---
title: "AI tool approval request, risk assessment and register entry (legal team and business use)"
url: "https://ailawframework.com/precedents/in-house-general-counsel/ai-tool-approval-and-register"
type: "precedent"
site: "AI Law Framework"
id: "a40-ai-tool-approval-and-register"
area_id: "A40"
kind: "form"
ai_level: "green"
version: 1
law_stated_as_at: "2026-10-17"
---

# AI tool approval request, risk assessment and register entry (legal team and business use)

> A form for requesting approval of an AI tool: use case, data classes, vendor terms on training and retention, privacy, privilege and accuracy risks, controls, the decision and a register entry, with review triggers for…

Canonical page: https://ailawframework.com/precedents/in-house-general-counsel/ai-tool-approval-and-register  
Law stated as at: 2026-10-17

Site index for agents: https://ailawframework.com/llms.txt

A form for requesting approval of an AI tool: use case, data classes, vendor terms on training and retention, privacy, privilege and accuracy risks, controls, the decision and a register entry, with review triggers for model or vendor changes.

## Key facts

- Kind: Form. A form to complete, or a guide to completing an official one.
- Practice area: [In-House / General Counsel](https://ailawframework.com/precedents/in-house-general-counsel.md)
- Jurisdictions: Australia
- AI level: Green. AI can do most of the drafting. A lawyer still reviews the result.
- Law stated as at: 2026-10-17
- Status: Maintained. Checked on 2026-10-17 against the 6 authorities it cites, for Australia.

## When to use it

Use before any team, including the legal team, starts using a new AI tool or a new AI feature in existing software, and when a use case or vendor changes. It records the decision; for high-risk uses, also complete a privacy impact assessment.

## How AI may be used

AI may help evaluate a tool: summarising vendor documents, building a requirements and risk matrix, and filling the register. The approver makes the decision on the evidence, and the vendor's commitments are checked in the contract.

**AI may:**

- Summarise the vendor's terms, security documents and model information into Part C, with page references.
- Build a requirements and risk matrix for comparing tools.
- Populate and maintain the register entry in Part G and diary the review triggers.

**AI must not:**

- Must not approve a tool or set the permitted data classes.
- Must not be tested with real client, customer or employee data before approval.
- Must not treat vendor marketing statements as verified commitments.

**The lawyer checks:**

- Training, retention and location answers are supported by the contract, not just a website.
- Permitted data classes match the risk assessment, and privileged material is allowed only if clause 9.7 criteria of the privilege protocol are met.
- Decisions that could significantly affect individuals are flagged for the privacy policy (APP 1.7).

## Authorities

- [Privacy Act 1988 (Cth) Sch 1 APPs 1, 3, 6, 8 and 11 (including APP 1.7 to 1.9 from 10 December 2026)](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Legal Profession Uniform Law Australian Solicitors' Conduct Rules 2015 rr 4.1.3 and 9 (competence and diligence; confidentiality)](https://legislation.nsw.gov.au/view/html/inforce/current/sl-2015-0244)
- [Evidence Act 1995 (Cth) ss 118 and 122 (privilege and waiver)](https://www.legislation.gov.au/C2004A04858/latest/text)
- [OAIC, Guidance on privacy and the use of commercially available AI products (October 2024)](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products)
- [National AI Centre, Guidance for AI adoption: foundations (six essential practices)](https://www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-foundations)
- [Australian Securities and Investments Commission v Bekier (Liability Judgment) 2026 FCA 196 at 394 (AI use should be controlled and transparent and governed by formal policy)](https://www.judgments.fedcourt.gov.au/judgments/Judgments/fca/single/2026/2026fca0196)

## Official form

[Official form](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/in-house-general-counsel/ai-tool-approval-and-register and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*