BIRMINGHAM, Mr Simon, Chief Executive Officer, Australian Banking Association [by video link] YANG, Mr Kai, Group Chief Data and AI Officer, Technology, ANZ Bank [by video link] [15:39] CHAIR: Welcome. I understand that information on parliamentary privilege and the protection of witnesses giving evidence to this inquiry has been provided to you. I'd now like to invite you to make a short opening statement, at the conclusion of which we will invite members of the committee to ask some questions. Perhaps we'll start with you, Mr Birmingham. Mr Birmingham : Thanks very much, Chair, and the committee, for the opportunity to be with you today. Australia's banks are not approaching artificial intelligence as a distant prospect; indeed, as you've already heard, it is already at work in our industry every hour of every day. It is checking payments in real time, answering customer questions at two in the morning, helping staff recognise a customer in financial stress during a live call and stopping money reaching criminals before it leaves an account. The opportunity for Australia is significant. Independent modelling puts AI's potential contribution at up to $116 billion in additional GDP by 2036, with a net gain in jobs possible. More importantly, it offers a way to lift productivity, after two decades of weak performance. On current settings, we are on track to capture around half of what widespread adoption could deliver. Closing that gap is the potential prize. So our first message is simple. Australia should back adoption, investment and innovation, and back Australian capability so more of the value is built and kept here where possible. Recently, the ABA and many of our member banks joined the Buy Australian AI Partnership. It will create a new pathway for ambitious Australian AI companies into the nation's banking sector and more broadly. This will help bridge the gap between home-grown AI capability and enterprise demand. Banks are investing in their people through that change, too, pairing new tools with training. Government has a role as well: building AI skills into existing vocational and tertiary pathways and helping small and medium businesses adopt with confidence. Change also brings questions about data, privacy, bias, cyber-resilience and accountability. These are serious questions. They're also familiar ones to banks. Banking already operates under an extensive, technology-neutral regulatory framework. APRA has set clear expectations already on AI governance, information security and third-party risk, without needing an AI-specific standard. ASIC, similarly, is exercising its existing powers, having announced a review of how banks are using AI and what that means for customers. There is, however, a different kind of risk that does warrant the committee's close attention. The people who defraud Australians will never appear before this committee. They are largely offshore. They answer to no regulator. And they are already using AI. They generate fake pay slips, bank statements and identity documents at scale. They are cloning faces and voices. Increasingly, they will deploy autonomous agents that probe systems, impersonate customers and adapt faster than any human team could. That threat cannot be met with yesterday's tools. The only effective response to AI used at scale against Australians is AI used at scale in their defence. Banks are already doing this. One bank alone screens 20 million payments a day and sends more than 40,000 real-time warnings to customers, contributing to a fall in fraud losses of more than 20 per cent. Some banks are deploying AI bots that engage scammers, gather intelligence and disrupt their networks. In this contest, banks stand on the nation's frontline. We cannot defend Australians, though, with one hand tied behind our back. So we ask the committee to recommend that, if there is to be any high risk classification or AI-specific obligation, it expressly preserves the use of AI to detect scams, fraud, financial crime and financial abuse. Transparency obligations should not require us to reveal how those systems work, because that would simply hand criminals a blueprint. Government can also strengthen those defences, with a verifiable digital identity available across the economy, and by sharing ATO income data through the Consumer Data Right so a lender can confirm who someone is and what they earn at the source, not through documents that AI can fabricate. Where genuinely new risks are emerging, such as AI agents transacting on a customer's behalf, we want frameworks on questions such as responsibility and liability built early, before volumes of those agents' use scatter. Left unchecked by rules written for a different time, these agentic systems will spawn new risks and new pathways for potential scams, fraud and data breaches. I will close with this. The capability that protects Australians is the same capability that will lift productivity, improve services and widen access. The data, the skills, the compute and the expertise are the same. We must build that capability to defend ourselves. Having built it, it would make little sense to deny Australians its benefits. As a nation, we cannot opt out of AI. The question is whether we shape it with confidence or leave others to shape it for us. Australia's banks want to help lead and, as I think you've heard, are leading. We look forward to working with the committee and the government to make that possible. CHAIR: Thanks, Mr Birmingham. Mr Yang. Mr Yang : I have no opening statement, so we can go straight to questions. CHAIR: Excellent—wonderful. Thanks for those opening remarks, Mr Birmingham. I think you've set the scene well in terms of where we are at the moment—the opportunities but also the real risks that are in front of us as a nation. I appreciate the financial sector—our banks in particular—is at the forefront of that. You articulated the threats that are posed by AI enabled activity, the threats of the scammers being able to have the tools that give them greater capacity. Where do we need to be when it comes to staying at the front line, on the frontier of the opportunities that Australia has at present with the interest that the hyperscalers have in investing and bringing their training models and capabilities to Australia? What are your reflections on the importance of that when it comes to the capabilities of our financial institutions, in particular, to remain at the forefront when fighting some of those significant threats that you've highlighted? Mr Birmingham : I spoke about the fact that the prize for Australia is to seize as much benefit from this transformation as possible, and that benefit can flow in a number of ways. One is risk management, absolutely. AI will unquestionably, as I spoke of, be weaponised by criminals and others against Australia and Australian companies and interests. That threat is best managed by fighting back using that tool. So that's one part. The other is in terms of how our companies seize the opportunity. The question of sovereignty that you've touched on and that you've asked others questions about applies, arguably, to all aspects of the Australian economy. If our businesses, our industry sectors and our government don't use this tool to be as close to the cutting edge and as innovative as possible, then we run the risk of losing sovereign capabilities in those industries and those sectors. So reliable, safe, legal access to tools is important to maximise the productive economic benefit across all sectors and to preserve the sovereignty and the capability across those sectors. Lastly is the piece that you also touched on, in terms of the role we can play in terms of the development of those tools in Australia. I referenced the Buy Australian AI Partnership Program that the government has launched as a welcome initiative elevating the knowledge that there are AI tools that are Australian developed, owned and operated and that they will continue to grow in scale and availability. Again, you heard good examples of how they are being deployed by banks and by others. And that will increasingly occur. But we also want to make sure that at that leading edge of AI that if there is a role we can play we do so, because that enhances our place in that ecosystem and therefore enhances our sovereignty. It's not just the productive benefits we can get but the security of access we can have as well. So concepts like the role of data centres and the potential for testing and training of systems in Australia are important. An analogy I like to draw on—which I'll just close this question with—is that, if we think about the longstanding role Australia has played in the pharmaceutical sector, we have often been seen as a preferred destination by pharmaceutical companies, particularly American pharmaceutical companies, for the testing of their new pharmaceutical products. They do so, of course, not without having to first meet regulatory standards and safeguards—we don't let anything be tested on Australians—but they do so because we provide a sound rule of law, protection for their IP and a consistent, reliable environment for such testing to be undertaken. I think that analogy can be drawn into how we think about frontier AI models and the type of approach that could be taken to successfully enable their training and testing in Australia as well and to seize the benefits of that. CHAIR: Thank you, Mr Birmingham. Deputy Chair. Senator DUNIAM: Thank you, Mr Birmingham. It's good to see you and odd to call you 'Mr', as I was just saying to a colleague on the committee. But there you go. Here is my simple question to you as a former legislator. This committee has a golden opportunity to provide to government recommendations for what should happen in a very short form in order to facilitate the arrangements to take advantage of the opportunity, to ameliorate risk and to increase take-up in the private sector and the community sector and by individuals as well. If you had a blank bit of paper and you were saying, 'Government, this is what you should do to put in place what needs to be done,' not just from your sector's point of view but more broadly, what would your advice to us be in providing that guidance to government? Mr Birmingham : Thanks, Senator Duniam. Senator DUNIAM: Not for long—a couple of weeks. Mr Birmingham : It is nice to see you and others virtually again too. The first point I'd make, which we stress particularly from a banking industry perspective, is that, wherever possible, governments should regulate standards and conduct, not technology, because ultimately individuals and corporations are responsible for those standards and that conduct. In the opening statement, I gave examples of the fact that APRA and ASIC, as two of our banking industry's most significant regulators—our prudential and conduct regulators—are already well positioned in terms of having structures and powers to regulate standards and conduct without defining the technology and its place. They're already looking at AI and its impact, but they are doing that within those existing frameworks, without creating new regulation or requiring new laws. I think that is an important starting point, because otherwise we will overburden the economy with regulation. In the broader sense, again, obviously you touched on some areas that perhaps do stand out to us: risk factors like the use of agentic agents intersecting with the financial system, and being clear about where liability and responsibility sit. Ultimately, it's easy to start that conversation on the premise that, if somebody clicks 'yes' to give access to an agentic agent to do things in their bank account, surely that individual is responsible. But there will quickly be deeper questions about how that may perhaps play through, and they're ones that, as an industry, we stand ready to work with government and regulators to try to assess before we see such agents deployed at scale by consumers or others. More broadly—to your question on that one blank sheet of paper—I think, again, the standard we have always deployed is that responsibility has to sit where, logically and appropriately, it is authorised by an individual or a corporation. That means, in some cases, AI companies themselves may well be, and should be, responsible where their tools act in a manner that is not what somebody has authorised and that creates harm as a result. That clearly means responsibility sits there. Of course, if their tools are used by others in a manner where those others are seeking to cause harm, the primary responsibility lies with those others, such as in the case of fraudsters and scammers. Fraudsters and scammers have always sought to use whatever the nearest and most available tool is for them. They are the ones who are primarily responsible. But it doesn't absolve others from doing what they reasonably can to prevent that fraud and those scams. I'll close here. I know you heard a reference before to the Scams Prevention Framework. As an industry, a banking industry, we welcome the fact that the parliament legislated to bring telco companies and digital platforms into an ecosystem of regulation there. We see that as really important because they can play a role in helping prevent scams, just as we can play a role in helping prevent scams. None of us is a perpetrator of those scams, and so the ultimate responsibility lies with the perpetrators. But, if we can reasonably be expected to play a role in preventing that wrongdoing, then we should be expected to undertake that. That same sort of test needs, ultimately, to apply in relation to AI companies too. Senator DUNIAM: Thank you very much, Mr Birmingham. Thank you, Chair. CHAIR: No worries—I'm glad to help facilitate a catch-up between former colleagues! Senator DUNIAM: That's why I'm here! Mr Birmingham : It happens to us all, eventually! CHAIR: Ms Chaney. Ms CHANEY: Mr Birmingham, you've said reliable and safe access to AI tools is needed. There are a lot of people and businesses that are experimenting with AI, but there is pretty widespread concern in the community about some of the longer-term risks, whether it's misuse or misalignment and including deepfakes, bioweapons, cognitive offloading and rogue agents. What safeguards do you think need to be put in place in order to build trust so that people feel that they can take the opportunities up safely? Mr Birmingham : Thank you. I absolutely acknowledge that some of the concerns really are very deep. I think that is a challenge for the country, too, and I'll come to that in a second. To address your question directly, I think it really flows on from the answer to Senator Duniam. Community confidence won't be achieved by having a maze of widespread, intersecting legislation or regulation that doesn't really know what it's targeting. The community needs to be clear that we have frameworks where the buck stops at those who are responsible and that there are expectations that they meet all reasonable laws and standards and take reasonable steps to ensure tools are not misused by others, in terms of a potential breach of those laws and standards. The community needs confidence that we are investing as a country in getting the best out of this and the transition of skills and capabilities that are necessary to it. I suspect that, for all the concern Australians have and the worry that exists—and I think it's commonplace around the world—most Australians also instinctively know that it's not something we can sidestep as a country. If we were to simply seek to dramatically restrict use of AI in Australia, then it would simply be used against us—used against us competitively and used against us by scammers, fraudsters et cetera. Ms CHANEY: I don't think anyone's proposing that, really. Mr Birmingham : No. Ms CHANEY: In terms of regulations, things that have come up this week have been things like DNA screening to reduce the risk of bioweapon development, critical-incident reporting on frontier models so that we know what's happening and when, and predeployment access to models so that we can do safety testing ourselves. Do you see those as being parts of a web of regulation that is going to restrain things, or do you see those as necessary safeguards to build trust? Mr Birmingham : No. I think that, in some of those, we will find that there already are very precise or close models that we should add to, if necessary. With that, I'm thinking about notification in relation to serious incidents and breaches. All of our major members are regulated under the Security of Critical Infrastructure Act., They have obligations in relation to alerting around critical incidents and engage very seriously with the ASD, which then has a framework for that information to be shared across the ASD networks so— Ms CHANEY: Which could do with a bit of updating, though, right? We've also heard some evidence that the SOCI Act does actually need a bit of updating to make sure that it includes AI risks. Mr Birmingham : Yes. I think that is absolutely worth teasing out. I'm not going to pretend to offer an expert opinion on that, but I would always listen very carefully to what ASD thought was necessary in relation to those particular legal frameworks. I obviously gave an example of where we don't have a precise sense yet of how we want to ensure it is legislated or the framework aligns, but that use of agentic agents potentially intersecting with banking systems and financial systems is one where we can see it may not clearly be a role for legislation. It might be able to deal with it within existing regulatory frameworks, but it's a question that we can see is a risk that we need to answer. So there definitely are case points that are relevant in terms of potential risk that legislators and governments have a role in looking that. We say that that primary approach should be legislating for outcomes and standards in a technology-neutral way. But where it's necessary for access to information and where it goes specifically to ensuring that those designing technology are responsible—at least for what they can do to uphold standards—that's perfectly reasonable. As a last point, I do think what is really important to stress in the midst of this debate is that we'd also like to play a role in trying to lift some community hopes in relation to AI. If, as a country, our entire outlook is driven by the fear and the concerns, that's really going to be harmful, I think, to not only attitudes but also approaches and interests of people to study, to engage and to do the things that would be necessary to get the best of it. We know that one area where people are most enthusiastic about banks using AI is to fight scams and fraud. As part of our responsibility in the banking space, the more we can actually explain how we are doing that, the more it opens the door to the next thing, which is that we can probably cut call waiting times and give faster, better, more accurate answers through the use of these tools—and Centrelink can do likewise and so forth. So how do we make sure we're building that sense where people can see real benefits in terms of this experience and their product experience but where we're also managing the risks? Obviously, you've got to do both together. Ms CHANEY: Yes. But it sounds like you are recognising that. You've mentioned that governments should regulate standards and conduct rather than technology. Regulating conduct makes sense when you're talking about humans, but when you're talking about agentic AI, which is really this next phase of AI that the developers are saying needs the slowdown, it does completely change how we think about allocating liability and responsibility and regulating conduct. There probably are some novel spaces where regulation and certainty is required, because we are facing novel problems that don't easily fit into our existing regulatory framework. Would you agree with that? Mr Birmingham : I think there will absolutely be some. We've just got to make sure that we run the test first to ensure that a company is responsible for how it uses AI. In the case of a bank, the financial accountability regime ensures that those bank executives are also accountable, just as company directors are accountable through different frameworks. Ensuring where we have frameworks that do drive that accountability back to individuals making decisions—because individuals, overwhelmingly, should be controlling those decisions, absolutely. But, in use cases where individuals have made those decisions, and the machine has acted—because of the way it has been constructed, built and set in the market—in ways contrary to what was foreseeable et cetera, then, of course, taking that back to those designs becomes a principle that is worth considering. Ms CHANEY: When you're moving to a world where we have a one-to-10 billion span of control in terms of decision-making, that human accountability does start to look quite different. But I agree; start with the frameworks that we have and build on them. That's all from me. CHAIR: Senator Sheldon. Senator SHELDON: Mr Yang, I note you haven't given us an opening statement. ANZ haven't given us a submission either. First thing—is there any reason why you haven't given us an opening statement? Mr Yang : We've been participating in the ABA submission. Senator SHELDON: No, I'm talking about an opening statement to this inquiry. Is there an opening statement to this inquiry that you're able to give us? Mr Yang : No, but I can if you want me to, just briefly. Senator SHELDON: You might do it briefly. That would be helpful. Mr Yang : From an ANZ perspective, my view and our view in terms of the position of AI is that there are three key components. Firstly, there's the opportunity for us to enable and to better service our customers, leveraging AI. Secondly, there's an opportunity for us to improve the productivity of an enterprise like ANZ, as well as, if we extrapolate up, the country. Thirdly, we also have the opportunity to strengthen our risk management to better protect our customers. Protecting the customer's data and resilience and building trust are fundamental to banking, and we believe that AI can support that and can help enable that and support us in terms of execution of our commitment to our ANZ 2030 strategy objectives, which fundamentally are about making sure we live up to the customer's expectations, as well as those of our shareholders, and the betterment of our communities. Senator SHELDON: Mr Yang, is there any reason why we haven't got a submission from ANZ to this inquiry? Mr Yang : It was just the position that we participated in the ABA submission, and I've personally been involved in that. Senator SHELDON: So was it your decision, or was it somebody more senior in the organisation who decided it wouldn't be of assistance to this inquiry? Mr Yang : It was a decision that was made together with Public Affairs. Senator SHELDON: Did it escalate above Public Affairs? Mr Yang : That I'm not aware of. Senator SHELDON: Can you find out for me—take that on notice, for starters? Mr Yang : We will, thank you. Senator SHELDON: It's really important, particularly being one of the big four banks, that people are open and accountable. That's why I wanted you to make an opening statement. But it's also why it's important that a submission be presented to this committee. It gives all the participants an opportunity to properly recognise or value what ANZ are really saying, not just what they're being forced to say. Then we can also turn around and properly analyse those comments. People who don't make submissions sometimes do it for a reason. Not giving us an answer is not particularly helpful at all to this committee—to me, anyway. I'll let the other committee members speak for themselves. Not making a submission goes to transparency issues at ANZ. Thank you for eventually giving me and the committee an opening statement. I understand that the consultative committee process that occurs, certainly, with the three other big banks—that they have a useful forum with employees and their representatives. They got involved in the deployment of AI in their workplace. They make sure that there are elected representatives of the workplace. People might feel sometimes reluctant to talk to a manager, but they'll talk to one of their colleagues. That's a virtuous circle for trying to find out information from senior management. I won't speak specifically on behalf of the three banks, but I think the evidence they've given goes to that point. But, for some reason, the ANZ is refusing to have elected representatives from the Finance Sector Union on the consultative committees. Is this another technique of hiding information or not consulting properly, whether it be with this committee or with your own workforce? Mr Yang : This is not what I'm aware of, unfortunately. But what I can say is that, if there are any major workforce changes, and due to technology changes, such as AI, we absolutely do make sure that our people are consulted, as well as the FSU. Senator SHELDON: So that means you are consulting—that, contrary to what I just said, you are consulting with the Finance Sector Union, or that you just don't know? Mr Yang : I can take that on notice. But, in terms of workforce changes that are major, we do consult with the FSU. Senator SHELDON: What we're talking about is a regularly ongoing consultative process. You don't know whether that actually occurs? You have elected representatives being able to talk directly with senior management. I know the other three banks are doing it. I want to give you an opportunity to set the record straight, if I've got it wrong, but I understand very clearly that the FSU is not included, unlike the other three banks. I understand that a number of banks, including ANZ, have been offshoring their technology teams, at various times, and it has been reported that ANZ has 11,500 workers in technology hubs in India and in the Philippines, and on the ANZ's website your group capability centre in Bengaluru—correct me if I'm wrong—in India, is described as your largest banking operations and technology capability centre outside Australia, with more than 7½ thousand full-time employees. Your website goes on to say, as to that Indian site: ANZ Bengaluru drives the transformation initiatives of the Bank. We are the early adopters of Business Automation, Machine Learning … Are these offshore hubs critical to your development and deployment of AI tools in Australia? Mr Yang : It's a technology organisation within ANZ. We are a global bank. We operate in over 20-odd countries and jurisdictions, and India is particularly one of those. In terms of Bangalore, we've been there—I think we were one of the first banks to sit a centre there, from a technology centre perspective. What we do is make sure that we can have the right talent and capability, particularly in terms of AI as well as all the other technology skill sets, to better serve our customers and our community— Senator SHELDON: Can I just cut to the chase: are these offshore hubs critical to your development and deployment of AI tools in Australia? Mr Yang : It supports our development of our capability to better support our customers in Australia. Yes. Senator SHELDON: If you have 11½ thousand workers at your offshore tech hubs, out of a global workforce of about 40,000, then that's more than a quarter of your headcount. Are the job opportunities that AI creates at ANZ Bank going to be created here or overseas? Mr Yang : Firstly, what I want to say is that there are no job losses due to AI. What I do see, in my position as the chief data and AI officer, are opportunities that are created through AI. As I've said, we're making a significant amount of investment into AI and making sure we can train our people by having the right academy, from a skills, training and certification perspective, for all our employees, globally—including Australian employees, obviously, as well as those offshore, such as in India. We're making sure that people are getting the right level of proficiency using new powerful tools, such as AI, again, to support our customers, to help simplify the bank through automation, or to strengthen our cyberdefence and fraud-control capabilities as well. Senator SHELDON: I'm just not clear. Are AI jobs being created here or overseas? And what numbers are being created here or overseas? Mr Yang : In terms of the AI practice, under data and AI that are run, we have over a thousand employees, and it is a balance, in terms of the mix, because we are a global operation across— Senator SHELDON: It would be helpful if you are able to give me the actual numbers that have been created here or overseas. Mr Yang : I can take that on notice. Senator SHELDON: So you haven't got the answer to that either? Alright. There have been issues to do with NAB and the Commonwealth Bank which I and others have raised. Issues on the rollout of AI and its effect on the workforce have been in the media over the last 18 months. To the credit of both banks, once those issues were dealt with, they came up with solutions with their workforce and representatives. From the reports that the banks gave this week, and comments since those settlements have been reached, that made the AI rollout a lot more competent. It doesn't mean there aren't challenges. I think both banks identify those challenges just as the workforce does. There was a cooperative approach. I'm deeply concerned about the lack of cooperative approach at ANZ and also the lack of transparency. I'm particularly concerned about what the numbers are of people that are actually being trained to use AI within this country and overseas. I'm particularly concerned about the representative rights to try to get matters better dealt with because when you get it wrong at ANZ—and I mean you personally—then you get it wrong for the entire country and all your customers, including your staff. I'll leave it there. CHAIR: That brings an end to this session and to today's hearing. Thank you very much, Mr Birmingham and Mr Yang, for appearing before us today. Could you provide any additional information that's been required or asked of you on notice to the secretariat within the next two weeks. Thank you for making yourselves available to answer our questions. Thank you to all the witnesses that have appeared before us over the course of today and this week, and to Hansard and Broadcasting for their impeccable assistance. Committee adjourned at 16:16