AI security and compliance for Australian enterprises
Kapālins is built and hosted in Australia. The platform finds every model, copilot and agent an organisation runs, enforces policy inline and turns each Australian obligation into evidence a regulator can read.
What changes for Australia enterprises, and when.
APRA told banks, insurers and superannuation trustees in April 2026 that AI governance, cyber security, supplier risk and assurance were lagging adoption, and that it will escalate where weaknesses persist. The updated CPS 230 commenced in July 2026. From 10 December 2026 every privacy policy must disclose automated decision-making. The federal government has announced Australian Standards for AI for early 2027. Each of these asks the same question: can you show which AI you run and prove it behaves as approved?
- In force
APRA letter to industry on AI-related risk management and governance. Names governance, cyber security, supplier risk and assurance as the four weak areas and signals escalation to enforcement. Source
- In force
Updated CPS 230 and CPG 230 commenced. Operational resilience now explicitly covers material service providers, which includes AI providers and copilots. Source
- In force · upcoming
Privacy Act: automated decision-making transparency (APP 1) takes effect. Privacy policies must say when a computer program makes or substantially supports a decision that affects a person's rights. You need an inventory of such AI first. Source
- Proposed
Australian Standards for AI expected to be legislated; Office of AI established 15 Jul 2026. Announced by the Prime Minister on 15 July 2026. Timing is the government's stated expectation, not a fixed date. Source
Dates: each entry links to its source. A source marked secondary is a law firm, analyst or vendor summary; check the primary text before relying on the date. The full calendar is on the AI regulation tracker.
Mapped on the platform for Australia.
Every framework page says which controls are proved by a live signal from the gateway, probes or device sensor, and which by assessment evidence. Both are exported in the regulator evidence pack.
Hosting and residency.
The platform and its data are hosted in Australia.
Industries and cities.
Questions buyers in Australia ask.
Is Kapālins available in Australia?
Yes. Kapālins is delivered remotely from Melbourne, Australia, and through partners in the Authorised, Premier and Elite tiers. Organisations in Melbourne, Sydney, Brisbane, Perth, Canberra, Adelaide are served in the same way: a briefing on your own estate, then onboarding.
Which Australia frameworks does the platform map?
APRA CPS 234, Privacy Act 1988, Essential Eight, SOCI Act, ASIC RG 271, ASX Principles, APS responsible AI, ACSC Secure AI, ISO/IEC 42001, ISO/IEC 27001, SOC 2. Each framework page lists the controls mapped and whether a control is proved by a live platform signal or by assessment evidence.
Where is our data hosted?
The platform and its data are hosted in Australia.
Does Kapālins help with the 10 December 2026 automated decision-making disclosure?
Yes. The platform inventories every AI that makes or supports decisions, so the privacy-policy disclosure required under APP 1 from 10 December 2026 is written from a live inventory rather than a survey.