--- title: "OAIC guidance on commercially available AI products" url: "https://ailawframework.com/frameworks/oaic-commercial-ai-products" type: "framework_note" site: "AI Law Framework" issuer: "Office of the Australian Information Commissioner" status: "The guidance itself is not binding. The Privacy Act is, for APP entities, and this guidance explains how the OAIC reads it. It gives no new duties to a firm that is not an APP entity." checked: "2026-10-10" --- # OAIC guidance on commercially available AI products > OAIC guidance, published 21 October 2024 and updated 17 January 2025, on privacy obligations when an organisation uses a commercial or public AI product. Canonical page: https://ailawframework.com/frameworks/oaic-commercial-ai-products Checked: 2026-10-10 Site index for agents: https://ailawframework.com/llms.txt The guidance itself is not binding. The Privacy Act is, for APP entities, and this guidance explains how the OAIC reads it. It gives no new duties to a firm that is not an APP entity. OAIC guidance, published 21 October 2024 and updated 17 January 2025, on privacy obligations when an organisation uses a commercial or public AI product. This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard. ## What it is The OAIC’s guidance is for organisations deploying AI systems that were built with, or that collect, store, use or disclose, personal information. The OAIC defines a deployer as any individual or organisation that supplies or uses an AI system to provide a product or service, including internal use. It is aimed at commercially available products, and it also addresses free public chatbots. The OAIC says the guidance is not a complete account of every privacy risk, and that it should be read with the Privacy Act and the APP Guidelines. It says the Act applies to all uses of AI that involve personal information. The guidance is particularly aimed at generative AI, general-purpose tools, and other uses with a high risk of adverse impacts. ## Who it applies to The guidance assists organisations that have Privacy Act obligations. A firm that is not an APP entity is not given new Privacy Act duties by this guidance. The OAIC’s best-practice warning about public generative tools is still worth reading, because the conduct rules on confidentiality do not depend on the turnover test. ## What it asks of a law firm using AI - The OAIC’s first takeaway: privacy obligations apply to personal information put into an AI system, and to output that contains personal information. Due diligence before adoption should cover whether the product has been tested for the intended use, how human oversight is built in, privacy and security risks, and who can access personal information the entity inputs or that the product generates. - As a matter of best practice, the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. - If the system generates or infers personal information, including an image, the OAIC says that is a collection and must comply with APP 3: reasonably necessary, and by lawful and fair means. Inferred, incorrect or artificially generated information about an identified or reasonably identifiable individual, including hallucinations and deepfakes, is personal information. - APP 6 limits use and disclosure to the primary purpose unless an exception applies, including consent, or a secondary use the individual would reasonably expect that is related to the primary purpose (directly related, for sensitive information). The OAIC says that, given the risks, it may be difficult to establish that an AI secondary use was within reasonable expectations. Where it cannot be clearly established, the OAIC says organisations should seek consent or offer a meaningful opt-out, to avoid regulatory risk. - APP 10 requires reasonable steps on accuracy. The OAIC says AI systems are known to produce inaccurate results, especially generative systems, which are probabilistic and do not understand the data. Steps should match the risk, and can include a disclaimer that states the system’s limits. - APP 11 applies to the security of personal information the entity holds. The OAIC says to consider where servers are located and whether personal information could be disclosed outside Australia. It says deploying locally or on premises is likely to be more privacy-preserving because it limits third-party access. That is the OAIC’s comparative statement, not a rule that cloud use is prohibited. - Update privacy policies and notices so the use of AI is clear, and identify public-facing tools such as chatbots as AI. The OAIC also recommends a privacy impact assessment. Due diligence is not “set and forget”: review the product, train staff, and monitor through the product’s life. ## How it maps to this framework | This site’s question | What the instrument says that bears on it | | --- | --- | | Efficiency: Whether the tool saves total human work at the quality the task needs. | The OAIC notes that AI can improve efficiency and productivity. It also says products should not be used simply because they are available, and that the use of personal information has to be necessary and the best solution in the circumstances. A faster draft is not a privacy answer. | | Effectiveness: Whether the output is good enough for the task. The catalogue does not score this. | APP 10 is the effectiveness point in this guidance: the firm must take reasonable steps so that personal information it collects, uses and discloses is accurate. Testing the product for the intended use, and understanding its training data, are part of that. Legal correctness of advice is still the lawyer’s job. | | Due diligence: What the firm has actually read about hosting, training and assurance before it relies on the tool. | The guidance is a due-diligence document. It asks whether the product was tested for the use, who can see the information, where it is processed, and whether personal information will be used to train the product. This framework’s due-diligence level is the firm’s reading of those points. | | Confidentiality: Whether client and other confidential information can go into the tool. | The best-practice recommendation against putting personal information, especially sensitive information, into a public generative tool is the privacy version of the profession’s warning about public chatbots. Client confidential information that is not personal information is outside this sentence and inside the conduct rules. | | Disclosure: When the firm tells the client, and where required the court or another party, that AI was used. | The guidance says privacy policies, collection notices, and labelling of public chatbots should make the use of AI clear. That is transparency to people whose personal information is handled. It is not, by itself, a rule that every retainer must announce the tool. | | Certifications: ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | The guidance tells organisations to assess the provider’s security measures. It does not say that an ISO or SOC report closes the APP 11 question. | | Data residency: Where the tool holds data, including whether that place is recorded as Australia. | The OAIC tells organisations using a cloud deployment to consider where the servers are and whether personal information could be disclosed outside Australia. Record the region. Then read APP 8 if there is a cross-border disclosure. | ## Sources - [OAIC, Guidance on privacy and the use of commercially available AI products](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products) ## Related pages - [Privacy Act 1988 and the Australian Privacy Principles](https://ailawframework.com/frameworks/privacy-act-and-apps.md) - [Notifiable Data Breaches scheme](https://ailawframework.com/frameworks/notifiable-data-breaches.md) - [Voluntary AI Safety Standard](https://ailawframework.com/frameworks/voluntary-ai-safety-standard.md) - [Engaging with artificial intelligence](https://ailawframework.com/frameworks/engaging-with-artificial-intelligence.md)