APRA seeks board management platform with AI switched off

The Australian Prudential Regulation Authority (APRA) has gone to market for board management software, calling for a secure, configurable platform delivered as a managed software service to run the governance and meeting workflow behind its roughly 90 board and committee meetings each year.

APRA said its current processes rely substantially on email, Microsoft 365 applications, shared repositories, and manually compiled documents, spreadsheets, registers and PDF meeting packs.

The regulator said that model demands significant administrative coordination and creates risks around fragmented workflows, version control, approval evidence, meeting-pack compilation, access control, auditability and records capture. It stressed it is not seeking merely a document repository or PDF reader, but a platform spanning the lifecycle from forward planning and paper preparation through meeting conduct, decisions, actions and records handover.

APRA said SharePoint, RecordPoint or another APRA-approved environment would remain the official records store unless it approves otherwise, and the solution must support APRA-approved end-user platforms including, at a minimum, Windows 11 desktops, the Microsoft Edge browser, and Apple iPad and iPhone devices, with controlled offline capability where authorised.

Internal and authorised external users would be managed through APRA-approved identity, governance and access-management mechanisms.

APRA stated that AI functionality is not required for the initial implementation, and the proposed solution must permit all artificial-intelligence and machine-learning functionality to remain completely disabled at the enterprise-tenant level unless and until APRA separately assesses and approves its use.

Suppliers must disclose every AI and machine-learning function embedded in or available through the product, its default state, and whether it can be fully switched off.

The regulator also set conditions that apply whether or not AI is enabled, including a prohibition on using APRA information for model training or product improvement without its express written approval, and a requirement that any AI functionality fall within the scope of the supplier's security assessment.

The required scope covers the software subscription and every module and service needed to deliver the solution, plus implementation planning, discovery, requirements validation and solution design; environment provisioning; identity, Microsoft 365 and other integrations.

It also includes configuration of committees, roles, permissions, workflows, templates and records-handover arrangements; testing; training and adoption support; ongoing support, maintenance and roadmap engagement; and data and records export, transition, exit, deletion and certification services.

As indicative planning assumptions - not guaranteed volumes - APRA listed 10 board and committee bodies, approximately 90 meetings annually, 100 board and committee members, 10 chairs, five governance and secretariat users, five system administrators, five executive assistants, 30 regular paper authors and approvers, 10 authorised external members, 20 temporary presenters and observers, and 40 expected initial training participants.

APRA said it will exclude from further consideration any response that does not satisfy a mandatory condition: the supplier must hold a current Information Security Registered Assessors Program (IRAP) assessment that is materially applicable to the actual board-management application and complete service proposed, and that covers within its scope the Australian Government Information Security Manual (ISM) controls needed to store, process, transmit and handle information classified up to and including PROTECTED.

Both elements must be met at the closing time, APRA said, and an assessment that is commissioned, planned, underway or expected to finish after closing will not qualify. 

The approach to market runs for an initial three-year term with two further three-year extension options exercisable at APRA's discretion. Evaluation and demonstrations are anticipated this month and contract execution happening next month.

Submissions close at 5pm Sydney time on 30 October 2026.

Earlier this year, APRA issued a request for quote, seeking a partner to deliver an Identity and Access Management solution that supports APRA’s identity security, access governance and regulatory compliance objectives.