Australia’s privacy regulator distinguishes using commercially available AI products from developing and training generative models. Both can expose personal information, but the responsible decisions differ.
The two October 2024 guides
On 21 October 2024, the Office of the Australian Information Commissioner released guidance for entities using commercially available AI and separate guidance for developing and training generative AI models. They address organizations subject to the Australian Privacy Act where relevant. A business should not assume that passing a vendor security review satisfies its independent obligations.
Before using an off-the-shelf assistant
Identify the intended purpose, data classification and potential exposure of personal information. Read provider terms covering prompts, retention, human review, optional training and subprocessors. The regulator has cautioned against entering personal information, particularly sensitive information, into publicly available generative tools without an appropriate basis and controls.
Before training a model
Understand data provenance, notice, lawful collection and use, minimization, security and re-identification risks. A model trained on vast collected material does not erase the privacy interests embedded in that data. Review whether individuals could reasonably expect their information to be used in this manner.
Practical review of outputs
Generated summaries may invent facts about named individuals, repeat confidential fragments or expose people in small groups. Provide correction and complaint paths, and validate outputs before using them for decisions. Evaluate separately whether external retrieval or tool integrations introduce new recipients.
Example: recruiting administration
A team plans to rank CVs using an externally hosted AI product. Before deploying, it reviews necessity, collection notices, bias, role-based access, retention and human decision authority. It tests the system on representative permitted cases, including errors affecting smaller applicant groups.
Scope note
OAIC guidance is authoritative Australian regulatory guidance checked 25 October 2026. Its specific legal application depends on the entity, nature of information and processing; no claim is made that one check-box renders a tool compliant.
Sources & Further Reading
- Privacy guidance for commercial AI products — OAIC Australia.
- Privacy guidance on developing generative AI — OAIC Australia.
Guidance varies by jurisdiction and application. This is general education, not legal, medical or other professional advice.