Whitepaper · PDF, 11 pages
Where the data sits: in-tenancy AI under APRA and ASIC expectations
What the rules require of an AI deployment, what they do not, and what a deployment choice can and cannot do for you. Every obligation is cited to the regulator’s own text.
Written for heads of compliance, COOs and CROs at advice licensees, fund managers and super funds.
What you will take away
- 01
There is no general data residency rule for advice licensees, fund managers or super funds. The hard localisation rules that do exist sit in other sectors, such as the My Health Record system.
- 02
Under CPS 230, an APRA-regulated entity must notify APRA before entering a material offshoring arrangement (para 60(b)). A foreign provider that performs the service in Australia is not offshoring; an Australian provider that performs it overseas is (footnote 16).
- 03
OAIC guidance treats some overseas storage as a use rather than a disclosure, but only in limited circumstances where the entity keeps effective control under a binding contract (APP Guidelines para 8.14). It is written about storage, and how far it reaches AI processing is untested.
- 04
Regulators are looking at AI through supplier control and assurance. APRA’s April 2026 letter asks regulated entities to map the whole AI supply chain, fourth parties included.
Inside the whitepaper
- Is there a data residency rule?
- What the Privacy Act asks of every firm
- What APRA asks of regulated entities
- What ASIC asks of licensees
- What a deployment choice changes: four deployment models compared
- Questions to put to any AI vendor
- What this paper does not cover
- Sources, fetched and quoted on 27 September 2026
Questions it answers
- Does Australian law require financial services data to stay in Australia?
- Not as a general rule. The Privacy Act, APRA’s CPS 230 and the Corporations Act licensing obligations permit offshoring and attach conditions to it: accountability for overseas recipients under APP 8 and section 16C, notice to APRA before a material offshoring arrangement, and a licensee keeping responsibility for anything it outsources. A contract, licence condition or client mandate can still add a location requirement for a particular firm.
- When must an APRA-regulated entity tell APRA about offshoring?
- Before entering a material offshoring arrangement, including where data or personnel relevant to the service will be located offshore (CPS 230, para 60(b), in the version commencing 1 July 2026). The 20 business day window in para 60(a) is a different requirement, for agreements supporting a critical operation.
- Does deploying AI in our own cloud account make us compliant?
- No. APP 11, CPS 234, CPS 230 and section 912A apply wherever the data sits. Keeping the system in an environment you control makes those obligations easier to evidence. It does not discharge them, and it does not settle where the AI model itself runs.
- Is this whitepaper legal advice?
- No. It is general information about Australian law and regulatory guidance as at 27 September 2026, with each obligation marked as law, guidance or a regulator’s finding and cited to its source.
More from the library