What CommBank's use of AI tells us about making innovation matter.

01 · CHOOSE THE PROBLEM

The use case is more important than the technology.

CommBank selected a problem that is significant, measurable and connected directly to customer protection.

The bank processes more than 20 million payments a day on average. Its fraud-protection systems monitor more than 80 million signals each day across transactions, card and online payments and digital banking interactions.

This gives the initiative a clear purpose. Detect suspicious patterns sooner. Improve the speed at which controls can respond. Help prevent customer harm.

Many AI programs begin in the opposite direction. A new capability becomes available, teams look for places to use it and disconnected experiments multiply.

02 · BUILD ON FOUNDATIONS

AI creates more value when it connects to real operating capability.

The agent was not introduced into an empty environment. It builds on CommBank's existing fraud-protection systems, real-time data, cloud-based core banking platform and specialist fraud analytics team.

When suspicious patterns are identified, the system assesses their severity, analyses the context and proposes new rules designed to help intercept emerging threats.

The bank reports that the agent has contributed to developing or updating three-quarters of its card-fraud rules.

The significance is not simply that the model can identify patterns. It is that the capability connects data, technology, workflows and people to improve how the organisation responds.

03 · KEEP ACCOUNTABILITY HUMAN

Automation does not remove responsibility.

CommBank states that proposed fraud-detection rules are reviewed and approved by its fraud analytics team before implementation.

This human-in-the-loop design matters. The technology can work continuously and analyse complex activity at speed, but people remain accountable for what enters the operating environment.

The bank's broader approach includes an AI policy, governance forums, risk-management frameworks, monitoring and annual reviews. Its stated principles cover fairness, transparency, privacy and data protection, reliability and security, environmental and social considerations and accountability.

Governance is most useful when it is built into the workflow rather than added after deployment.

04 · MEASURE THE OUTCOME

Activity is not the same as impact.

CommBank reports that its broader fraud-detection technology, which includes a range of AI capabilities, played a role in reducing fraud losses by more than 20% in the first half of FY2026 compared with the same period a year earlier.

That distinction is important. The result should not be attributed solely to the new AI agent. It reflects a wider system of technology, controls, people and customer interventions.

The bank also sends more than 40,000 proactive warning alerts to customers through its app on an average day.

Useful measures connect the technology to the problem it was introduced to address. They may include customer harm avoided, losses reduced, response time, accuracy, employee effort or the speed at which controls improve.

05 · DESIGN FOR ADOPTION

Innovation must become part of how the organisation works.

CommBank developed the fraud-detection agent through its in-house data science and engineering teams and integrated it with specialist fraud operations.

Its broader AI approach also includes workforce capability. The bank reports providing AI-focused training to more than 30,000 employees and has established governance and practical guardrails to support adoption.

Technology alone does not change an organisation. People need to understand when to use it, how to interpret its output, where judgement remains essential and what they are accountable for.