---
title: "Conduct AI product due diligence for privacy"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/conduct-ai-product-due-diligence-for-privacy"
type: "task"
site: "AI Law Framework"
id: "A25-B6-2"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["AU"]
last_reviewed: "2026-10-10"
---

# Conduct AI product due diligence for privacy

> Assess a commercial AI product's data handling.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/conduct-ai-product-due-diligence-for-privacy  
Last reviewed: 2026-10-10

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Assess a commercial AI product's data handling. |
| What the lawyer must review | Ongoing review, not set-and-forget. |
| Written for / versions | Australia |

## Checking plan

**Source-by-source verification**

Trace relied-on content to independent sources and check for relevant material the output has missed.

- What the AI does: Assess a commercial AI product's data handling.
- What the lawyer does: Ongoing review, not set-and-forget.
- Who reviews: Lawyer competent in the matter and the forum
- Basis: Planning guidance checked against the linked public sources on 10 October 2026. Confirm the current instrument before reliance.
- Why: The traffic light follows the consequence of an error and how much of the output the lawyer must check before it is used.
- Written for: AU

## Checks the lawyer makes

1. Open the cited source and confirm it is the current instrument for this forum and this date.
2. Ongoing review, not set-and-forget.
3. Compare the output with the source and the instructions, including material the output left out.
4. The responsible lawyer approves the exact output for its intended use, or sends it back.

## Notes

- Suggested working checks from the linked public sources. Read the source and confirm it applies to this forum and this date. The checks do not approve software or record that the work is done.

## Practical guide

Jurisdiction: Australia

**Deliverable**: Conduct AI product due diligence for privacy

**Inputs**

- OAIC: commercially available AI products
- CG Law: privacy and AI
- The matter instructions and the documents the output will rely on.

**Example**: Stop before the result is filed, sent or relied on. Ongoing review, not set-and-forget.

**Stop and escalate when**

- The cited source is not the instrument that applies to this forum or this date.
- The output states a fact, date, citation, figure or commitment that is not in the instructions or the source.
- The responsible lawyer has not approved the exact output for its intended use.

Checked 2026-10-10.

## Sources

- [OAIC: commercially available AI products](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products) (checked 2026-10-10)
- [CG Law: privacy and AI](https://www.cglaw.com.au/privacy-ai-how-much-does-your-ai-know/) (checked 2026-10-10)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*