Checklist · Knowledge Management
Privacy due diligence before an AI knowledge vendor is chosen
A worksheet of the privacy questions the OAIC says an organisation should answer before it adopts a commercially available AI product, including training data, security, and who can see the inputs.
- Kind
- Checklist. Steps or checks to work through and tick off.
- Where it applies
- Australia
- AI use
- Yellow You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at
- 22 October 2026
- Status
- Maintained. Checked on 22 October 2026 against the authority it cites, for Australia.
- Version
- 1
- Source
- Written for this library
When to use it
Use when the firm is evaluating an AI knowledge-management vendor or any commercially available AI product that would handle personal information. It is not an information-barrier record and it is not the citation policy for a knowledge assistant.
Used for these tasks
Each task page says how far AI may help with the task and what the lawyer must review.
How AI may be used
AI may list the OAIC questions against a vendor's documents the lawyer has supplied; the lawyer decides whether the product is appropriate and whether personal information would be disclosed.
AI may
- Set out the vendor's stated training sources, hosting location, and access terms beside the questions on the OAIC checklist
- Record whether a privacy impact assessment has been commissioned, without writing its findings
AI must not
- Must not decide that the product complies with the Privacy Act
- Must not send client documents or personal information to the vendor in order to test it
- Must not treat a developer safeguard as foolproof
The lawyer checks
- The intended use is stated, including whether the tool would make or support a decision with a legal or similarly significant effect
- APP 6 is considered if the developer or a third party would see inputs or outputs
- APP 11 security, including cloud hosting and overseas servers, is answered from documents the firm has, or marked as not yet known
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Read the full text
The full text is available after you log in. It is free. When you log in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Knowledge Management
- Legislation and citation currency audit worksheet
- Precedent review and approval procedure (including AI-drafted and AI-updated precedents)
- Policy on putting client documents into an AI knowledge tool
- Precedent metadata and version-control standard (for people and AI retrieval)
- Privilege and confidentiality clearance before know-how ingestion
- Information barrier record for an AI knowledge tool
- Minimisation worksheet before a document joins the precedent bank
- AI prompt library governance policy (prompt templates linked to precedents and tasks)
- Knowledge-base content licensing and copyright checklist (before AI ingestion)
- Judgment know-how note
- Training outline: checking an AI output before it is kept or used
- Retention schedule for AI-indexed know-how and prompt history
- Matter close-out know-how capture form with confidentiality scrub
- AI knowledge assistant governance and source-citation policy (permission-aware search, information barriers, citations)
All precedents for Knowledge Management · Tasks and AI use in this area