| TASA s 30-10 Code item 6; TPB(GS) 55/2026 ¶¶23–25: client permission before AI use | What it means for an AI systemEntering client information into an AI tool can be a disclosure to a third party, depending on how the tool is configured and used, so client permission may be needed first. | How we design for itA data note says which providers see client data and where it's processed. | Evidence you getA one-page data note naming each processor, its region and its retention setting | SourceSource, as at 22 July 2026 |
|---|
| APESB Technical Alert (31 Oct 2025): APES 110 applies to AI use | What it means for an AI systemMembers using AI must keep meeting APES 110 and critically assess and verify AI-generated information, and the APESB says they should disclose and supervise AI use. | How we design for itEvery register field links to its page, so a reviewer can check it. | Evidence you getA register with a source-page link per field, and a test report listing every miss | SourceSource, as at 31 October 2025 |
|---|
| Privacy (Tax File Number) Rule 2015 ss 10, 11: use limits and safeguards for TFNs | What it means for an AI systemEvery holder of TFN information, whatever its size, may use or disclose it only for tax, superannuation or personal-assistance law purposes (or to give individuals their own TFN information), and must take reasonable steps to protect it. | How we design for itTFNs are masked before any model call unless the job needs the field. | Evidence you getA masking test result that lists any TFN left unmasked | SourceSource, as at 4 March 2015 |
|---|
| Privacy Act APPs 6 and 11: personal information entered into AI products | What it means for an AI systemFor practices the APPs cover (generally turnover over $3m; smaller ones only in listed cases), putting personal information into an AI product is a use or disclosure under APP 6, and APP 11 requires reasonable security steps. | How we design for itWhere the provider offers the setting, tools are set so it doesn't train on what you enter. | Evidence you getA region note stating where inference runs and what the provider retains | SourceSource, as at 17 January 2025 |
|---|
| AML/CTF Act s 28 (from 1 Jul 2026 for table 6 services): initial CDD for a trust customer | What it means for an AI systemA practice providing AUSTRAC-regulated services, such as setting up or restructuring a trust, must establish a trust customer's trustees, beneficiaries or their classes, and beneficial owners, among other matters. AUSTRAC names the deed and deeds of variation for verifying the trust's details, not individuals' identities. | How we design for itEach role links to its deed page; your AML/CTF compliance officer signs off. | Evidence you getA trust register with a page link per field, and an exception list | SourceSource, as at 5 May 2026 |
|---|