AI disclosure tells clients how your brokerage uses AI to handle their information. Put that explanation in your privacy documents, give clients notice when collecting their information and ask for express consent before an AI note taker records a meeting.
The legal duties depend on whether your brokerage is covered by the Privacy Act 1988 and what the tool does. A notice explains the handling. Consent records the client’s agreement to a particular activity. Treat them as separate steps.
When Clients Must Be Told About AI
For a brokerage covered by the Privacy Act, Australian Privacy Principle (APP) 1 requires a clear, up-to-date privacy policy about its handling of personal information. Explain AI use wherever it changes that handling. Include the information collected, its purposes and usual disclosures, plus relevant overseas disclosures. The Office of the Australian Information Commissioner’s APP 1 guidance sets out the policy requirements.
APP 5 deals with the particular collection. Your brokerage must take reasonable steps to notify the client of the relevant matters, or ensure they know them. Do this at or before collection. If that is not practicable, do it as soon as practicable afterwards.
An AI meeting tool gives you an opportunity to explain the collection before switching it on. The APP 5 guidelines cover the information a collection notice must provide.
For example, explain that a meeting service receives the client’s voice and discussion, produces a transcript and sends a draft summary to the broker. A client who uploads documents also needs to understand any AI processing of those documents. A general sentence about using technology does little to explain either activity.
A privacy policy does not itself authorise every use of client information. The OAIC’s guidance on commercially available AI distinguishes notice from consent and addresses lawful collection, use and disclosure. Consent is usually required when an AI tool collects sensitive information, subject to the applicable exceptions. Health information discussed during a meeting can bring that requirement into the conversation.
Automated Decisions Need Extra Policy Detail
The Privacy and Other Legislation Amendment Act 2024 adds privacy-policy duties for certain uses of computer programs, including systems that support human decisions. Under APP 1.7, all these conditions must be met:
- Your brokerage arranges for a computer program to make a decision, or do something substantially and directly related to making it.
- That decision could reasonably be expected to significantly affect an individual’s rights or interests.
- The program uses personal information about that individual to perform the relevant task.
Where the test applies, the policy must identify the kinds of personal information used. It must also describe the kinds of decisions made solely by programs and those where programs perform the relevant supporting task. Human review does not automatically put a system outside this test. The OAIC’s automated decision-making explanation gives the conditions and exact commencement date.
The extra duties commence the day after the statutory 24-month period beginning with the Act’s Royal Assent ends. The Act’s commencement table specifies that boundary. Existing privacy-policy and collection-notice duties apply independently of that commencement.
A tool that drafts a routine appointment reminder has a different role from a system that materially informs a client’s access to credit. Assess the actual decision and the program’s contribution before deciding what the policy needs to say.
What an AI Disclosure Statement Says
Describe each AI tool through its tasks and the client information it handles. Explain who reviews its outputs before use. Write the AI disclosure statement from your approved tool settings and provider terms, so it matches what happens to a client’s information.
Cover these details in the full statement or its clearly identified supporting schedule:
- The provider and product names, including any separate transcription service.
- The tasks each tool performs, such as preparing meeting notes or drafting correspondence.
- The client information each tool receives, including audio, uploaded documents and information it generates about the client.
- Storage locations and relevant overseas recipients, with countries identified where required and practicable.
- Who can access the information, retention periods and the provider’s treatment of information for model training.
- The broker’s review of every output before it is relied on or added to the client file.
- Your privacy contact, the access and correction process and the alternative to recording.
Do not promise Australian-only storage, immediate deletion or exclusion from model training unless your provider arrangements support the promise. A setting for one product or account does not establish how another tool handles information.
Credit Guide Sample
Sample wording to adapt, not legal advice. This example assumes your privacy policy names the approved tools and explains their handling of information.
We use the AI tools identified in our privacy policy to help prepare draft meeting notes and correspondence. Your broker reviews every output before using it in your credit assistance. Our privacy policy explains which information the tools receive, where it is handled and how to raise a privacy question. We ask for your agreement before recording a meeting and can take notes manually if you decline.
Treat this as additional privacy information within an approved credit guide or accompanying document. The National Consumer Credit Protection Act 2009 sets the credit-guide duties in sections 113 and 158. The required content depends on whether you are a licensee or credit representative. Keep the identification, licence or representative details, fees and complaint information required for your role.
AI wording must preserve those disclosures and the guide’s delivery timing. The Australian Securities and Investments Commission’s credit disclosure overview, INFO 146 explains the applicable documents and role differences. Obtain your licensee’s approval before changing its credit guide.
Privacy Policy Sample
Sample wording to adapt, not legal advice. Add this clause to a complete privacy policy with a completed AI tools schedule.
We use AI tools to prepare draft meeting notes and correspondence from information you provide during our services. The AI tools schedule forming part of this policy names each product and provider. It explains the tasks, information received, storage countries, access arrangements and retention periods for each tool, including its use of information for training. Your broker checks every output before relying on it. We seek your agreement before recording a meeting. You can ask your broker about manual notes or contact our privacy contact about access, correction or a complaint.
Complete the schedule with the actual products and their arrangements before adopting the clause. If the automated decision-making test applies, add the required information about the kinds of personal information and decisions. A meeting-notes clause cannot describe a separate decision system by itself.
Email Signature Sample
Sample wording to adapt, not legal advice. This example assumes you have already provided the relevant collection notice.
We use approved AI tools to help prepare drafts, which your broker reviews. Our privacy policy explains how those tools handle client information. We ask before recording meetings and can take manual notes instead.
In the final signature, link the words “privacy policy” to your brokerage’s policy. A short AI disclaimer on an email or document identifies AI assistance and review. The full disclosure statement explains the information handling behind it. Use the short line as a reminder after the full notice, without treating it as permission to upload documents or record a call.
Consent for AI Note Takers and Recording
Ask each participant for an express answer before starting an AI scribe or recording tool as your brokerage’s standard practice. Explain the recording and transcription, the purpose, who receives the information and the alternative. Arrange this before a bot joins or an automatic recording begins.
The OAIC identifies consent to collecting sensitive information as a requirement in its AI meeting example, subject to the applicable exceptions. It recommends seeking consent as best practice given the uncertainty of what people will discuss. Separate recording laws can also apply. Use the record phone call guide for those rules before recording client conversations.
For valid privacy consent, the client needs to understand the proposed handling and its consequences. They must have a voluntary choice, and consent must be current and specific. The OAIC’s consent guidance explains these conditions. A signature acknowledging receipt of a privacy policy does not by itself establish agreement to a particular recording.
Recording Consent Script
Sample wording to adapt, not legal advice. Name the actual tool and explain its storage and access arrangements before asking the final question.
With your agreement, I would like to use our AI meeting tool to record this conversation and prepare a transcript and draft notes for your loan file. I will check the output. The privacy information I sent explains the provider, storage and access arrangements. We can continue with manual notes if you prefer. Do you agree to the recording and AI transcription for this meeting?
Keep the tool off while you ask. Record each participant’s answer in the client file, together with the meeting details, tool name and notice version provided. If you use an AI consent form, describe the particular activity and record the client’s choice separately from general service terms.
If a client says no, disable the recorder and remove the note-taking bot. Continue with manual notes, and do not send those notes through the same AI tool without a separate basis for that processing. If someone joins late, pause recording while you explain the tool and obtain their answer. If agreement is withdrawn, stop the recording and assess how to handle material already collected under the applicable obligations.
Update Your Client Documents
Update every document that explains AI use from one approved description of your tools and information flows. The privacy policy carries the full explanation. A collection notice gives information relevant to the collection, while the credit guide and meeting invitation can direct clients to those details.
- List the approved tools and confirm their tasks, information inputs, storage arrangements and training settings. Include meeting bots that join automatically.
- Update the privacy policy and its AI tools schedule. Use the privacy policy template to organise the wider policy alongside the AI clause.
- Put the relevant notice before the document upload or meeting collection starts. The privacy collection notice helps you place that explanation at collection.
- Add the approved short explanation to your credit guide or accompanying privacy information, meeting invitations and relevant email signatures. Keep any recording-consent request separate and visible.
- Give staff the consent script and a way to record each answer. Set the note taker to wait until the broker starts it after agreement.
- Follow a dummy client journey from invitation to saved notes. Confirm the client sees the notice before collection, refusal leaves the recorder off and the file retains the consent record.
If a tool captures audio before the broker asks, change its automatic-join or recording settings before the next client meeting. If the policy and invitation name different providers, reconcile the wording with the approved tool list. Repeat that document check whenever you add a tool or change its information handling, so the client’s explanation continues to match the service.
