AI use-case risk assessment
Worked example: Autonomous loan approval (Australia) · ARA-261031-D7361A · 2026-10-31 06:37:15 UTC · Agentic Risk Analyst v3.2.1 · Worked example: prepared in advance, not generated live
EXECUTIVE DECISION
APPROVE WITH CONDITIONS
Inherent High → residual Medium
Scenario
An Australian retail bank wants to deploy an autonomous AI agent that approves personal loans up to AUD 50,000 using customer transaction history, credit bureau data and open banking data. No human review is planned for approvals under AUD 30,000. The bank intends to use a third-party foundation model via API. Decisions will be delivered to customers in-app within 30 seconds.
Executive narrative
Proceed only with a human gate for declines and larger loans, validated fairness and affordability, and updated transparency. Full automation of declines is not supported.
Top risks
- Unfair or discriminatory credit outcomes
- Unsuitable loans approved
- Automated decisions without required transparency
Conditions
- Human review of all declines and approvals above AUD 30,000
- Fairness and affordability testing before go-live
- Privacy policy updated for APP 1.7 to 1.9 before 10 December 2026
Remediation plan
| Horizon | ID | Action | Owner | Priority |
|---|
| 0-30 days | A-01 | Design the human review step and reason codes | Head of Credit | Critical |
| 30-90 days | A-02 | Run fairness and affordability validation | Model Risk | High |
| 30-90 days | A-03 | Update privacy policy and notices | Privacy Officer | High |
| 90+ days | A-04 | Set up monthly drift and fairness monitoring | Model Risk | Medium |
Risk register
| ID | Risk | L | I | Inherent |
|---|
| R-01 | Unfair or discriminatory credit outcomes | Possible | Major | High |
| R-02 | Unsuitable loans approved | Possible | Major | High |
| R-03 | Automated decisions without required transparency | Likely | Moderate | High |
| R-04 | Foundation model change or outage | Possible | Moderate | Medium |
| R-05 | Drift after deployment | Likely | Moderate | High |
Regulatory findings
Evidence status: model knowledge only; verify against source texts.
| Regulation | Applicability | Why it matters |
|---|
| National Consumer Credit Protection Act 2009 (responsible lending) (Australia) | applicable | Personal loans to consumers are regulated credit. |
| Privacy Act 1988 (APPs, including APP 1.7 to 1.9) (Australia) | applicable | Personal and credit information drives automated decisions. |
| APRA CPS 230 Operational Risk Management (Australia) | applicable | The bank is APRA-regulated and relies on a third-party model provider. |
| Anti-discrimination legislation (Commonwealth and state) (Australia) | potentially applicable | Credit decisions must not discriminate on protected attributes. |
Security threats
| ID | Threat | Inherent | MITRE |
|---|
| T-01 | Adversarial manipulation of application data | High | MITRE ATLAS AML.T0043 |
| T-02 | Credential compromise of the model API | Medium | MITRE ATT&CK T1552 |
Controls and residual risk
| ID | Control | Priority | Addresses |
|---|
| C-01 | Human review of declines and loans above AUD 30,000 | Immediate | R-01, R-02 |
| C-02 | Fairness and affordability testing before release and monthly | Immediate | R-01, R-02, R-05 |
| C-03 | Automated-decision transparency | Near-term | R-03 |
| C-04 | Model change control and fallback | Near-term | R-04, R-05 |
| Risk | Inherent | Residual | Justification |
|---|
| R-01 Unfair or discriminatory credit outcomes | High | Medium | Human review and testing catch most unfair outcomes. |
| R-02 Unsuitable loans approved | High | Medium | Affordability testing and review of large loans. |
| R-03 Automated decisions without required transparency | High | Low | Policy and reasons address the obligation. |
| R-04 Foundation model change or outage | Medium | Low | Version pinning and fallback. |
| R-05 Drift after deployment | High | Medium | Monthly monitoring. |
Decision support only, not legal or regulatory advice. AI-generated ratings and citations must be reviewed by a qualified person before they are relied on.