AI compliance for mortgage brokers means applying Australian credit, privacy and consumer protection laws to every AI-assisted task. A tool can draft an email or summarise a document, but the broker and licensee retain their obligations. Before using client information, establish what the tool receives, what its provider can do with it and who checks the output.
Is There an AI Law in Australia?
No, Australia has no single, economy-wide AI Act. AI regulation in Australia relies on existing laws, supported by government guidance for responsible adoption. The National AI Plan keeps established legal and regulatory frameworks as the foundation for managing AI risks.
Government AI adoption guidance helps a brokerage assess its practices. Following voluntary guidance does not itself establish compliance with the National Consumer Credit Protection Act 2009 (NCCP Act) or the Privacy Act 1988.
Other existing laws can also apply. Misleading communications, discriminatory treatment and breaches of confidence can create liability when AI contributes to the conduct. The National AI Centre’s explanation of AI and Australian law maps these risks to existing protections.
The EU AI Act uses a separate risk-based system, including rules for certain creditworthiness assessments. Overseas coverage does not describe the Australian rulebook. A brokerage operating across borders must assess whether EU territorial rules also apply to its activities.
What ASIC Expects From Licensees Using AI
The Australian Securities and Investments Commission (ASIC) expects licensees to manage AI risks through their existing compliance arrangements. Report 798, Beware the gap, examines AI use by financial services and credit licensees. It asks who is accountable, what human oversight is needed and how third-party models are monitored.
These are regulator expectations about meeting existing obligations, not a separate AI licence. Section 47 of the NCCP Act requires credit activities to be conducted efficiently, honestly and fairly. It also addresses compliance arrangements, competence and risk management. Outsourcing a task to an AI provider does not transfer the licensee’s responsibility.
Responsible lending still requires reasonable inquiries into the client’s circumstances and objectives, verification of their financial situation and a preliminary assessment of unsuitability. An AI summary does not establish that the underlying information is accurate. ASIC explains those steps in RG 209 and its responsible lending guidance.
The best interests duty (BID) also continues when AI drafts a recommendation. The broker must assess the client’s circumstances and explain why the recommended product serves their interests. RG 273, Mortgage brokers: Best interests duty, explains ASIC’s approach, including evidence of the broker’s reasoning.
Keep a record of the source information checked and the reasons for the recommendation. A fluent AI explanation cannot replace those reasons.
Privacy Act Duties When AI Touches Client Data
The Australian Privacy Principles (APPs) apply to a brokerage that is an APP entity under the Privacy Act. They cover personal information entered into an AI tool and personal information the tool generates about an identifiable person.
The Office of the Australian Information Commissioner (OAIC) recommends avoiding personal information in publicly available generative AI tools as a matter of best practice. Its guidance on commercially available AI products also calls for due diligence before adoption. A paid subscription alone does not answer the privacy questions.
Before uploading a client document, answer these questions for the proposed task:
- What information does the task need? Remove unrelated documents and personal details.
- Does APP 6 permit this use or disclosure for the collection purpose, or does a secondary-purpose exception apply?
- Can the provider retain the information, use it for training or let other people access it?
- Will an overseas provider or subcontractor receive it? Assess APP 8 where the arrangement is an overseas disclosure.
- What security controls protect uploads, outputs and connected accounts? Assess APP 11 and the deletion arrangements.
A privacy notice explains handling practices. It does not automatically supply consent or make an otherwise unauthorised disclosure lawful. Update the privacy policy and collection notices to reflect the actual AI use.
APP 8 overseas disclosure depends on the recipient and the brokerage’s effective control of the information. For security, the OAIC’s guide to securing personal information explains why outsourcing does not remove APP 11 duties where the brokerage still holds the information.
AI Compliance Checks for Common Broking Tasks
Review AI outputs before sending them to clients, saving them as factual records or relying on them in a credit assessment. The review must address the task’s actual risk.
| Broking task | Rules engaged | Check before use |
|---|---|---|
| Drafting a client email | APP 6 and prohibitions on misleading representations | Use only authorised information. Check the recipient, figures and product statements against the file before sending. |
| Summarising bank statements | Responsible lending verification, APP 6 and APP 10 | Reconcile income and expense totals to the statements. Investigate omitted transactions and keep the supporting records. |
| Writing a file note | APP 10 and evidence of compliance with BID | Compare the draft with the conversation or source notes. Correct invented statements and distinguish the client’s words from the broker’s assessment. |
| Recording and transcribing a call | APP 3, APP 5, APP 6 and applicable recording laws | Establish the recording authority and explain the capture and AI handling before recording. Review the transcript against the audio before relying on disputed details. |
APP 10 addresses the accuracy, completeness and currency of personal information. It also requires relevance when information is used or disclosed. APP 5 deals with collection notices. Recording laws add separate requirements that depend on the jurisdictions involved and any applicable exceptions.
In a hypothetical file, an AI summary classifies transfers between a client’s own accounts as income. The broker identifies the transfers in the statements and corrects the summary before assessing affordability. The file records the error, the corrected treatment and the supporting statement entries.
Use a short review record that identifies the tool and task, the source documents, the checks performed and the reviewer. Record unresolved discrepancies and the final decision. Keep the review with the accepted output so someone reading the file can follow what the broker relied on.
Confidentiality, Aggregator and Lender Terms
Aggregator agreements, lender terms and confidentiality obligations can restrict AI use even where a privacy assessment permits it. Approval to access a lender portal does not necessarily authorise a separate AI service to read its contents.
Before connecting a tool to a customer relationship management system (CRM), mailbox or lender portal, inspect the relevant agreements for:
- Limits on confidential information, permitted purposes and disclosure to third parties.
- Prior approval requirements for outsourcing or subcontractors.
- Restrictions on overseas access, processing locations and onward disclosure.
- Credential sharing, automated access and application programming interface permissions.
- Provider rights to reuse data, retain copies or train models.
- Incident notification, audit access and return or deletion of information when access ends.
Record the clause and any written permission that supports the connection. If the agreement prohibits the proposed access, use a permitted workflow or obtain the required permission first. A client’s agreement to AI use does not waive a lender’s or aggregator’s contractual rights.
Rules Still to Come
Automated-decision transparency requirements add privacy-policy duties for qualifying arrangements when their commencement provisions take effect. The OAIC’s automated-decision transparency resources explain the conditions and exact commencement boundary.
The rules cover programs that make a decision or do something substantially and directly related to making it. The decision must reasonably be expected to significantly affect an individual’s rights or interests, and the program must use their personal information. Human involvement does not automatically exclude the arrangement. Required policy information includes the kinds of personal information used and the kinds of decisions involved.
Keep enacted changes separate from consultation proposals. Follow ASIC, OAIC and Australian Government notices, then record which brokerage tasks each change affects. The guide to Privacy Act changes covers the reforms in more detail.
For each approved AI task, assign a review owner and a trigger for reassessment when the provider, purpose or data access changes. AI governance covers those responsibilities. Put the resulting staff permissions and restrictions in an AI policy before extending access to more client files.
