AI should be a decision, not a default

APRA's move to procure board management software with AI switched off highlights an important principle: AI should be a deliberate business decision, not an automatic software feature, and not a shadow IT exercise. It's worth noting this is a requirement for APRA's own procurement, not a blanket ban on AI for regulated organisations. Read the original report at TechPartner.news.

What this means in practice

The practical lesson is to understand where AI is already embedded in the platforms you use, what information it can access, and whether it can be disabled or restricted.

Board papers, financial information and confidential client records warrant particular scrutiny. Even Copilot on a laptop needs the same vigilance. Vendor assurances should be backed by clear contractual commitments, documented settings and appropriate oversight.

It's also worth knowing that some AI tools use your data, or your intellectual property, to train their global language models. Understanding which tools do, and on which plans, is part of getting this right.

The opportunity isn't to avoid AI. It's to adopt it selectively, with controls suited to the sensitivity of the information and the consequences of failure.

Where to start

Before enabling new capabilities, review AI features, data handling, access permissions and approval processes. That includes features introduced through routine software updates, which can switch on without anyone making a conscious decision.

A note on AI sandboxes

Reports of AI agents bypassing restrictions in test environments are a reminder that calling something a sandbox doesn't make it secure. An AI sandbox gives your team somewhere to experiment without putting the business at risk, but the fences matter. It should be:

• isolated from production systems
• populated with synthetic or sanitised data
• tightly controlled in its access to networks, tools and credentials

This isn't about machines going rogue. It's about unexpected behaviour finding gaps in controls. The principle is simple: encourage experimentation, verify isolation, monitor activity, and require human approval before connecting AI to live operations.

How OneTeam IT can help

We've been on this journey for over a year, and have focused as much on AI governance as on practical applications. If you'd like to understand where AI sits across your environment and how to gain real benefit from it securely, contact us to start the conversation.