Running private AI in regulated Australia

Australia chose sector regulators over a single AI Act, so your AI governance framework has to map to the real Australian stack, not a global rehash.

Five axes, eight contract questions, and three archetype walk-throughs (APRA-supervised bank, AHPRA-bound clinical operator, Commonwealth agency on PROTECTED data), written for the chief risk officer, chief data officer, and head of digital making a defensible engagement decision.

Approval gates, escalation paths, and audit trails: where to put humans in the AI loop when the workflow runs under APRA, OAIC, AHPRA, or Privacy Act scrutiny.

What APRA expects when an AI system sits inside the information-security boundary of a regulated entity: the controls, the evidence, and the lines of defence.

Why on-territory inference is the default for regulated Australian workflows, and what the alternatives actually cost in assurance work, contractual ambiguity, and residual risk.

Two 120-billion-parameter open-weight models with opposite architectural bets.

Hallucinations become expensive when AI output reaches customers, regulators, or operators without grounding and review.