Designing practical AI governance for a regulated payments environment.
Context
As the operator of Australia’s domestic payments and identity infrastructure, including eftpos, BPAY, NPP, and ConnectID, Australian Payments Plus (AP+) operates at the intersection of regulated finance and emerging technology.
As AI reshapes financial services, AP+'s challenge was to build the foundations of an AI practice that could support the responsible adoption of AI without compromising the trust the ecosystem depends on. Too often, AI governance frameworks are designed primarily for compliance. AP+ needed one designed for trust, accountability and informed decision-making across the business.
“We wanted something that our teams could use day to day, that our risk colleagues were comfortable with, and that gave leadership confidence as we adopted AI.”
The right AI governance shouldn’t slow responsible innovation - it should enable it.
Insight
Effective risk management in the world of AI isn’t easy or straightforward. Traditional risk frameworks often rely on standardised assessments against fixed risk tolerances. AI is evolving rapidly, requiring governance that can evolve alongside it.
Big Idea: Right-Sized AI Governance
Not every AI initiative carries the same risk, and governance should reflect that. Lumyra's approach calibrates oversight to consequence: heavier where stakes are higher, lighter where they're not, and co-designed with the frontline teams who will run it. The result is governance that's practical, proportionate, and built to enable the business rather than stall it.
Bringing it to Life
AP+’s approach to establishing and operationalising AI Risk & Governance focuses on the applied uses of AI, where risk is most likely to arise.
Working closely with Engineering, Operations, Risk Specialists and People & Culture, Lumyra co-designed AP+'s AI governance framework around real use cases and frontline teams. An Executive level Steering Group provided strategic oversight, defining the AI Risk Appetite, structuring the AI Intake and Development Lifecycle, and uplifting Responsible AI capability across the business. We established a new operating cadence through the AP+ Adaptive Cycle to ensure that governance evolves alongside the AI ecosystem.
“Lumyra took the time to understand how AP+ works. Rather than bringing us a pre-defined framework, we worked together to build something that reflected our business, our people and the way we wanted to approach AI.”
