Map the insurer's ASIC, APRA, GI Code and Privacy Act claims-handling obligations
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- From the client's claims process and policies, table obligations under ASIC RG 271, the GI Code, APRA CPS 230 and Privacy Act APPs, listing current instruments to check.
- What the lawyer must review
- Check CPS 230 (from 1 July 2025; amendments 30 April 2026; revised standard and CPG 230 from 1 July 2026)
- Confirm AI vendors' material service provider status against the current Attachment
- Note ASIC's December 2024 sweep found every reviewed insurer non-compliant with at least one RG 271 obligation
- Check APP 1.7 automated-decision disclosure (from 10 December 2026) and OAIC guidance (expected by September 2026)
- Check the current General Insurance Code on the Insurance Council of Australia site
- Note the revised Code (consulted Q1 2026) is expected to go to ASIC mid-2026
- Apply CPS 234 to AI cyber-risk governance
- Written for / version
- Commonwealth versionCth
Rules that apply
The document starts from the task name. Change it if this piece of work is different.
Who does what
| Role | What they do |
|---|---|
| Assistance | Potential support includes identifying points for review. Confirm the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.