---
title: "Prepare the file note deciding whether an AI-tool incident is a notifiable data breach"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/prepare-the-file-note-deciding-whether-an-ai-tool-incident-is-a-notifiab"
type: "task"
site: "AI Law Framework"
id: "A25-B15-4"
practice_area: "Privacy, Data Protection & Cyber"
tier: "red"
lawyer_review: "required"
jurisdictions: ["CTH"]
last_reviewed: "2026-10-22"
---

# Prepare the file note deciding whether an AI-tool incident is a notifiable data breach

> Set out the incident facts from the log. Do not decide whether notification is required.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/prepare-the-file-note-deciding-whether-an-ai-tool-incident-is-a-notifiab  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Red: Lawyer writes; AI may check, clarify or collect data |
| How AI is used | Set out the incident facts from the log. Do not decide whether notification is required. |
| What the lawyer must review | The lawyer decides, using the incident log and the OAIC notifiable data breaches page. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Lawyer-led judgement**

The file note has to stay with the incident log and the OAIC notifiable data breaches page. A generated note can invent who was affected or decide that notification is required. The lawyer makes that decision.

- What the AI does: Set out the incident facts from the log. Do not decide whether notification is required.
- What the lawyer does: The lawyer decides, using the incident log and the OAIC notifiable data breaches page.
- Basis: Checked against the linked public source on 10 October 2026.
- Written for: AU

## Notes

- Forum: Office of the Australian Information Commissioner. Document: File note on whether an AI-tool incident is a notifiable data breach.
- Main AI risk: The file note has to stay with the incident log and the OAIC notifiable data breaches page. A generated note can invent who was affected or decide that notification is required. The lawyer makes that decision.

## Sources

- [OAIC: Notifiable data breaches](https://www.oaic.gov.au/privacy/notifiable-data-breaches) (checked 2026-10-10)
- [Privacy Act 1988](https://www.legislation.gov.au/C2004A03712/latest) (checked 2026-10-10)

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/privacy-data-protection-and-cyber/prepare-the-file-note-deciding-whether-an-ai-tool-incident-is-a-notifiab/united-states.md) | Red |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*