institution and ASIC supervises conduct. APRA's April 2026 letter to industry on AI set expectations for boards to build AI literacy and oversee AI strategy within risk appetite and flagged prompt injection and agent misuse as cyber risks; it did not name the banks it reviewed. The bank says it participates in government inquiries on safe and responsible AI.
## Deeper on Commonwealth Bank

- [What is Commonwealth Bank's AI strategy?](https://www.bankingnewsai.com/banks/commonwealth-bank/ai-strategy)
- [What AI research, patents and partnerships does Commonwealth Bank have?](https://www.bankingnewsai.com/banks/commonwealth-bank/ai-research-patents-partnerships)
- [What technology stack does Commonwealth Bank run?](https://www.bankingnewsai.com/banks/commonwealth-bank/technology-stack)


---

Canonical page: https://www.bankingnewsai.com/banks/commonwealth-bank/responsible-ai
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (42 authorities, 243 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.