Supporting responsible AI: discussion paper

4 August 2023

Technology Strategy Branch
Department of Industry, Science and Resources
GPO Box 2013
Canberra ACT 2601

By email: digitaleconomy@industry.gov.au

Australian Payments Network (AusPayNet) welcomes the opportunity to respond to the Discussion
Paper on Safe and Responsible AI in Australia.

AusPayNet is the industry association and self-regulatory body for the Australian payments industry.
We manage and develop standards and guidelines governing payments in Australia. Our purpose is to create confidence in payments by setting enforceable industry standards for a safe, reliable and effective payments system; leading transformation in payments to drive efficiency, innovation and choice; and being the home for ecosystem collaboration and strategic insight. AusPayNet currently has more than 150 members including financial institutions, payment system operators, major retailers and financial technology companies.1

Introduction
Artificial Intelligence (AI) has the potential to deliver significant benefits across all areas of Australia’s economy and society. The payments ecosystem has been using AI technology for a number of years to drive innovation, efficiency and safety for businesses and consumers. Many of the key use cases of
AI in payments are widely trusted and adopted by payment service providers, businesses and customers across Australia. These include:

▪ Fraud detection: AI-enabled tools allow payment service providers to analyse thousands of
transactions in real-time every second for criminal activity, without compromising the speed of
payments. AI allows for much greater accuracy and adaptability to new and evolving fraud
patterns than traditional rule-based fraud detection systems. Ongoing improvements in AI
technology and the increasing volume of data on digital and card-based payments continue to
benefit businesses and consumers, not only by mitigating a greater share of fraud but also by
reducing the number of false declines (which is a significant cost for businesses). This is
particularly important as economic crime continues to become more sophisticated and prevalent.
▪ Authentication: AI-supported biometric recognition is increasingly being used by customers to
authenticate mobile and online payments. Ongoing developments in AI are supporting increased
accuracy and performance of biometric authentication tools, as well as the development of new
methods such as behavioural recognition.

1
The views expressed in this submission are those of AusPayNet Management, and may not necessarily
represent the views of each of our members.

AUSTRALIAN PAYMENTS NETWORK LTD. ABN 12 055 136 519
Level 23, Tower 3, International Towers Sydney, 300 Barangaroo Avenue, Sydney, NSW 2000 | auspaynet.com.au |
▪ Efficiency: AI-enabled tools can help streamline and increase the accuracy of many payment
processes, for both payment service providers and businesses. This includes automating many of
the manual tasks involved in reconciliation, which can provide significant benefits for small
businesses in particular. AI can also be used for transaction routing decisions, which can help
reduce the cost of payments for businesses, and enable businesses to offer a more personalised
and convenient payment experience for their customers.
As AI technologies continue to evolve, we expect to see many new opportunities for AI enhancing both the payments ecosystem and other sectors of the economy and society. Some estimates suggest that
AI could add up to $26 trillion in annual economic value globally. 2

At the same time, the ongoing developments in AI also have the potential to generate significant risks if not designed and deployed responsibly. This can deter adoption and limit Australia’s opportunity to capture the full benefits of this technology. AusPayNet therefore supports the Government’s work on ensuring that Australia has clear and proportionate governance frameworks in place to mitigate potential risks while supporting the continued development and adoption of effective and trustworthy
AI technology.

AI governance framework
AusPayNet welcomes the Government’s commitment to establishing an AI governance framework that is able to address the risks posed by AI while fostering the continued development and adoption of these technologies. We agree that these two goals are not mutually exclusive. As a standards- setting body, AusPayNet recognises that appropriate governance mechanisms can support innovation and growth for the benefit of all stakeholders.

As evidenced by the range of regulatory frameworks currently being considered around the world, a best-practice approach to AI governance has not yet been determined. In part, this is because the potential opportunities and risks of AI technology are still evolving. Based on AusPayNet’s review of global approaches to AI regulation and our experience in developing and managing industry standards for the payments industry, we support a sector-based approach similar to that proposed in the UK.

Key aspects of our proposed AI governance framework are outlined below.

Sector-based approach

Under this approach, regulators would seek to proportionately address the risks posed by AI within their respective remits, in accordance with existing laws and regulations and guided by a set of cross- sectoral principles on responsible AI.

The risks associated with AI depend not only on the AI techniques used, but also the context in which they are used. For example, the risks associated with using facial recognition technology to authorise a mobile payment would be lower than when used for public surveillance. As the use of AI expands across the economy, a standardised regulatory approach for all use cases is unlikely to be effective. A

2
McKinsey & Company (2023), The economic potential of generative AI: The next productivity frontier, June.

AUSTRALIAN PAYMENTS NETWORK LTD. ABN 12 055 136 519
Level 23, Tower 3, International Towers Sydney, 300 Barangaroo Avenue, Sydney, NSW 2000 | auspaynet.com.au |
sector-based approach would give regulators the flexibility to tailor their response to the use and impact of AI for specific contexts within their areas of expertise.

It could also enable greater collaboration within and across sectors, under the supervision of the relevant regulators. For example, with the growing complexity in scams, fraud and money laundering
– often involving multiple financial institutions and payment networks, as well as other participants such as digital platforms, telecommunications companies, internet service providers, regulators and law enforcement – collaboration to identify and disrupt criminal activity is becoming increasingly important. As recently noted by the Bank for International Settlements, ‘a network view of payments data is essential to combat money laundering’, and public-private collaborative analysis and learning arrangements ‘are more effective in detecting money laundering networks than the current siloed approach (in which financial institutions carry out analysis in isolation)’.3 Pooling payments data across institutions – in compliance with relevant laws and risk management obligations set by the relevant regulator – could assist AI-enabled tools to better detect fraudulent transactions and thereby safeguard customers.

To ensure appropriate consistency of outcomes, as well as cross-sectoral collaboration, a sector-based approach should be supported by a set of cross-sectoral principles for responsible AI. These principles could potentially build off Australia’s existing AI Ethics Framework. Each regulator would be responsible for assisting businesses operating in the relevant sector in understanding how they may need to apply the principles in their AI activities.

Risk-based regulation

AusPayNet generally supports the principles of ‘same risk, same regulation’. However, the effective application of this principle requires a good understanding of the risks that the regulation seeks to address. As noted above, the risks associated with the use of AI can vary widely across different contexts. A high-level classification of all AI use cases into three risk categories based on human impact and reversibility could provide organisations with a simple way to understand their regulatory requirements. However, it could also hinder innovation and development in certain areas.

We therefore support context-specific regulation underpinned by a risk-based approach (noting that most regulators already adopt a risk-based approach to regulation). Specifically, regulators would be able to provide guidance on how to assess and mitigate the risks of different AI applications for organisations within their remit. This is particularly important where trade-offs might need to be made between different principles. For example, making an AI application simpler to make it more explainable can also make it less accurate and precise. And in some cases, the suggested risk- management requirements could actually lead to greater harm. For example, publishing details on AI- enabled fraud detection tools could assist criminal actors in evading those tools and thereby cause significant economic and social harm.

3
BIS (2023), Project Aurora: the power of data, technology and collaboration to combat money laundering
across institutions and borders, 31 May.

AUSTRALIAN PAYMENTS NETWORK LTD. ABN 12 055 136 519
Level 23, Tower 3, International Towers Sydney, 300 Barangaroo Avenue, Sydney, NSW 2000 | auspaynet.com.au |
Maximising reliance on existing legislation

Australia has generally adopted a technology-neutral approach to regulation, seeking to address outcomes rather than means. As noted in the Discussion Paper, many regulators are already applying their existing regulatory toolkit to address risks posed by the use of AI. We expect that many of the key concerns around AI could be addressed through existing legislation. This includes privacy, cybersecurity, data protection, anti-discrimination, product liability, and consumer and competition laws. As noted earlier, the payments industry has been safely using AI technology to improve end-user outcomes for many years, supported only by existing legislation.

Nevertheless, we acknowledge that as AI techniques and applications continue to develop, they may pose new risks that cannot be readily addressed by existing regulatory frameworks. We encourage regulators to continue their review of how existing regulations can address potential risks arising from the use of AI, and where adjustments or additional guidance may be required to provide greater certainty to developers, users and individuals. This includes ensuring that there are appropriate accountability measures in place if AI is used for harmful purposes, which is particularly relevant as AI is increasingly used to perpetrate scams, fraud and other criminal activities. The reviews and any changes to the legislation should be underpinned by the cross-sectoral principles.

Industry standards

As is the case with other technologies, some technical standards will likely be required to support the overarching outcomes-based regulatory framework. Such standards could be set either by industry standard-setting bodies or by the relevant regulators in consultation with technical experts.

We note the work currently being undertaken by the international standards committee responsible for standardisation in the area of AI, ISO/IEC JTC/1 SC42. We encourage Australia’s participation in global standards committees, and the thoughtful implementation of any resulting standards by the relevant regulators or industry standard-setting bodies in Australia. AusPayNet stands ready to assess any standards developed by the international working group to determine whether they should be adopted by the Australian payments industry.

Assurance mechanisms

AusPayNet welcomed the release of Australia’s AI Ethics Framework in 2019, and we note that several large organisations and government entities have recently made public commitments to ethical AI practices. However, there is little information on how widespread the understanding and implementation of the AI ethics principles is across the broader economy. Given the rapid pace of AI development, it is likely that many organisations do not have the knowledge or tools that would allow them to safely deploy AI in line with the ethical principles, or even manage their existing regulatory obligations in relation to their AI activities.

The provision of sector-specific guidance by the relevant regulators should help businesses using AI to understand and comply with their regulatory obligations. We encourage the Government to consider other measures to assist businesses in adopting AI technology, including the provision of tools to help test and verify that an AI-enabled system meets the necessary standards or requirements. Singapore, for example, has developed the AI Verify tool, which helps organisations validate the performance of their AI systems against the government’s AI governance principles through standardised tests.

AUSTRALIAN PAYMENTS NETWORK LTD. ABN 12 055 136 519
Level 23, Tower 3, International Towers Sydney, 300 Barangaroo Avenue, Sydney, NSW 2000 | auspaynet.com.au |
International cooperation and alignment

Given the cross-border nature of technology, global coordination on governance is important for facilitating the development and adoption of AI technologies. Diverging from global standards could restrict our ability to take advantage of AI technologies developed offshore and discourage investment in Australia’s own AI capacity and capabilities. AusPayNet therefore supports broad alignment of
Australia’s AI governance framework to those being developed and used globally, and welcomes
Australia’s ongoing engagement with other jurisdictions and multilateral bodies on this topic.

As part of this, we encourage Australia’s participation in global AI research and standards development initiatives. AusPayNet, for example, contributes to a number of global payments standard-setting bodies to ensure that the views of the Australian payments ecosystem are considered in the development of international standards. As globally recognised standards on AI are developed,
Australian regulators should then consider the applicability of those standards within their remits.

We acknowledge that a global consensus on AI governance is yet to emerge, with overseas jurisdictions adopting a range of different approaches to AI regulation to date. However, as noted in the Discussion Paper, there are some emerging trends. This includes a move towards risk- or outcomes-based regulation, underpinned by internationally agreed principles for responsible AI. This approach is broadly in line with our feedback provided above.

Conclusion
AusPayNet appreciates the opportunity to respond to the Government’s consultation on a governance framework for safe and responsible AI in Australia. This is a critical step in ensuring that the potential risks of AI can be mitigated appropriately, while promoting the continued development and adoption of AI so that Australia can realise the full benefits of this technology. AusPayNet looks forward to continuing our engagement with the Government as this work progresses over the coming years.
Please contact Kateryna Occhiutto, Head of Policy & Insights (kocchiutto@auspaynet.com.au) if you have any further questions.

Yours sincerely,

Andy White
Chief Executive Officer
Australian Payments Network

AUSTRALIAN PAYMENTS NETWORK LTD. ABN 12 055 136 519
Level 23, Tower 3, International Towers Sydney, 300 Barangaroo Avenue, Sydney, NSW 2000 | auspaynet.com.au |