Blog

At a time when the NEW GI Code and NIBA Brokers Code of Practice are occupying the general insurance headlines, ASIC and APRA have released their 2026-27 Corporate Plans. In this article I analyse the regulators plans and the impact on the general insurance industry. I consider what the plans mean for APRA‑regulated general insurers and other AFSL holders in the general insurance ecosystem (underwriting agencies, claim managers, and brokers). ASIC and APRA are converging on a pathway that can be summarised as: support productivity and innovation, but raise the bar on resilience and outcomes and make compliance easier for those acting in good faith while being less forgiving where harm occurs. ASIC frames its approach as being “easier to deal with” for those who want to comply and “harder to avoid” for those who cause harm. APRA’s plan emphasises safety and stability, strong risk management and governance, and the need to respond to intensifying cyber and AI threats and service provider dependencies. The result is that general insurance regulation is increasingly “end‑to‑end”: prudential resilience and market conduct are being treated as mutually reinforcing, not separate lanes. 1) The shared themes that affect everyone in general insurance (A) Operational resilience is becoming a common regulatory language ASIC states it will consult on proposals to “better align operational resilience market integrity rules with APRA standards” and continue harmonisation work. APRA identifies cyber and AI threats as intensifying, and highlights increased reliance on common platforms and material service providers (through CPS 230). Practical implication: regulators will increasingly test whether an organisation can maintain critical services through disruption (catastrophes, cyber events, vendor outages), and whether third‑party dependencies are properly controlled, not just whether policies exist. (B) AI shifts from ‘innovation’ to ‘governance, security and outcomes’ ASIC signals support for “responsible innovation” and “safe and responsible use of AI”, and notes investment in ASIC’s own AI and digital capability. APRA similarly identifies AI as a key priority and aims to become an “AI-enabled regulator”, while tying frontier AI to heightened cyber threats. Practical implication: AI use in client servicing, underwriting, claims, complaints and customer communications will be examined for explainability, control, auditability, and the way it changes consumer outcomes and operational risk. (C) Simplification and coordination: fewer duplicative asks, less tolerance for ‘confusion’ ASIC commits to ‘simplification practices’ and improving guidance accessibility and usability, and notes coordinated surveillance and streamlined data requests with APRA through Council of Financial Regulators collaboration. APRA likewise emphasises coordination to reduce duplication and references the Regulatory Initiatives Grid. Practical implication: expect improved visibility of regulatory priorities and more standardised information gathering, but also clearer lines of accountability when systemic issues persist. 2) Impacts for APRA‑regulated general insurers (A) Prudential expectations will bite hardest where outsourcing and catastrophe operations are weakest APRA is explicit that cyber and AI risk is intensifying and that reliance on common technology platforms and material service providers increases systemic concentration risk. That has direct consequences for insurers’ outsourcing models: delegated claims administrators (insurance claims managers),

𝐁𝐞𝐲𝐨𝐧𝐝 𝐭𝐡𝐞 𝐋𝐢𝐜𝐞𝐧𝐜𝐞: 𝐖𝐡𝐚𝐭 𝐒𝐞𝐜𝐭𝐢𝐨𝐧 𝟗𝟏𝟐𝐀 𝐌𝐞𝐚𝐧𝐬 𝐟𝐨𝐫 𝐆𝐞𝐧𝐞𝐫𝐚𝐥 𝐈𝐧𝐬𝐮𝐫𝐚𝐧𝐜𝐞 𝐅𝐢𝐫𝐦𝐬 Section 912A of the Corporations Act 2001 (Cth)is the conduct backbone that sits behind distribution, underwriting agency operations, claims handling and settling and the oversight of large service-supplier ecosystems. Section 912A contains “general obligations” on AFS licensees. Below is a practical, obligation-by-obligation guide to what each limb of s 912 A(1) means for insurers, underwriting agencies, claims managers, claimant intermediaries, brokers and authorised representatives, and how to operationalise it. s 912 A(1)(a): provide financial services efficiently, honestly and fairly (EHF) This is the overarching obligation: you must “do all things necessary” to ensure the financial services covered by your AFSL are provided efficiently, honestly and fairly. ASIC treats EHF as both an “umbrella” obligation (if you fail other general obligations, it is unlikely you are meeting EHF) and a standalone obligation capable of being breached even where another specific obligation is not. In insurance, this obligation is directly relevant to claims handling and settling and the service standards you set across your claims supply chain (refer ASIC INFO 253). ASIC indicates that alignment with relevant industry code standards (GI Code of Practice) is a strong indicator of commitment to EHF claims handling. Operationalising EHF (practical controls) Look at the firm’s ‘conduct’ values through a compliance lens and operationalise them across, sales, underwriting, claims and servicing through Standard Operating Procedures (SOP), and provide training aligned to the SOP. Set and monitor end-to-end service standards (sales, disclosure, claims, complaints) and map them against code, incident and complaint management expectations then measure and report them internally. Build supervision and QA that actually detects harmful patterns (e.g., scripts, claims triage rules, vulnerable customer handling) Treat EHF as a product-and-service outcome obligation: uplift governance of claims partners, authorised reps, and outsourced functions (including adjusters, investigators, builders, repairers) so quality is demonstrable, not asserted. s 912 A(1)(aa): adequate arrangements for managing conflicts of interest This obligation was inserted to supplement EHF and make conflicts management explicit. It contemplates robust internal policies and procedures for preventing and addressing conflicts, including adequate disclosure where relevant. ASIC’s primary detailed guidance is in RG 181 (updated as at December 2025) Operationalising conflicts management Maintain a conflicts register that covers remuneration, binder and authority incentives, claims cost containment incentives, related-party service providers, and delegation arrangements then review it as part of governance mechanisms Implement “conflicts by design” controls: segregation where needed (e.g., claims decision authority vs cost management), clear escalation pathways, and documented rationale where conflicts cannot be avoided. Hard-wire conflicts into procurement and third-party governance: contractual duties, audit rights, and performance metrics that do not reward unfair customer outcomes. for insurance brokers be mindful of commissions including non-monetary benefits from insurers. When charging a fee, implement Guidelines where a fee range is based on complexity criteria. s 912 A(1)(b): comply with the conditions on your AFSL Your AFSL conditions are not boilerplate. They are enforceable licence obligations, and RG 104 frames compliance with conditions as part of your “broad

Artificial intelligence is already being used across general insurance, from underwriting and pricing to claims and complaints triage, fraud detection, vulnerability identification, data analysis and customer communications. The governance challenge is not simply whether an AI system works. It is whether the system produces appropriate, defensible and consistent outcomes throughout its lifecycle. Four principles provide a practical foundation: Fairness, Adaptability, Explainability and Reliability. 1. Fairness Fairness means that any of the outputs generated by AI should be equitable and free from bias. It should not discriminate against any communities, groups, or individuals. Fairness can sometimes be a trade-off between procedural fairness (ensuring the system or process treats all people the same) and representational fairness (ensuring inequalities in the real world or past data, e.g. gender bias, aren’t perpetuated). [AI Fluency for directors, The University of Sydney, Sydney Executive Plus+ 2026) In general insurance, this is particularly relevant where AI is used for: risk selection, pricing or policy renewal; claims triage and fraud detection; identifying potentially vulnerable customers; prioritising complaints; or recommending whether a claim should be accepted (in full or in part), investigated or declined. Fairness does not necessarily mean treating every customer identically. Insurance legitimately differentiates between the type of consumer and general insurance product. The question is whether the differentiation is supported by relevant information, is legally permissible and does not operate as an inappropriate proxy for a vulnerability factor. Controls should include testing datasets for bias, comparing outcomes across customer cohorts, reviewing false-positive and false-negative rates, and requiring human review before an adverse or high-impact decision is made. 2. Adaptability Adaptability in an AI system refers to the ability to adjust to new information that falls outside its training data. A machine learning system that has learned to identify patterns in training data can be extremely efficient at predicting those patterns in the future. But they often struggle to cope with disruption and change, when the world changes and no longer matches its training data. (ibid, AI Fluency for directors) Adaptability requires: monitoring for model drift and unexpected changes in outcomes; reassessment when the model, data, intended use or regulatory (or Code) environment changes; defined triggers for escalation, suspension or human intervention; change-management controls over vendor and internal updates; and a process for retiring AI systems that are no longer suitable. Governance should therefore continue after implementation. Approval at the commencement of an AI project is not enough. 3. Explainability AI should be transparent and explainable. Transparency is about how much of your system’s inner workings you can understand. Explainability means how and why certain decisions are made can be understood by the people who interact with the AI, be they employees or customers. (ibid, AI Fluency for directors) This is critical where AI contributes to: premium or policy coverage decisions; the identification of suspected fraud; claim delays, part settlements or denials; complaint outcomes; or customer facing advice or communications. Explainability does not require every employee to understand the technical construction of a model. It does require

In the AFSL context, “competent” is used in two related but distinct ways—(1) organisational competence (driven by responsible managers), and (2) representative competence (driven by training/supervision of the people who actually provide the services).

The Federal Court today imposed penalties of $35 million against Harvey Norman Holdings Ltd and $20 million against Latitude Finance Australia for misleading conduct and false or misleading representations they made in a national advertising campaign promoting a 60-month interest free and no deposit payment method for goods purchased at Harvey Norman stores. The…