Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
The organisation's resources page carries a block headed 'Ask SmartAssist' reading 'Describe your situation in your own words and our AI-powered assistant will guide you to the right legal information', linking to a form at /resources/smartassist, checked 27 September 2026. The form takes up to 2,000 characters of free text plus a state or territory, and has no account, plan or paid tier.
Ask: Is SmartAssist the deployed form of the natural language processing model described on your AI project page, and is it available to other legal assistance organisations under any licence?
What the AI does
Public claim only
The tool page states 'SmartAssist uses artificial intelligence (AI) to search Justice Connect's library of legally reviewed resources and find information relevant to your situation' and, in an 'About this tool' block, 'SmartAssist uses AI to match your situation to Justice Connect's self-help resources'. The consent gate refers to information being used 'to generate a response using AI'. The separate AI project page describes the organisation's model as 'a natural language processing classifier rather than a decision-making algorithm'.
Ask: For a single submission, what runs: retrieval over your resource library, a classifier, a generative model, or a combination, and which component produces the text a user sees?
Deployment and hosting
Public claim only
The tool is a form on the organisation's own website; no API, on-premises or self-hosted option is described. The privacy policy states personal information may be disclosed to or stored with contracted information technology service providers 'hosted offshore or in cloud via Amazon Web Services (AWS)', without naming a region or country. No security page or trust centre was surfaced by a 60-URL site map.
Ask: In which AWS region does the SmartAssist form and any model call run, and is an Australian-only configuration available?
Whether the AI is in production
Not confirmed
Two vendor pages read on 27 September 2026 describe different stages. The resources page and /resources/smartassist present a live submission form. The AI project page says 'Across 2020 and early 2021, we have been working to produce a proof-of-concept natural language processing AI model' and its latest milestone is September 2021. Neither page states that the live tool runs the project's model, and neither gives a launch date for SmartAssist.
Ask: When did SmartAssist go live, what version is in production, and is the AI project page describing the same system?
Jurisdictions and language covered
Public claim only
The form requires a state or territory from VIC, NSW, TAS, ACT, SA, QLD, WA and NT, stating 'This helps us show resources that apply to your location'. The resources filter also offers National. The form states 'Please write in English, as SmartAssist currently understands English only.'
Ask: How does SmartAssist handle a problem that crosses jurisdictions, and is any non-English or interpreter-assisted path planned?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 27 September 2026. A 60-URL site map with the search terms 'ai smartassist intake privacy terms security llms' returned no /llms.txt, /ai-info, /ai or /for-ai path, and the four pages read contain no heading or block addressed to AI models, AI assistants, LLMs or crawlers and no instruction about how the tool should be described. No /llms.txt was guess-fetched, so its existence is unverified rather than disproved.
Ask: Do you publish any page, file or embedded block intended to tell AI models or crawlers how to describe SmartAssist or Justice Connect?
Stated intended use and limits
Public claim only
The form's mandatory consent statement reads 'I understand that this tool provides general legal information only, not legal advice, and that my information may be used to generate a response using AI.' The 'About this tool' block adds 'It is not legal advice. AI can make mistakes, also known as hallucinating, so always read the source resources linked in the results carefully before drawing any conclusions. The information will not cover everything or match your exact situation.'
Ask: Is the Disclaimer and Conditions of Use that the form requires users to accept the complete set of terms for SmartAssist, and does any separate document govern it?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to rely on output, and professional duties
Public claim only
Use of the form requires acceptance of a statement that the tool 'provides general legal information only, not legal advice'. The tool page adds 'You should consult a qualified lawyer before acting on any information or making important decisions about your situation.' The linked Disclaimer and Conditions of Use at /disclaimer/ was not opened within the operation budget for this product, so its terms are unread.
Ask: What does the Disclaimer and Conditions of Use say about liability and reliance on SmartAssist results, and is any part of it specific to the AI tool?
Model providers and where inference runs
Not confirmed
No model, model provider, API or hosting arrangement for the AI component is named on the tool page, the resources page, the AI project page or the privacy policy. The AI project page names a University of Melbourne school as research partner for building the organisation's own model and an Australian Research Council Linkage Grant as funding, which identifies a research partner rather than a commercial model provider.
Ask: Which model or models does SmartAssist call, who operates them, and does inference run in Australia?
Subprocessors and third parties
Public claim only
The privacy policy names categories of recipients including 'information technology service providers' and 'storage providers for archiving files', and names Google Analytics, HotJar, Laravel, Google Ads and Meta Audience Network in its cookies section, with Amazon Web Services named for offshore or cloud storage. The tool page itself carries a third-party bot-protection widget marked 'Protected by ALTCHA'. No subprocessor list, and no named processor for the AI component, was published anywhere in the material read.
Ask: Which named third parties process text submitted to SmartAssist, and can you publish or provide a subprocessor list for the tool?
Use of submitted text for training or improvement
Public claim only
The privacy policy lists as a purpose 'designing, developing and improving products and services, including digital solutions powered by artificial intelligence'. The AI project page states the organisation held 'thousands of samples of natural language text describing legal problems' from an online intake system launched in 2018 and used annotated samples from those help-seekers to train its proof-of-concept model. Neither document states whether text entered into SmartAssist today is retained for, or used in, training or tuning.
Ask: Is text submitted to SmartAssist used to train, tune or evaluate any model, by you or by any provider, and can a user decline that use while still using the tool?
Use of user feedback on AI results
Not confirmed
No rating, thumbs, correction or feedback mechanism for SmartAssist results is described on the tool page or the resources page, and the privacy policy addresses complaints and feedback about services generally rather than AI output. Nothing published states what happens to a user's report that a result was wrong.
Ask: Can a user report an incorrect SmartAssist result, who reviews those reports, and is the feedback used to change the model or the resource library?
Retention of submitted text
Public claim only
The privacy policy, last updated 14 May 2024, states that for clients, service users and suppliers, copies of documents 'will generally be kept for at least 7 years after the date that your file has been closed'. It says nothing about text entered into a public tool, and the tool page gives no retention statement. Whether a submission is stored at all is not published.
Ask: Is a SmartAssist submission stored, and if so for how long, in which system, and is it linked to an IP address or session identifier?
Deletion on request
Not confirmed
The privacy policy sets out access and correction rights, a 30-day response target and identity verification, and a complaints path, but states no deletion or erasure right and no process for deleting a submission. The tool has no account, so there is no self-service deletion path described.
Ask: How can a person ask for a SmartAssist submission to be deleted, what is the timeframe, and does deletion extend to logs and backups?
Who can read submitted text
Not confirmed
Nothing published states whether staff, volunteers, contractors or service providers can read text entered into SmartAssist, or under what controls. The privacy policy names contracted service providers as recipients of personal information generally and states access to computer systems is restricted, without addressing this tool.
Ask: Which roles can read SmartAssist submissions, is that access logged, and are submissions ever reviewed by staff or pro bono lawyers?
Access control
Public claim only
The privacy policy states steps including 'access restrictions to our computer systems requiring multi-factor identification (such as login and password protection)', restricted access to premises and files, and staff training with workplace policies. These are general organisational statements; the tool itself has no user account, and no administrative or role model is published for it.
Ask: Which internal system receives SmartAssist submissions, and what access control and logging applies to it?
Encryption
Public claim only
The privacy policy states 'we use a secure server using the latest SSL (secure sockets layer) encryption technology to process any financial transactions' and lists 'website protection measures (such as encryption, firewalls and anti-virus software)'. No statement of encryption at rest for submitted text, no algorithm or key management detail, and no statement about encryption in transit to any model provider was found.
Ask: Is SmartAssist submitted text encrypted in transit and at rest, and who holds the keys?
Independent assurance
Not confirmed
No SOC 2, ISO/IEC 27001, ISO/IEC 42001, penetration test summary or other security assurance is claimed on the pages read, and no security page or trust centre was surfaced by a 60-URL site map. The badges published in the site footer are registration as a charity with the Australian Charities and Not-for-profits Commission and accreditation as a Community Legal Centre certified by Community Legal Centres Australia, which are sector accreditations rather than information-security certifications.
Ask: Has SmartAssist or its hosting environment been independently assessed for security or AI governance, and can you share the report or certificate?
Contractual position
Not confirmed
No terms of service, services agreement, data processing agreement or standard contract for the tool was found in the material read. The only documents the form requires acceptance of are the privacy policy and a Disclaimer and Conditions of Use; the latter was not opened within the operation budget. The privacy policy states it is accepted 'by accessing our website, services or otherwise providing us with your personal information'.
Ask: Is there any written agreement or data processing agreement governing SmartAssist, for users or for partner organisations?
Cross-border disclosure
Public claim only
The privacy policy's cross-border section states 'We may disclose or store your personal information to our contracted information technology service providers that are hosted offshore or in cloud via Amazon Web Services (AWS). You agree that we may disclose your personal information in this manner, notwithstanding that privacy laws in such countries may differ.' No country or region is named, and the policy commits only to 'reasonable steps' to ensure overseas recipients abide by the Australian Privacy Principles.
Ask: Which countries can SmartAssist submissions reach, and what contractual safeguards apply to each overseas recipient?
Incident and breach notification
Not confirmed
No breach notification commitment, timeframe or security contact is published in the privacy policy or on the tool page. The published escalation path is a complaint to the Privacy Officer, with a 30-day response target, and referral to the Office of the Australian Information Commissioner if the complainant is unhappy with the response.
Ask: If SmartAssist submissions were exposed, who would you notify, within what time, and how would affected users be reached given the tool has no accounts?
How changes are communicated
Public claim only
The privacy policy states 'You indicate that you accept the terms of this Privacy Policy (as amended from time to time) by accessing our website, services or otherwise providing us with your personal information. Please regularly review our Privacy Policy so that you are aware of changes.' It carries a 'Last updated 14 May 2024' date. No change log, notice period or version history is published for the AI tool itself.
Ask: How will you tell users if SmartAssist's model, data sources or retention behaviour changes materially?
Exit and data portability
Not confirmed
No export, download, portability or account-closure provision was found. The tool has no account on the pages read, and the privacy policy provides for access requests, for which it says a fee may be charged to cover reasonable costs of locating, retrieving and sending the information.
Ask: If an organisation adopted SmartAssist or its model, what would it get on exit, and in what format?
Connectors and integrations
Public claim only
The tool page carries a third-party bot-protection widget marked 'Protected by ALTCHA'. The privacy policy names Google Analytics, HotJar, Laravel, Google Ads and Meta Audience Network as cookie and analytics technologies used across the organisation's websites. No integration between SmartAssist and any case management, intake or referral system is described; the organisation's online application platform and Justice Connect Answers are published as separate services on separate subdomains.
Ask: Does SmartAssist pass anything to your intake platform, referral systems or analytics tools, and can a submission be linked to a later application?
Whether the tool reaches outside its own content
Public claim only
The tool page states SmartAssist 'uses artificial intelligence (AI) to search Justice Connect's library of legally reviewed resources', which describes a defined internal source set. Nothing states whether the tool also queries the open web, whether any request leaves the organisation's environment, or whether results are limited to the resource library in all cases.
Ask: Does SmartAssist ever retrieve from the open internet or any source outside your own resource library?
What the tool does beyond returning information
Not confirmed
The flow described on the tool page ends with resources shown to the user, with a prompt to read the linked source resources. Nothing states whether a submission creates a record, opens an intake application, generates a referral or notifies staff, and no agentic or action-taking behaviour is described.
Ask: Does a SmartAssist submission create any record, referral or notification, and can a user submit without anything being retained?
Human review of output
Public claim only
The resources SmartAssist searches are described as 'legally reviewed', and the AI project page describes pro bono lawyers annotating training samples, so human review is described over the content and the training data rather than over individual answers. The user is directed to 'always read the source resources linked in the results carefully' and to 'consult a qualified lawyer before acting on any information'. No review of an individual AI result before it is shown is described.
Ask: Is any SmartAssist result reviewed by a person before or after it is shown, and how are incorrect matches detected?
