--- title: "Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)" url: "https://ailawframework.com/precedents/privacy-data-protection-and-cyber/ai-privacy-impact-assessment" type: "precedent" site: "AI Law Framework" id: "a25-ai-privacy-impact-assessment" area_id: "A25" kind: "checklist" ai_level: "yellow" version: 1 law_stated_as_at: "2026-10-17" --- # Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool) > A structured PIA checklist for deploying an AI product: project description, information flows (prompts, outputs, logs, training), an APP-by-APP analysis including APP 1.7, AI-specific risks, vendor checks, a risk… Canonical page: https://ailawframework.com/precedents/privacy-data-protection-and-cyber/ai-privacy-impact-assessment Law stated as at: 2026-10-17 Site index for agents: https://ailawframework.com/llms.txt A structured PIA checklist for deploying an AI product: project description, information flows (prompts, outputs, logs, training), an APP-by-APP analysis including APP 1.7, AI-specific risks, vendor checks, a risk register and sign-off. ## Key facts - Kind: Checklist. Steps or checks to work through and tick off. - Practice area: [Privacy, Data Protection & Cyber](https://ailawframework.com/precedents/privacy-data-protection-and-cyber.md) - Jurisdictions: Australia, European Union - AI level: Yellow. AI can help in set ways. A lawyer checks specific points before use. - Law stated as at: 2026-10-17 - Status: Maintained. Checked on 2026-10-17 against the 9 authorities it cites, for Australia and European Union. ## When to use it Use before an organisation deploys, or materially changes, an AI tool that handles personal information, alongside the OAIC's PIA tool and guide. It is a working document for the project team and the privacy officer, not a substitute for legal advice on high-risk uses. ## How AI may be used AI may pre-fill the project description and data-flow map from vendor documents and the project brief, and suggest risks. Risk ratings, mitigations and sign-off are human decisions. **AI may:** - Extract data flows, retention periods, locations and sub-processors from the vendor's documents into Part B and Part E, with page references. - Suggest candidate risks for Part D from the use case, for the team to accept or reject. - Check that every risk in the register has an owner, a mitigation and a due date. **AI must not:** - Must not assign final risk ratings or decide that a risk is acceptable. - Must not be given real personal information to "test" the tool before the PIA is approved. - Must not treat the vendor's documents as verified without the vendor's contractual commitment. **The lawyer checks:** - The APP 6 analysis of any secondary use (including training) is reasoned and supported by notices or consent. - Any decision that could significantly affect individuals is flagged for APP 1.7 and the privacy policy is updated. - Sign-off is by people with authority, and review triggers are set. ## Authorities - [Privacy Act 1988 (Cth) Sch 1 APPs 1, 3, 5, 6, 8, 10, 11, 12 and 13](https://www.legislation.gov.au/C2004A03712/latest/text) - [Privacy Act 1988 (Cth) Sch 1 APP 1.7 to 1.9 (automated decisions, from 10 December 2026)](https://www.legislation.gov.au/C2024A00128/asmade/text) - [Privacy Act 1988 (Cth) s 33D (Commissioner may direct an agency to give a PIA)](https://www.legislation.gov.au/C2004A03712/latest/text) - [Privacy (Australian Government Agencies — Governance) APP Code 2017 (Cth) s 12 (agencies must conduct a PIA for high privacy risk projects)](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/government-agencies/australian-government-agencies-privacy-code/privacy-australian-government-agencies-governance-app-code-2017) - [OAIC, Guidance on privacy and the use of commercially available AI products (October 2024)](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products) - [OAIC, Guidance on privacy and developing and training generative AI models (October 2024)](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-developing-and-training-generative-ai-models) - [OAIC, Privacy impact assessment tool and Guide to undertaking privacy impact assessments](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/privacy-impact-assessments/privacy-impact-assessment-tool) - [Regulation (EU) 2016/679 (GDPR) art 35 (data protection impact assessment)](https://eur-lex.europa.eu/eli/reg/2016/679/oj) - [Regulation (EU) 2024/1689 (AI Act) art 27 (fundamental rights impact assessment), as amended by Regulation (EU) 2026/1744](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) ## Official form [Official form](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/privacy-impact-assessments/privacy-impact-assessment-tool) ## Full text and drafting notes The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/privacy-data-protection-and-cyber/ai-privacy-impact-assessment and through the signed-in MCP connector https://ailawframework.com/mcp/firm. *Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*