---
title: "Privacy due diligence before an AI knowledge vendor is chosen"
url: "https://ailawframework.com/precedents/knowledge-management/ai-vendor-privacy-due-diligence"
type: "precedent"
site: "AI Law Framework"
id: "km-ai-vendor-privacy-due-diligence"
area_id: "KM"
kind: "checklist"
ai_level: "yellow"
version: 1
task_ids: ["KM-B12-25"]
law_stated_as_at: "2026-10-22"
---

# Privacy due diligence before an AI knowledge vendor is chosen

> A worksheet of the privacy questions the OAIC says an organisation should answer before it adopts a commercially available AI product, including training data, security, and who can see the inputs.

Canonical page: https://ailawframework.com/precedents/knowledge-management/ai-vendor-privacy-due-diligence  
Law stated as at: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

- Kind: Checklist. Steps or checks to work through and tick off.
- Practice area: [Knowledge Management](https://ailawframework.com/precedents/knowledge-management.md)
- Jurisdictions: Australia
- AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at: 2026-10-22
- Status: Maintained. Checked on 2026-10-22 against the authority it cites, for Australia.

## When to use it

Use when the firm is evaluating an AI knowledge-management vendor or any commercially available AI product that would handle personal information. It is not an information-barrier record and it is not the citation policy for a knowledge assistant.

## Used for these tasks

- [Evaluate an AI KM vendor](https://ailawframework.com/practice/knowledge-management/evaluate-an-ai-km-vendor.md)

## How AI may be used

AI may list the OAIC questions against a vendor's documents the lawyer has supplied; the lawyer decides whether the product is appropriate and whether personal information would be disclosed.

**AI may:**

- Set out the vendor's stated training sources, hosting location, and access terms beside the questions on the OAIC checklist
- Record whether a privacy impact assessment has been commissioned, without writing its findings

**AI must not:**

- Must not decide that the product complies with the Privacy Act
- Must not send client documents or personal information to the vendor in order to test it
- Must not treat a developer safeguard as foolproof

**The lawyer checks:**

- The intended use is stated, including whether the tool would make or support a decision with a legal or similarly significant effect
- APP 6 is considered if the developer or a third party would see inputs or outputs
- APP 11 security, including cloud hosting and overseas servers, is answered from documents the firm has, or marked as not yet known

## Authorities

- [Office of the Australian Information Commissioner, Guidance on privacy and the use of commercially available AI products, updated 21 October 2024: selecting an AI product, APP 6, APP 10 and APP 11](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/knowledge-management/ai-vendor-privacy-due-diligence and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*