---
title: "Technology, Media & Telecommunications / IT Contracts"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts"
type: "practice_area"
site: "AI Law Framework"
id: "A24"
task_count: 24
last_reviewed: "2026-10-10"
---

# Technology, Media & Telecommunications / IT Contracts

> Make the service, data flows and commercial responsibilities explicit. Check the complete contract for licence scope, security, data use, service levels, liability and exit arrangements.

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts  
Last reviewed: 2026-10-10

Site index for agents: https://ailawframework.com/llms.txt

Also covers: TMT law; technology law; IT law; digital transactions; tech contracting; software licensing; SaaS/cloud contracts; outsourcing agreements; technology procurement; Consumer Data Right (CDR) agreements; digital platform regulation

## Key facts

- Tasks: 24
- Green: 5, Yellow: 19, Red: 0
- Levels: Green is AI drafts and the lawyer checks; Yellow is lawyer and AI draft together; Red is the lawyer writes and AI may only check, clarify or collect data.

## Principles

- **Define the matter**: Confirm the client’s instructions, jurisdiction, intended output and the information available before dividing the work.
- **Verify the authorities**: Open each relied-on authority independently. Confirm its existence, current status, proposition and any quotation or pinpoint reference.
- **Reconcile the figures**: Trace every relied-on figure to its source, confirm dates and assumptions, and independently recalculate totals or derived amounts.

## Checklist

- Open each relied-on authority independently. Confirm its existence, current status, proposition and any quotation or pinpoint reference.
- Trace every relied-on figure to its source, confirm dates and assumptions, and independently recalculate totals or derived amounts.
- Calculate operative dates independently from the current rule and actual triggering event. Check exceptions and record the verified deadline.
- Check the current court or regulator requirements, prescribed form and attachments for the intended document and filing.
- Review operative clauses in the complete document, including definitions, cross-references, schedules and inconsistencies with the instructions.
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.

## Restrictions

- Confirm firm, client and applicable court or professional restrictions before using any AI feature.

## Jurisdiction note

Apply this guidance to the actual matter and jurisdiction. Confirm current requirements before relying on an example.

## Basis

Practice guidance supports planning; the responsible lawyer confirms the scope, evidence and review requirements for the matter.

Also covers: TMT law; technology law; IT law; digital transactions; tech contracting; software licensing; SaaS/cloud contracts; outsourcing agreements; technology procurement; Consumer Data Right (CDR) agreements; digital platform regulation

TMT/IT contracts practice covers the drafting, review, negotiation and dispute resolution of agreements governing technology supply, software licensing, SaaS/cloud services, digital infrastructure, outsourcing, Consumer Data Right participation and telecommunications. The AI risk profile is high-moderate: tasks are largely document-bound (text extraction and comparison play to AI strengths), but the regulatory environment is fast-moving (Privacy Act 2024 reforms, UCT regime, SOCI Act CIRMP Rules amendments, APRA CPS 230 replacing CPS 231, CDR expansion, ACCC digital platform designated-service regime), jurisdiction-specific drafting standards are exacting, and hallucinated precedent or a wrong statutory threshold can expose the client to multi-million-dollar penalties or unenforceable clauses.

## Limits on AI assistance

Red lines — never in this area

## Limits on AI assistance

AI must never be used as the sole source of a statutory limitation period, regulatory notification deadline, or penalty threshold in any advice or document delivered to a client — these must always be verified against the current version of the legislation on legislation.gov.au or the relevant regulator's current instrument. AI must never generate or reproduce case citations (UCT, Privacy Act, SOCI Act, IP, CDR, or TMT cases) without lawyer verification against AustLII, Jade, or a confirmed law report — hallucinated citations have resulted in the first Australian solicitor sanction confirmed by VLSB+C (August 2025) following Handa & Mallick [2024] FedCFamC2F 957 and Dayal [2024] FedCFamC2F 1166. AI must not conduct or substitute for actual searches of IP Australia (patent/trade mark registers), ASIC registers, PPSR, CDR Register, ACMA spectrum licence register, or any government database — AI cannot access live registries and fabricates search results. AI must not determine whether a contract is subject to the UCT regime or whether a counterparty qualifies as a 'small business' without the lawyer verifying the employee and turnover thresholds against current ACL and ASIC Act provisions and confirming them against the client's and counterparty's actual corporate and financial structure. AI must not draft or finalise any court filing, pleading, or submission for TMT litigation without complete independent verification of every authority cited — NSW Supreme Court Practice Note SC Gen 23 (effective 3 February 2025) and Federal Court Practice Note GPN-AI (effective 16 April 2026) both require disclosure of GenAI use; undisclosed reliance and citation of hallucinated authorities risks indemnity costs orders and professional disciplinary referral. AI must not provide final advice on cross-border data transfer compliance — the Privacy Act 1988 (Cth) overseas transfer whitelist is a live regulatory instrument and as of mid-2026 no countries have been formally approved; AI has no means of knowing the current approved-country status. AI must not determine whether a client's activities, assets, or systems trigger SOCI Act obligations — sector-specific rules and asset class definitions are amended by legislative instrument, including by the CIRMP Rules Exposure Draft released March 2026; specialist verification against current instruments is mandatory. AI-generated open source licence analysis must never be relied upon in a technology acquisition without independent lawyer review of each identified licence against the actual SPDX licence text — errors in GPL/LGPL/AGPL/AGPL-3.0 classification carry material consequential loss exposure. AI must not be relied upon for any aspect of APRA prudential standard compliance without the lawyer first confirming which standard is currently in force — CPS 231 (Outsourcing) was replaced by CPS 230 (Operational Risk Management) from 1 July 2025; AI citing CPS 231 in an outsourcing context is citing a superseded standard. AI must not determine whether a vendor qualifies as a 'designated digital platform service' under any enacted or proposed Australian digital competition regime — the legislative status of the proposed regime changes and AI cannot determine current enactment status.

- AI must never be used as the sole source of a statutory limitation period, regulatory notification deadline, or penalty threshold in any advice or document delivered to a client — these must always be verified against the current version of the legislation on legislation.gov.au or the relevant regulator's current instrument.
- AI must never generate or reproduce case citations (UCT, Privacy Act, SOCI Act, IP, CDR, or TMT cases) without lawyer verification against AustLII, Jade, or a confirmed law report — hallucinated citations have resulted in the first Australian solicitor sanction confirmed by VLSB+C (August 2025) following Handa & Mallick [2024] FedCFamC2F 957 and Dayal [2024] FedCFamC2F 1166.
- AI must not conduct or substitute for actual searches of IP Australia (patent/trade mark registers), ASIC registers, PPSR, CDR Register, ACMA spectrum licence register, or any government database — AI cannot access live registries and fabricates search results.
- AI must not determine whether a contract is subject to the UCT regime or whether a counterparty qualifies as a 'small business' without the lawyer verifying the employee and turnover thresholds against current ACL and ASIC Act provisions and confirming them against the client's and counterparty's actual corporate and financial structure.
- AI must not draft or finalise any court filing, pleading, or submission for TMT litigation without complete independent verification of every authority cited — NSW Supreme Court Practice Note SC Gen 23 (effective 3 February 2025) and Federal Court Practice Note GPN-AI (effective 16 April 2026) both require disclosure of GenAI use; undisclosed reliance and citation of hallucinated authorities risks indemnity costs orders and professional disciplinary referral.
- AI must not provide final advice on cross-border data transfer compliance — the Privacy Act 1988 (Cth) overseas transfer whitelist is a live regulatory instrument and as of mid-2026 no countries have been formally approved; AI has no means of knowing the current approved-country status.
- AI must not determine whether a client's activities, assets, or systems trigger SOCI Act obligations — sector-specific rules and asset class definitions are amended by legislative instrument, including by the CIRMP Rules Exposure Draft released March 2026; specialist verification against current instruments is mandatory.
- AI-generated open source licence analysis must never be relied upon in a technology acquisition without independent lawyer review of each identified licence against the actual SPDX licence text — errors in GPL/LGPL/AGPL/AGPL-3.0 classification carry material consequential loss exposure.
- AI must not be relied upon for any aspect of APRA prudential standard compliance without the lawyer first confirming which standard is currently in force — CPS 231 (Outsourcing) was replaced by CPS 230 (Operational Risk Management) from 1 July 2025; AI citing CPS 231 in an outsourcing context is citing a superseded standard.
- AI must not determine whether a vendor qualifies as a 'designated digital platform service' under any enacted or proposed Australian digital competition regime — the legislative status of the proposed regime changes and AI cannot determine current enactment status.

## Jurisdiction-specific considerations

Australian traps

## Jurisdiction-specific considerations

ASCR Rules 4 (competence) and 9 (confidentiality) are the primary conduct risk anchors — the December 2024 joint statement of the NSW Law Society, VLSB+C, and WA Legal Practice Board confirms both apply directly to AI use; practitioners must not input client-confidential matter information into public GenAI tools without verified data isolation and a data processing agreement. NSW Supreme Court Practice Note SC Gen 23 (effective 3 February 2025): mandatory for all NSW proceedings — requires disclosure of GenAI use in documents filed with the court; prohibits filing of content the practitioner knows to be AI-generated without verification; unverified AI content and hallucinated citations attract indemnity costs orders and misconduct referral. Federal Court Practice Note GPN-AI (effective 16 April 2026): applies to all persons appearing before or filing with the Federal Court — requires disclosure of GenAI use in the body of each document identifying where and how GenAI was used; draws a material distinction between open/public tools (highest risk) and closed/enterprise tools; applies to TMT litigation and IP proceedings in the Federal Court. Dayal [2024] FedCFamC2F 1166 / VLSB+C sanction confirmed 19 August 2025: the correct sanction case — Handa & Mallick [2024] FedCFamC2F 957 is the referral order; Dayal is the sanction (practising certificate varied; Mr Dayal may only practise as an employee solicitor under supervision). This is the benchmark case for professional discipline referrals across all Australian jurisdictions. Helmold & Mariya (No 2) (2025) FLC 94-272: Federal Circuit and Family Court warning that unverified AI research 'has the capacity to confuse, mislead, and waste judicial time' — cited in professional liability contexts beyond family law. Unfair contract terms regime (post-9 November 2023): making a standard-form contract that contains an unfair term is a prohibited act — penalties for corporations are the greater of AU$50M, three times the benefit obtained, or 30% of adjusted turnover for the relevant period; the small-business definition (fewer than 100 employees OR annual turnover less than AU$10M — either limb; no monetary contract value cap) is a critical threshold AI frequently misstates; ACCC is actively enforcing against SaaS and digital platform vendors. Privacy and Other Legislation Amendment Act 2024 (Cth): commenced 10 December 2024 — introduces statutory privacy tort; updates overseas transfer framework with a whitelist mechanism (no countries formally approved as of mid-2026 — lawyers must verify current status with OAIC); expands OAIC enforcement powers; APP 1 automated decision-making transparency obligation commences 10 December 2026; AI advice on Privacy Act must be verified against post-December 2024 legislation. Security of Critical Infrastructure Act 2018 (Cth) and CIRMP Rules: data storage and cloud services can be regulated critical infrastructure assets; CIRMP Rules Exposure Draft of amended Rules released 25 March 2026 proposes significant expansions; telecommunications security obligations were integrated into the SOCI Act framework from 4 April 2025; AI has unreliable coverage of current asset class definitions and positive security obligations — verify against legislation.gov.au and Home Affairs. APRA CPS 230 (Operational Risk Management): effective 1 July 2025 — replaces CPS 231 (Outsourcing), CPS 232 (Business Continuity Management), and CPS 234 (Information Security) for APRA-regulated entities; pre-existing outsourcing and technology agreements have a transition period to 1 July 2026; AI citing any of the superseded standards in outsourcing, cloud, or incident response advice is citing a defunct instrument. Copyright Act 1968 (Cth) s 196 — IP assignment formalities: assignment must be in writing signed by the assignor; no US-equivalent 'work for hire' doctrine for independent contractors; Commissioner of Patents v Thaler [2022] FCAFC 62 confirms AI cannot be named inventor; AI-generated creative works have no copyright owner under Australian law without an identifiable human author; Australian Government confirmed in October 2025 it will not introduce a text-and-data-mining exception. Consumer Data Right regime: OAIC first CDR determination (Regional Australia Bank, May 2025) confirmed contractual liability-shifting to service providers does not excuse data holders from their own CDR and Privacy Act obligations; CDR expanding to non-bank lending sector; Data Standards require FAPI 1.0 Advanced Profile; AI coverage of current technical standards and sector scope is unreliable. Limitation periods vary by state: contract limitation periods and — critically — accrual rules for latent software defects differ materially between Limitation Act 1969 (NSW), Limitation of Actions Act 1958 (Vic), and Limitation of Actions Act 1974 (Qld); AI conflates state regimes and US limitation law; independent verification per jurisdiction is mandatory for any limitation-period advice.

- ASCR Rules 4 (competence) and 9 (confidentiality) are the primary conduct risk anchors — the December 2024 joint statement of the NSW Law Society, VLSB+C, and WA Legal Practice Board confirms both apply directly to AI use; practitioners must not input client-confidential matter information into public GenAI tools without verified data isolation and a data processing agreement.
- NSW Supreme Court Practice Note SC Gen 23 (effective 3 February 2025): mandatory for all NSW proceedings — requires disclosure of GenAI use in documents filed with the court; prohibits filing of content the practitioner knows to be AI-generated without verification; unverified AI content and hallucinated citations attract indemnity costs orders and misconduct referral.
- Federal Court Practice Note GPN-AI (effective 16 April 2026): applies to all persons appearing before or filing with the Federal Court — requires disclosure of GenAI use in the body of each document identifying where and how GenAI was used; draws a material distinction between open/public tools (highest risk) and closed/enterprise tools; applies to TMT litigation and IP proceedings in the Federal Court.
- Dayal [2024] FedCFamC2F 1166 / VLSB+C sanction confirmed 19 August 2025: the correct sanction case — Handa & Mallick [2024] FedCFamC2F 957 is the referral order; Dayal is the sanction (practising certificate varied; Mr Dayal may only practise as an employee solicitor under supervision). This is the benchmark case for professional discipline referrals across all Australian jurisdictions.
- Helmold & Mariya (No 2) (2025) FLC 94-272: Federal Circuit and Family Court warning that unverified AI research 'has the capacity to confuse, mislead, and waste judicial time' — cited in professional liability contexts beyond family law.
- Unfair contract terms regime (post-9 November 2023): making a standard-form contract that contains an unfair term is a prohibited act — penalties for corporations are the greater of AU$50M, three times the benefit obtained, or 30% of adjusted turnover for the relevant period; the small-business definition (fewer than 100 employees OR annual turnover less than AU$10M — either limb; no monetary contract value cap) is a critical threshold AI frequently misstates; ACCC is actively enforcing against SaaS and digital platform vendors.
- Privacy and Other Legislation Amendment Act 2024 (Cth): commenced 10 December 2024 — introduces statutory privacy tort; updates overseas transfer framework with a whitelist mechanism (no countries formally approved as of mid-2026 — lawyers must verify current status with OAIC); expands OAIC enforcement powers; APP 1 automated decision-making transparency obligation commences 10 December 2026; AI advice on Privacy Act must be verified against post-December 2024 legislation.
- Security of Critical Infrastructure Act 2018 (Cth) and CIRMP Rules: data storage and cloud services can be regulated critical infrastructure assets; CIRMP Rules Exposure Draft of amended Rules released 25 March 2026 proposes significant expansions; telecommunications security obligations were integrated into the SOCI Act framework from 4 April 2025; AI has unreliable coverage of current asset class definitions and positive security obligations — verify against legislation.gov.au and Home Affairs.
- APRA CPS 230 (Operational Risk Management): effective 1 July 2025 — replaces CPS 231 (Outsourcing), CPS 232 (Business Continuity Management), and CPS 234 (Information Security) for APRA-regulated entities; pre-existing outsourcing and technology agreements have a transition period to 1 July 2026; AI citing any of the superseded standards in outsourcing, cloud, or incident response advice is citing a defunct instrument.
- Copyright Act 1968 (Cth) s 196 — IP assignment formalities: assignment must be in writing signed by the assignor; no US-equivalent 'work for hire' doctrine for independent contractors; Commissioner of Patents v Thaler [2022] FCAFC 62 confirms AI cannot be named inventor; AI-generated creative works have no copyright owner under Australian law without an identifiable human author; Australian Government confirmed in October 2025 it will not introduce a text-and-data-mining exception.
- Consumer Data Right regime: OAIC first CDR determination (Regional Australia Bank, May 2025) confirmed contractual liability-shifting to service providers does not excuse data holders from their own CDR and Privacy Act obligations; CDR expanding to non-bank lending sector; Data Standards require FAPI 1.0 Advanced Profile; AI coverage of current technical standards and sector scope is unreliable.
- Limitation periods vary by state: contract limitation periods and — critically — accrual rules for latent software defects differ materially between Limitation Act 1969 (NSW), Limitation of Actions Act 1958 (Vic), and Limitation of Actions Act 1974 (Qld); AI conflates state regimes and US limitation law; independent verification per jurisdiction is mandatory for any limitation-period advice.

## Risks to address

How it goes wrong

## Risks to address

Hallucinated UCT case law: AI cites non-existent or misquoted ACCC enforcement decisions or court judgments applying the unfair contract terms regime to SaaS contracts, leading to incorrect advice on enforceability and risk exposure. Stale Privacy Act obligations: model training predates or incompletely captures December 2024 Privacy and Other Legislation Amendment Act reforms; AI applies pre-reform APP 8 framework, misses the new whitelist mechanism (no countries yet approved as of mid-2026), the statutory privacy tort, and the APP 1 automated-decision-making obligation commencing December 2026. Wrong UCT small-business threshold and penalty quantum: AI applies the pre-November 2023 threshold (20 employees, AU$300,000 contract value cap) or misstates the penalty as a flat AU$50M rather than the greater of AU$50M, three times benefit, or 30% of adjusted turnover — material for large-vendor clients. Superseded APRA standards: AI cites CPS 231 (Outsourcing) and CPS 234 (Information Security) in outsourcing and cloud advice — both replaced by CPS 230 from 1 July 2025; advice built on these standards is structurally wrong for APRA-regulated clients. IP ownership errors in outsourced development: AI defaults to a US 'work made for hire' framing not available under Australian copyright law — Copyright Act 1968 (Cth) s 196 requires an assignment in writing signed by assignor; AI-drafted assignments frequently omit the s 196 formalities. Hallucinated SOCI Act sector and asset coverage: AI asserts or denies that a client's data centre, cloud service, or managed service is a 'critical infrastructure asset' with no basis in the current legislative instrument defining asset classes, causing a client to be non-compliant and potentially uninsured.

- Hallucinated UCT case law: AI cites non-existent or misquoted ACCC enforcement decisions or court judgments applying the unfair contract terms regime to SaaS contracts, leading to incorrect advice on enforceability and risk exposure.
- Stale Privacy Act obligations: model training predates or incompletely captures December 2024 Privacy and Other Legislation Amendment Act reforms; AI applies pre-reform APP 8 framework, misses the new whitelist mechanism (no countries yet approved as of mid-2026), the statutory privacy tort, and the APP 1 automated-decision-making obligation commencing December 2026.
- Wrong UCT small-business threshold and penalty quantum: AI applies the pre-November 2023 threshold (20 employees, AU$300,000 contract value cap) or misstates the penalty as a flat AU$50M rather than the greater of AU$50M, three times benefit, or 30% of adjusted turnover — material for large-vendor clients.
- Superseded APRA standards: AI cites CPS 231 (Outsourcing) and CPS 234 (Information Security) in outsourcing and cloud advice — both replaced by CPS 230 from 1 July 2025; advice built on these standards is structurally wrong for APRA-regulated clients.
- IP ownership errors in outsourced development: AI defaults to a US 'work made for hire' framing not available under Australian copyright law — Copyright Act 1968 (Cth) s 196 requires an assignment in writing signed by assignor; AI-drafted assignments frequently omit the s 196 formalities.
- Hallucinated SOCI Act sector and asset coverage: AI asserts or denies that a client's data centre, cloud service, or managed service is a 'critical infrastructure asset' with no basis in the current legislative instrument defining asset classes, causing a client to be non-compliant and potentially uninsured.

## Review checklist

The lawyer's review checklist

## Review checklist

Every statutory threshold, deadline, or penalty figure cited by AI (UCT small-business test and penalty maximum, Privacy Act notification window, limitation period, SOCI Act asset class, APRA prudential standard version) is independently verified against the current version of the legislation or instrument on legislation.gov.au before the output is used in any client-facing document. Every case citation is checked on AustLII, Jade, or a verified law report — citation, party names, year, court, and the proposition for which it is cited are all confirmed; any citation that cannot be found is treated as hallucinated and deleted; the Dayal/Handa & Mallick distinction is applied correctly if either is cited. Confidentiality exposure is assessed before the task begins: no client-confidential, privileged, or personally identifiable information is submitted to a public GenAI tool; only tools with verified Australian data residency or contractual data isolation are used for matter-specific work. The AI's characterisation of the applicable regulatory overlay is verified against the actual client profile: APRA-regulated entity (CPS 230, not CPS 231/234); SOCI Act-covered asset operator (current CIRMP Rules, not pre-2022 framework); CDR participant (current Data Standards and sector scope); designated digital platform service (current legislative status of proposed regime) — the AI base playbook will not include these overlays by default. IP ownership provisions in AI-generated drafts are confirmed to satisfy Copyright Act 1968 (Cth) s 196 formalities (written instrument, signed by assignor), to exclude any work-for-hire reasoning inapplicable under Australian law, and to address AI-generated output ownership where the vendor uses AI in delivery. The AI's characterisation of the contract type (standard-form vs bespoke, consumer vs business, ACL vs ASIC Act) and the counterparty's small-business status are verified against the actual transaction facts and current statutory definitions before any UCT or ACL advice is finalised; the penalty quantum stated to the client uses the three-limb maximum, not the flat AU$50M figure. For any matter proceeding in an NSW, Victorian, or Federal court: disclosure obligations under NSW Practice Note SC Gen 23, Victorian AI Guidelines (2024), and Federal Court Practice Note GPN-AI (16 April 2026) are assessed and complied with before filing any AI-assisted document; disclosure language is specific about where and how GenAI was used. The overseas transfer whitelist status is confirmed with OAIC and on legislation.gov.au before any APP 8 compliance advice is finalised — the whitelist mechanism is in force but no countries have been formally approved as of mid-2026; AI will not know current approval status.

- Every statutory threshold, deadline, or penalty figure cited by AI (UCT small-business test and penalty maximum, Privacy Act notification window, limitation period, SOCI Act asset class, APRA prudential standard version) is independently verified against the current version of the legislation or instrument on legislation.gov.au before the output is used in any client-facing document.
- Every case citation is checked on AustLII, Jade, or a verified law report — citation, party names, year, court, and the proposition for which it is cited are all confirmed; any citation that cannot be found is treated as hallucinated and deleted; the Dayal/Handa & Mallick distinction is applied correctly if either is cited.
- Confidentiality exposure is assessed before the task begins: no client-confidential, privileged, or personally identifiable information is submitted to a public GenAI tool; only tools with verified Australian data residency or contractual data isolation are used for matter-specific work.
- The AI's characterisation of the applicable regulatory overlay is verified against the actual client profile: APRA-regulated entity (CPS 230, not CPS 231/234); SOCI Act-covered asset operator (current CIRMP Rules, not pre-2022 framework); CDR participant (current Data Standards and sector scope); designated digital platform service (current legislative status of proposed regime) — the AI base playbook will not include these overlays by default.
- IP ownership provisions in AI-generated drafts are confirmed to satisfy Copyright Act 1968 (Cth) s 196 formalities (written instrument, signed by assignor), to exclude any work-for-hire reasoning inapplicable under Australian law, and to address AI-generated output ownership where the vendor uses AI in delivery.
- The AI's characterisation of the contract type (standard-form vs bespoke, consumer vs business, ACL vs ASIC Act) and the counterparty's small-business status are verified against the actual transaction facts and current statutory definitions before any UCT or ACL advice is finalised; the penalty quantum stated to the client uses the three-limb maximum, not the flat AU$50M figure.
- For any matter proceeding in an NSW, Victorian, or Federal court: disclosure obligations under NSW Practice Note SC Gen 23, Victorian AI Guidelines (2024), and Federal Court Practice Note GPN-AI (16 April 2026) are assessed and complied with before filing any AI-assisted document; disclosure language is specific about where and how GenAI was used.
- The overseas transfer whitelist status is confirmed with OAIC and on legislation.gov.au before any APP 8 compliance advice is finalised — the whitelist mechanism is in force but no countries have been formally approved as of mid-2026; AI will not know current approval status.

## Tasks (24)

| Task | Level | How AI is used | What the lawyer must review |
| --- | --- | --- | --- |
| [Review a vendor contract against the technology playbook](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/review-a-vendor-contract-against-the-technology-playbook.md) | Yellow | Compare the vendor MSA, SaaS terms or click-wrap to the client's playbook and produce a clause-level issues list with missing liability, IP, data and exit… | Open every flagged clause in the actual document Check unflagged schedules for interaction effects before the issues list goes to the client |
| Draft a data-processing, IP, SLA or exit schedule from the playbook | Yellow | Produce a first-draft schedule from the playbook and deal facts, listing definitions, service levels, change control and transition terms that need commercial… | Read each schedule against the main agreement Confirm privacy, IP ownership and liability work together under the governing law |
| [Build a one-sided terms table for a standard-form technology contract](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/build-a-one-sided-terms-table-for-a-standard-form-technology-contract.md) | Yellow | Flag termination, variation, liability, auto-renewal and unilateral change terms that may be one-sided, with clause references. | Decide whether the contract is standard-form Decide whether the counterparty is in the protected class under the law that actually applies |
| Map data locations and cross-border flows from the vendor DPA | Yellow | Extract stated data residency, subprocessors and transfer mechanisms from the DPA and architecture paper into a flow table with gaps marked. | Confirm locations against the vendor's current DPA, not a marketing page Apply the transfer rules of the governing privacy law |
| Build an open-source and contractor-IP issues table for a technology deal | Yellow | From the target contracts and licence notices, list ownership gaps, contractor-created IP and copyleft or attribution conditions with document references. | Read the licence family in the actual notice Check GPL version differences and inbound assignment gaps; both are easy to mis-state |
| [Draft or review security and incident-notification clauses](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/draft-or-review-security-and-incident-notification-clauses.md) | Yellow | Produce a security schedule covering standards, audit rights, notification timelines and incident cooperation, and list gaps against the playbook. | Match timelines to the client's actual reporting duties Do not leave a generic 72-hour clause if the statute or regulator requires something else |
| Draft a software escrow agreement from the release triggers | Yellow | Produce a first-draft escrow agreement covering deposit materials, verification, release triggers and licensed-materials definition. | Check insolvency and administration triggers under the governing insolvency law Confirm what is actually deposited |
| Draft an outsourcing or managed-services structure from the term sheet | Yellow | Produce a first-draft structure for SLAs, governance, benchmarking, step-in, change control and exit from the term sheet. | Confirm the structure matches the services actually being moved Apply any operational-resilience rules that apply to the client |
| Build a technology-dispute chronology from the correspondence | Yellow | Turn the contract and the correspondence file into a chronology of alleged breaches, notices and responses, with a list of missing documents. | Check dates against the file Decide limitation, notice and breach from the contract and current law, not chronology labels |
| [Map carrier, numbering or consumer-safeguard duties from the licence papers](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/map-carrier-numbering-or-consumer-safeguard-duties-from-the-licence-pape.md) | Yellow | Extract the client's licence class and the obligations the lawyer has listed from the statute and licence conditions into a compliance table with gaps marked. | Open the current instrument; telecommunications rules change by determination Do not merge rules across countries |
| Draft AI-use, training-data and output-warranty clauses for a vendor contract | Yellow | Produce first-draft clauses on permitted AI use, training on client data, output warranties, audit and indemnities, mapped to the vendor's technical… | Match the clauses to the architecture the vendor actually uses Do not use a generic 'no training' clause the product cannot honour; it is worse than none |
| [Review an open-banking or consumer-data-sharing participation agreement](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/review-an-open-banking-or-consumer-data-sharing-participation-agreement.md) | Yellow | Extract data-holder, recipient and API obligations from the agreement and line them up against the rules the lawyer has named, marking gaps. | Open the current data standards and rules Do not treat a heading match as compliance |
| [Extract platform, app-store or marketplace terms that bind the client](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/extract-platform-app-store-or-marketplace-terms-that-bind-the-client.md) | Yellow | Pull ranking, fee, termination, data and content-moderation terms from the platform paper into a table with clause references. | Read the live terms, not a summary of a regulator inquiry Decide which terms the client can actually negotiate |
| Extract uptime, credits and support response times from the SLA schedule | Green | Turn the SLA schedule into a table of metrics, measurement windows, exclusions and service credits with clause references. | Check the exclusions and the credit formula against the schedule Do not rely on a 99.9% headline if the vendor controls measurement |
| Draft a statement of work from the proposal and the MSA | Yellow | Produce a first-draft SOW covering deliverables, acceptance, dependencies and charges from the proposal, aligned to the MSA definitions. | Confirm the SOW does not silently vary liability, IP or data terms in the MSA Check that acceptance criteria are testable |
| Compare the signed technology contract with the last agreed issues list | Green | Compare the signing copy with the issues list and the last negotiated draft; flag unimplemented changes and unexpected edits. | Read every flagged difference Check cross-references in SLA and DPA schedules; broken ones are easy to miss |
| Review a SaaS agreement for AI-specific clauses | Yellow | Flag training-use, output and liability terms. | Lawyer reviews. |
| Draft an AI addendum to a technology contract | Yellow | Draft clauses on data, testing and transparency. | Lawyer settles. |
| Map a vendor's data flows for privacy impact | Green | Build a data-flow table from documents. | Lawyer checks. |
| Prepare an incident-response checklist for an AI system | Green | Draft checklist steps. | Lawyer approves. |
| Summarise telecommunications regulatory duties for a product | Yellow | Summarise ACMA rules. | Lawyer verifies. |
| Review a GenAI vendor contract for TMT clients | Yellow | Review. | Lawyer advises. |
| Advise on AI product liability | Yellow | Analyse. | Lawyer advises. |
| Summarise AI regulatory developments | Green | Summarise. | Verify. |

## Jurisdiction notes

### Australia

#### Scope

Technology supply, software licensing, SaaS and cloud, outsourcing, Consumer Data Right participation and telecommunications agreements, from drafting to disputes.

#### Moving law

2024 Privacy Act reforms, the unfair-contract-terms regime, SOCI Act CIRMP Rules amendments, APRA CPS 230 (replacing CPS 231), CDR expansion and the ACCC's proposed digital-platform regime.

#### Where it goes wrong

Text extraction and comparison suit AI. A wrong statutory threshold or invented precedent can expose the client to multi-million-dollar penalties or unenforceable clauses.

- Check every statutory threshold, penalty figure and commencement date against the current instrument.

### New Zealand

#### Consumer and unfair terms

Fair Trading Act 1986, not the ACL.

#### Overseas data

Privacy Act 2020 and IPP 12, not APP 8. Check IPP 12 and the Client Care confidentiality rules before client data enters a tool.

#### Consumer data right

No Consumer Data Right statute was confirmed for this research.

Sources:

- [Fair Trading Act 1986](https://www.legislation.govt.nz/act/public/1986/121/en/latest/) (checked 2026-09-23)
- [OPC: Privacy Act 2020 information privacy principles](https://www.privacy.org.nz/privacy-principles/) (checked 2026-09-23)
- [OPC: Artificial Intelligence and the Information Privacy Principles](https://www.privacy.org.nz/resources-and-learning/a-z-topics/ai/) (checked 2026-09-23)
- [Lawyers and Conveyancers Act (Lawyers: Conduct and Client Care) Rules 2008](https://www.legislation.govt.nz/secondary-legislation/pco-drafted/2008/214/en/latest/) (checked 2026-09-23)

### United States

Local name: Technology, media and telecommunications / IT contracts

#### Governing law

State contract law plus federal communications, IP and privacy overlays.

#### Vendor terms

A Rule 1.6 diligence item under Formal Opinion 512, California's Practical Guidance and Florida 24-1.

#### Agentic tools

California's 2026 guidance covers agents that act without a new prompt. Do not let one file, email a counterparty or access documents without your controls.

Sources:

- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-09-23)
- [State Bar of California, Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law (2026)](https://www.calbar.ca.gov/Portals/0/documents/ethics/Generative-AI-Practical-Guidance.pdf) (checked 2026-09-23)
- [Florida Bar Ethics Opinion 24-1](https://www.floridabar.org/etopinions/opinion-24-1/) (checked 2026-09-23)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*