AI Governance Audit
AI Governance Audit for Australian Businesses
From 10 December 2026, Australian businesses must disclose automated decision making in their privacy policies. The OAIC is already sweeping. Most businesses using AI cannot list where it touches personal information. This audit finds out, documents it, and makes you compliance-ready before the deadline.
What the audit covers
Full inventory of AI touchpoints
We map every place AI touches personal information across your tools and workflows, so you can actually list it.
Documented data flows
Clear, auditable documentation of how data moves into, through and out of each AI system.
Privacy policy disclosure language
Ready-to-use disclosure language for automated decision making, written for the December 2026 amendments.
Compliance-readiness report
A prioritised report of fixes, ranked by risk and effort, so you know exactly what to do first.
Who needs it
Businesses over $3M turnover
The Privacy Act applies. Automated decision disclosure is now a requirement, not an option.
All health providers
Health providers are APP entities with higher obligations. If you use AI, you need this.
Government contractors
Public sector procurement increasingly requires evidence of AI governance.
Any SME using AI tools without a policy
If your team uses ChatGPT, Copilot or similar on real work and you have no policy, you are exposed.
Why now
60
days to the deadline. From 10 December 2026, automated decision making must be disclosed in privacy policies.
OAIC sweep active
The Office of the Australian Information Commissioner is already reviewing how businesses use AI.
$66k
in penalties per breach for serious or repeated privacy failures.
How it works
Discovery
We map your tools, workflows and where AI is already in use across the business.
Audit
We assess each touchpoint against the Privacy Act and the 2026 amendments.
Documentation
We document the data flows and write the disclosure language for your privacy policy.
Handover
You receive the compliance-readiness report and a prioritised fix plan.
Compliance framing
Inherited controls, not claimed certifications
We do not claim certifications directly. Controls are inherited from our build platforms, including Base44 (SOC 2 Type II). Our work is aligned to the frameworks that matter in Australia.
- Privacy Act 1988
- Essential Eight
- Australian data residency
- 2026 Privacy Act ready
FAQ
AI governance audit FAQ
Any decision made wholly or partly by AI that affects an individual, from eligibility checks to personalised pricing. If a tool uses AI to decide something about a person, it counts.
Book an AI governance audit
Find out where AI touches personal information in your business, and get compliance-ready before 10 December 2026.
Book an AI governance audit