COMYN, Mr Matt, Chief Executive Officer and Managing Director, Commonwealth Bank of Australia NICOL, Ms Nicola, Group Security Officer, Commonwealth Bank of Australia [16:40] CHAIR: Welcome. I understand that information on parliamentary privilege and the protection of witnesses has been provided to you. I'll now invite you to make some opening remarks—as short and sharp as we possibly can—and provide anything further in written form to the secretariat so we can then get underway with questions. Over to you. Mr Comyn : Thank you very much, Chair, and thank you for the opportunity to appear today. I will take that cue very literally. I think there are a number of different areas, and we want to make ourselves as helpful as we can to the committee. Broadly, we could talk about some of the things that we've thought about from a national capability plan—How do we think this technology creates value? Where are the risks? How do we manage those risks?—including in areas like attracting international investment. I'm by no means a copyright expert, but I've spent quite a bit of time on this topic. I've noticed a number of questions in that area over the course of the day. Then also, secondly, we're happy to talk about anything that we're doing within CBA: How are we thinking about it strategically? Where's the opportunity to better serve our customers? How do we think about better protection? Nicola looks after security. We've spent a lot of time on risks such as cyber. Then maybe there's a thread through both of those but is worthy of mention on a standalone basis, which is how we make sure that we're building the right skills and capabilities in the organisation not just for today and into the future but more broadly. I think this workforce transition—getting people prepared, building agency and resilience—is really important as an employer but also as a financial institution. I'm happy to be guided by you. CHAIR: Thank you, Mr Comyn. On that last comment there, expanding out, what does AI sovereignty and capability mean to you, and how does that interact, obviously, with the CBA but also more broadly? It would be interesting to get your perspective on what that means. Mr Comyn : We think about the technology in many ways. One, I think there is huge transformative potential as a general-purpose technology, as has been the case in prior generations. Wealth is really created within a country where the benefits and the ability to use that technology are widely adopted, so we tend to think about that very much in terms of what the capabilities are that need to be built within Australia. For us, as a large employer within that, one of the things that we think about is where the value is going to accrue and how we make it more likely that it's going to accrue to Australian companies. We obviously make individual decisions about technology providers that we work with. We also have our own capabilities that we've developed. Central to this, of course, is trust and reputation and transparency. It's why we're prepared to communicate about this topic. We report on an annual basis about where we're using it, in what instances. And, of course, we're investing a lot in areas to protect our customers, like cyber, financial crime, scams and fraud. Those are areas where there's been a significant change in the broader risk profile, both domestically and internationally. Then we're trying to think through how to best build the right capabilities in the organisation. I think this is true at a national level. It's very much about where Australia wants to participate. It won't make sense to participate in all areas of this technology. Similarly, what are the risks that we're most worried about? How can we best control for those? What are the capabilities that really underpin that? This is clearly a very dynamic area. CHAIR: What's your sense, then, in terms of those capabilities and the ability to see an Australian AI ecosystem and the connected capabilities around the ability for us to attract these hyperscalers to train here in terms of the correlation between the opportunity to leverage off of that as we understand is possible? What would that then mean, do you think, around our own capability opportunities as well as making the point around the sovereignty? Is there a genuine, real connection in your mind between the opportunity for compute investment and frontier access correlating directly with our ability to build up our own Australian AI ecosystem? Mr Comyn : I think there is. I don't think it's the only way that we can attract the level of investment and capability. You touched on it. It is very important across the economy that companies both large and small—I'm happy to return to our own experiences dealing with some of the smaller companies—are able to use the technology safely and have the confidence to leverage it to generate better outcomes for customers and to work more productively. I do think, specifically to your question, that there will be additional capabilities if we do training compute here in addition to inference. I do think it is a little difficult to establish exactly what the causality will be. In and around research and training runs, there are additional capability resources. I know of at least a small number of people in the US tech firms that would be willing to spend considerably more time in Australia. It's these sorts of ecosystems that we need to be able to build—hopefully many, but even a small number of companies that are commenced in the next few years that go on to be very significant would be worthwhile. There is a real spillover effect. If we can attract and come up with a compact with those firms, having some sort of commitment to roles that are actually here in market, how to work through research and development—Australia does well in research and development, but that whole commercialisation pipeline hasn't been as strong as it perhaps could have been. So I think this is one of those opportunities. One of the solutions that needs to be worked through is around copyright. I recognise the concerns there. I think they are legitimate. I've met with a small number of rights holders because I was seeking to understand it. I don't think there is a perfect solution. I'm hopeful that there is a compromise solution, but there are a number of difficult issues to navigate as part of that. CHAIR: I appreciate that. Deputy Chair. Senator DUNIAM: Mr Comyn, obviously you lead one of Australia's largest commercial entities. I'm interested in what you have to say about creating value and attracting investment, as you referenced in your opening remarks there. This committee is a multipartisan or cross-party committee of the parliament, and I'm hopeful that the government will hear what we have to say. What is your advice to us around what needs to be done in this country to create that environment where we do attract investment and create value as well? Mr Comyn : I think the attractiveness for foreign capital extends beyond AI. There are a number of different settings there which are important in areas that Australia already does well—areas like a reliable rule of law. This is helpful in this broader context. We do have space, we do have vast renewable resources and we do have good security relationships. In this particular area, being part of the Five Eyes security alliance means that Australia is one of a relatively small number of countries that is a viable training location as it relates to the US firms particularly. If you think about the overall value chain of AI, it's actually pretty concentrated in a small number of countries between the US, China, Taiwan, lithography in the Netherlands, and a bunch of things like wafers in Japan. So, as for being a country that at least participates in that value chain to attract the investment, as best I can tell, I don't think there's a solution anywhere in the world to copyright that we should be seeking to replicate insofar as I don't think TDM or even the fair use exemptions are viable; therefore, it has to be an Australian solution. As best I can tell, there's certainly no perfect solution, so it's about trying to find the right sort of compromise where there are genuine creative controls, where there's a reasonable financial dividend that's being extracted and where there are capability and a commitment to build that capability over an extended period of time. We think about the creative and cultural capability over a long period, and we're also very mindful of the community obligations, things like energy, water usage. Clearly, site selection is very important. This is a controversial topic globally, so I think Australia has to be able to make deliberate choices and then be prepared. Hopefully, one of the success of this committee would be getting some bipartisan support as best we can for an optimal solution. As I said, narrowly, that could be around the investment that's required for training. But I think, more broadly, obviously continuing to be an attractive source for foreign capital as well as a source for domestic capital is really important. Senator DUNIAM: You reference a small number of countries where AI investment and capital related to it are domiciled, so could we perhaps be another country added to that list if we get the settings right in this country? Mr Comyn : Yes. I don't want to create an impression that I would see Australia alongside Taiwan, because the senator's comment earlier is right. I think it's around 70 per cent of the value that would flow offshore if we think of $200 billion of capex. But across that value chain, I do think there are some sovereign considerations to having that scale of domestic compute. I could imagine that would be valuable in the near term, not only in stable times but also—perhaps even more valuable—in more volatile times. Nicola works very closely with our intelligence services. Obviously, national security is at the forefront of our thinking. I know at least one of the model companies has talked about providing secure and reliable access. I do think that's an important consideration. Working with some of the more advanced models, the generally non-available models, does require specialist expertise be able to both run them and run them safely, and that's the sort of capability that the US firms work directly with companies like us on, and parts of the government like the ASD, whose capabilities I think Australia is very well served by. Senator DUNIAM: Sure. Yes, Abby Bradshaw sings CBA's praises. CHAIR: Senator Pocock. Senator DAVID POCOCK: Thank you very much for your time here today. Given what we've seen with the Medicare breach, how concerned are you about the potential impact to banks, and what's being done in that space? I understand you have an agreement with Anthropic. What are the sorts of things you're doing to stay ahead of the scammers and the people trying to trying to get access to people's details and money? Mr Comyn : We work with both Anthropic and OpenAI on different implementations. Then we also have a series of controls that we rely and build on. To your specific question, yes, of course, we're concerned about the specific instances of that. But also, we've seen the capability develop at an ever-increasing rate, particularly over the last nine or so months, and that was really from about April or so of this year. To some of the capabilities that were developed within Mythos, obviously, one of the issues with the technology is it is very much dual use, so what makes it very good from a engineering or coding perspective also makes it very good and effective as a cybertechnology. We also have to build out the capabilities, because if we deploy this technology then ultimately we're accountable for it. We have our own processes in terms of the way we think about the individual models that have been built. We have pre-deployment checks. We think about that in terms of registration and making sure we know any models that are being used inside the organisation. Then there are things like run time evaluation and monitoring. Again, I don't want to gloss over some of the complexities. As the models become more capable and they're capable of running longer horizon tasks, the importance of being able to evaluate those in real time or runtime is very important. Then you've got post-runtime controls. So you're monitoring, logging, seeing what results were developed. We've built a number of those capabilities ourselves; for others, we're partnering. Nicola's team is an example where we're working with very advanced cybermodels. There's a whole range of additional controls that we would have in place where they're not partitioned. They're partitioned away from the internet. They're very much isolated. We've got approved users. You've got specific authorisations that need to be in place. This is one of the reasons why I think it's hard for many enterprises early on when there's a new and quite different technology, because there's actually an enormous amount of complexity and then capabilities that need to be built so that you can be confident about how you're using it, about what outcomes are being delivered and, to the extent that anything is drifting from your expectations, that you're able to detect that. That's still an imperfect science. Senator DAVID POCOCK: Do your partnerships with the frontier labs give you early access to their frontier models to test out your vulnerabilities? Is that how it works? Mr Comyn : Yes, there is the opportunity to work closely with them. I only hesitate because we may go into areas that perhaps I'd be very happy to share privately but may not want to do so publicly. Senator DAVID POCOCK: One of the things we hear from these big tech companies is that the financial benefits are going to be huge for the country. Aussie companies are paying pretty much full freight corporate tax here in Australia. A lot of them are getting away with 1.3, 1.52 or two per cent tax on revenue. I know you've weighed into these debates in the past. What is your view on how we ensure that companies that come here clearly because there's a profitable market actually contribute beyond payroll tax, which is people's favourite thing to say they're contributing? Mr Comyn : Based on what I've seen of your questions over an extended period of time, I think we have some shared views and beliefs, and certainly taxation is one of those. I think where you operate in a country, you should be bound by the laws that operate within that country. Secondly, you should be making a fair and reasonable contribution to that, which is why, when it comes back to copyright, it is important. Copyright works around permissions. I do think it's right, insofar as the training, which is done over a vast corpus of data. It is very difficult to make that work in the operation of receiving or achieving prior consent, which is why, if moving to something like an opt-out, which requires a legislative or statutory change there clearly needs to be compensation—well, I think there needs to be compensation—that flows from that. There are some complexities about how you deal with rights holders, especially for content that's distributed across third-party sites. I don't know what the distribution is between domestic and international, but, as I said, there is some complexity in and around the copyright laws. I say it eyes wide open, and I think the considerations that you and others are pressing on is important, but we should make sure that there is an adequate value exchange for Australia. I'd like to think that there is one and that one could be achieved. I think that, at the moment, clearly, given the significant growth in compute requirements, there's a relatively narrow window to try and strike that balanced outcome to be able to attract that investment, which may not exist in five or so years. Those, at least, are my own views. I don't have a perfect understanding, obviously, of either party's consideration and of what the no-go zones really are in terms of what would make it unattractive to come here. Senator DAVID POCOCK: Finally, on the copyright question, does your recently announced copyright deal show that, where there's a will, there's a way—that, if companies actually want to engage in good faith and engage with creatives, we can actually find something that works for creatives? Mr Comyn : Yes, and I think there are a couple of things within that, because one of the elements to understand is all of the different types of use. So I would see that, if you're doing training compute here, you'd need an authorisation and you'd probably have to have an accreditation. It may be wise or even beneficial to then be submitted to audit and different compliance checks so that other stakeholders can have confidence that you're following that. Alongside that, you have to distinguish between what is pretraining or general training, what is post or fine-tuning and what is RAG, retrieval augmented generation—so, for specific uses. And our example is a good one because, as you said, we're evidence of the mechanism working in its totality. Now, we're relying on limited use. It can't be used for training, which is fine for our purposes, but we can specifically identify individual works through workplace prompts—not outside of that. So, yes, I think where there are high-value individual works that can be identified, they can be opted out of some sort of statutory permit. Then there is a commercial and licensing agreement or deal that could be struck, and, at least in our instance, that was possible. I think there's a multitude of reasons why that's important. Senator DAVID POCOCK: Thank you. CHAIR: Senator Sheldon. Senator SHELDON: Thanks very much. Your answers have been helpful for the committee and for our deliberations. It's been interesting. I note that, in the very start of your submission—the CommBank submission—it says of AI: It is critical that Australia is able to capture the benefits and distribute them well—between labour and capital … It's that question, I guess, of social licence, which has been a big part of the conversation today. Last year, Kathryn Sullivan, who had worked at your bank for 25 years, was tasked with training one of your chatbots. Then, with one day's notice, CBA terminated her and told her the chatbot would be taking over her job. Obviously, that's not a fair distribution of benefits of AI, so what's your new sweep of approach in light of what, frankly, was seen as a breaking of social licence? Mr Comyn : I think that relates to in and around July or so—and maybe that question was even put at our AGM. There are some parts of that that are related to AI. In that particular instance, that's around voice servicing. Another part, which could be unrelated to AI, is that we have important obligations to both engage with staff and make sure that we have the right level of capabilities to deal with ongoing volumes, and some of the technology makes that harder. But that, ultimately, was our fault. We completely fall on that. I may, if I could, just come back to one part of your question, around capability and working with technology, because I think this will be a difficult issue and I don't want to gloss over it. That was one of the inputs into us candidly and fundamentally reviewing our approach for dealing with workforce change. As I said, I think, in the past, cycles were progressively slow enough that you could be engaging with people with some degree of foresight and be able to assist them to find another role. And I should also put that in the context that, over the last 10 years, we've added more than 10,000 FTE. So we've been in an area where we've grown FTE. Then, what we really thought about was, actually, we don't know—and I'm personally not on the negative side, insofar as I don't think there's going to be near-term significant labour-force disruption. But I do think there are changes underway across the economy, and I think they're more likely than not to accelerate. So the most important part about that is: how do we best prepare? One of the things that we wanted was for everyone in the organisation to start thinking about their career, their skills and what they're doing in their role, and we wanted to give them opportunities to be able to build additional skills which give them greater flexibility. There's no point being worried about something if you don't have the opportunity to actually engage in it to give people agency and resilience. We announced earlier this year a $90 million program over three years. There are a number of different elements to that but, effectively, we extended the period for people, at the organisation's cost, to be able to build additional skills. We're about to enhance that platform. We have some long-term and near-term plans about how we're going to make sure that we're giving all of our employees the best opportunity to build skills and capability to be successful in their roles today but to also give them much greater visibility of what roles they'd be more eligible or more likely for if they had additional skills, both in the CBA context and potentially outside of that. We've been in a situation for many decades, which we're fortunate—there is a degree of apathy around career paths. We're certainly working hard to make sure that we're engaging and enrolling the whole organisation in what could be some pretty significant changes over the next five-plus years. Senator SHELDON: Thanks for that answer. We've had OpenAI saying sorry for a number of weeks now and again today. Part of your answer goes to that point, but the question goes to what's changed culturally. I appreciate your answer, but would it be appropriate to say sorry to the fact that it has gone wrong for the moment and what your change is? For somebody who gets a day's notice—the reporting is correct, I'm taking it. Certainly, from the workforce themselves— Mr Comyn : I don't know the specifics about whether it was a day's notice, but it was also our error, the way we identified—the reason we reversed the decision was that the volumes we then calculated were going to require additional staffing. That's what led to our decision. I have apologised for that in the past; I have no hesitation in doing so. It was actually one of the triggers that led us to think that this isn't actually a very good process, to be engaging for the first time at relatively short notice and saying: 'Your role is going to be impacted. Here's eight weeks to try and find redeployment paths.' This is one of the reasons why we extended that to 12 weeks and gave people priority placements. We've given them opportunities to build skills in advance of that. But there is one aspect of your question which I also want to make sure I don't gloss over, and this is about the concept of—I think people do and will feel that they're training technology. I think this is going to be one of the more difficult issues. If you think about how intelligence is stored within the models—without going into the technology in too much detail, the specific information that's in the model itself is often referred to as weights. There's a lot of information that sits around that knowledge context. The way you train and help the models be more accurate so they behave the way you would like is you effectively provide information. If it doesn't do a good job, you're putting information into that—both what worked and what didn't work—so that the next try is more effective and accurate. I think this is going to be one of the issues that is important for organisations to both do and communicate, because trust does come from transparency, reliability and consistency. I don't think that particular issue is going away. Senator SHELDON: In part of the guidelines or the new culture—I'm describing it that way, which I think is the way you've outlined it both in your introduction and now: 'How do we build a culture around AI amongst the entire workforce, not just among management but for those in different roles right through to managerial, so we can actually get the benefits?' In New South Wales, they've identified the New South Wales Occupational Health and Safety Act to deal with psychosocial effects of the use of AI, and that helps with the frame. I'm not expecting you to be intimately involved in understanding the New South Wales Occupational Health and Safety Act, but the principle is this. I'll speak broadly about the principle of safety acts, which is pretty well settled across the economy, across workforces and across business—certainly among good business, which is the vast majority of companies. There are guidelines which are national, there are industry-specific guidelines and there are corporate guidelines that are developed in cooperation, through conversations and discussions, with the workforce, with management and with academics to say, 'This is what will probably and practically work.' If we were to place the psychosocial questions on the effects of AI within guidelines that are equally shared by everybody, we can all gain the benefits of others' knowledge and others' experiences. Is that something you think is an important cultural piece that we have to work on as well? Mr Comyn : I'm not as familiar with the legislation specifically, but maybe let me talk on a few points from a— Senator SHELDON: 'Firm guidelines' might be a way of saying not the specifics that are done on a corporate basis with workforce and management cells but the broad context of guidelines about how we actually manage a cultural change that has to take place or is taking place in workplaces—good and bad. Mr Comyn : As I said earlier, it's really important to understand both the technology and how to use that to improve the customer experience. We have to think about the way the benefits are distributed across new products and across improvements to customer experience. Obviously you would anticipate higher levels of competitive intensity. There will be areas where there'll be a reduction in the number of roles, which will lead to higher efficiency. Part of what we're doing—there's considerable uncertainty about exactly where and exactly when—is talking about that openly and trying to create as much momentum around building additional skills and career pathways. We do have psychosocial obligations. We do recognise that there are a number of things that are still unresolved about the use of this technology and how it can be—for some people, it's removing joyless work; for other people, they're finding it more taxing. There are a number of different pieces of research that are underway, some of which we're participating in. We've also committed to continuing our graduate intake, which, at least on a global basis, is probably one of the only areas that, so far, is bearing out in many pieces of economic and jobs research, as there seems to be less hiring for entry-level roles. There are many other industries where it is anticipated that there will actually be far fewer roles, but demand has more than offset more productive supply of those workforces. But this is going to be a particularly important issue to continue to navigate through. I'm not suggesting we have all of the answers, but we certainly are committed to trying to talk about it as openly as we can be, and we are trying to mitigate it as best we can. I think that early engagement is really important because these sorts of changes certainly have the potential to have more of a herding effect across different sectors of the economy if they come quickly. I think it's beneficial to be prepared well in advance of that. Senator SHELDON: Thank you. CHAIR: I am very conscious of time. We are coming right to the end or are just over it. Mr Hastie has one question. I'll put it on record that it could potentially be taken on notice or be made quite quick. Mr HASTIE: On page 4 of your submission, in the 'national security and strategic autonomy' part, there's a line about advanced AI becoming more embedded across the economy. The sentence I want to focus on, if you could expand on it and explain it to the average Australian, is: Excessive dependence on capabilities controlled elsewhere could also increase Australia's exposure to disruption, external pressure or coercion. What are the risks here from a national perspective? Mr Comyn : Nicola might want to add to this, too. We've covered some of this earlier insofar as—the most advanced closed-weight models are clearly from the US. We have been well supported, but there have been some well-known instances where international access for particular models has been revoked at relatively short notice. Part of that for us is about building the capability to switch in and out of models. Some of the knowledge and infrastructure you need to have around the model enables that. I think there will be a place for open-weight models in multiple jurisdictions. There are some we use that we think will be viable from a commercial perspective. There are other models that, at least at this point in time, are open weight—I'm sure you can imagine what I'm referring to—and that we wouldn't prioritise for customer-facing use cases but are important. Nicola and her team are working with them in areas like cyber defence. Ms Nicol : To add, when you look at getting early access to some of those advanced models, one of the national challenges is making sure that we have the capabilities and the skills to leverage those models for cyber defence purposes. If you look at some of the resourcing around cyber roles in Australia, we're already underresourced, more broadly. We're now having to scale those roles but also having to change the nature of the work. Again, I think there's an opportunity to build sovereign capability and also leverage a variety of models for cyber defence purposes. That's an area where there's an opportunity, but we need to act with a sense of urgency. Mr HASTIE: Sure. We can't call the Trump White House or the US Department of Commerce, but let's say Anthropic, OpenAI and others set up here. Just because they're here doesn't mean that the US government can't issue an export control directive, which may lead to the next Mythos being cut, potentially. Is there a way around that? Is that about having our own sovereign capability? Are we capable of such a thing? Mr Comyn : It would be hard to suggest that we're going to come up with a closed-weight LLM that's going to be competing with an Astra or a FableAI/Mythos. There was another US open-weight model, which is not at the frontier, that was published in the last 24 hours. It would be six to nine months behind. More than 95 per cent of tasks inside companies do not require much more model capability. There's a significant model capability overhead in defensive areas like cyber. That's where you need the most advanced models. I think there is a combination of strategies that we should be employing. Personally, I think it is definitely helpful to have a strong and very productive working relationship between firms and some of the US companies in that instance. That's enhanced if they're onshore. As I said, certainly in our experience, our intelligence services have a very strong and very productive relationship such that I think Australia—certainly, as I've been able to garner insights from across the rest of the world—is certainly not disadvantaged compared to any other jurisdiction. That is important as well. Mr HASTIE: There's a difference between the relationship with the private sector and the relationship between governments. ASD, for example, might be exempt from such an export control. We don't know if they were, and we can't ask them in public. Mr Comyn : To your point, we should be developing our own capability where it makes sense, and we should be realistic about where that is likely to be productive. There are areas where we can be working between government and enterprise. Of course, where it could make sense is in building out specific national resources. Sometimes particular training data could be used in areas of, say, national security. There will also be areas like health care, for example, where the models are trained heavily on particular profiles that aren't necessarily representative of certain communities. Building out capability in academia, government and enterprise is a priority. Mr HASTIE: Thank you. CHAIR: I appreciate the time that you've given to this committee today and the evidence that you've provided for us. There have been a few questions taken on notice. Could you work with the secretariat and come back to the committee with your responses to those within the next two weeks. This concludes today's hearing. Thank you to all the witnesses who have appeared before us today. Thank you to Hansard and Broadcasting for their assistance. Committee adjourned at 17:18