APRA has been tub-thumping all year about AI and cyber risk, saying governance is lagging dangerously behind adoption.