AUSTRAC was hard.
The OAIC will be harder.
Your privacy policy has been reviewed by practitioners. It meets many existing compliance obligations — but it does not name the AI-assisted tools your team uses when making decisions about clients. APP 1.7 closes that gap on 10 December 2026.
APP 1.7 commences 10 December 2026. It requires disclosure of any computer program that contributes to decisions about clients. You're disclosing where your data goes. You're not disclosing the programs that make the decisions.
Built by AI governance practitioners. Sam Banerjee — PhD Researcher in Responsible AI (UTS), 25 years in regulated industries, MAICD. Rae Dev — 18 years inside Privacy Act entities, APRA-regulated institutions and AFSL-holder environments. Every assessment signed by both.
One obligation. Three pressures. One document closes all of them.
The Scorecard maps your specific gap, your specific exposure, and the documentation your professional body, your insurer, and your clients are starting to ask for.
A thorough privacy policy. The one new obligation is missing.
Your policy covers the existing APPs well. APP 1.7 — commencing 10 December 2026 — requires disclosure of computer programs that make or substantially contribute to decisions affecting your clients, using their personal information. Your policy doesn't contain those disclosures yet.
Tools identified in your public digital footprint. None named in your policy.
Standard market intelligence on your firm identifies several AI-adjacent tools that are not named in your published policy. Under s.13G, failure to maintain a compliant privacy policy attracts compliance notices and infringement notices — up to $66,000 per breach for corporations. Civil penalty proceedings ($3.3M and above) are reserved for serious or repeated interference; the realistic exposure for an unupdated policy is the infringement notice tier. The Scorecard identifies which of those tools actually contribute to decisions about clients — that's where APP 1.7 applies.
A scorecard maps your firm's exact obligations
Your specific gap. Your partially-disclosed tools. Your penalty band under s.13G. A minimum-action roadmap — with the documentation your professional body and PI insurer will expect to see. $497. Delivered in 48 hours. Practitioners have already reviewed your published policy.
Fixed fee · 48-hour delivery · signed by practitioners
PhD Researcher in Responsible AI at the UTS Data Science Institute. 25 years building and exiting technology ventures across banking, finance and regulated industries. Advises Audit and Risk Committees on Shadow AI exposure and director liability under the 2026 Privacy Act reforms.
18 years inside regulated organisations evaluating AI and SaaS implementations and designing governance structures. Built AI governance registers for Privacy Act entities, APRA-regulated institutions and AFSL-holder environments. Every Attesta assessment is practitioner-prepared and personally delivered.
The tools in your firm's stack — mapped against your policy.
Every tool below is identified in your firm's public digital footprint via standard market intelligence, cross-referenced against your published privacy policy. Two categories: tools absent from your policy entirely, and tools your policy names but not as AI or automated systems. The Scorecard confirms which of these actually contribute to decisions about clients — that's where APP 1.7 applies.
Public digital footprint identified via standard market intelligence. Cross-referenced against your firm's published privacy policy. The Scorecard confirms which tools actually contribute to decisions about clients.
Know exactly where you stand.
Know exactly what to do.
Delivered as a completed PDF — not a template, not a form for you to fill in.
| Requirement | Status |
|---|---|
| APP 1.7 AI system disclosure | ✕ Not met |
of completing your 15-minute assessment
Less than one hour of PI exclusion-clause negotiation.
Ready immediately. Not legal advice — your existing solicitor reviews before action.
Your questions answered
You answer 12 questions about your firm's tools, policies, and governance position. Practitioners cross-reference your answers against your published policy and the AI-adjacent tools identified in your firm's public digital footprint. The completed PDF contains your exposure score, penalty figure, PI gap flag, and prioritised action list. Delivered within 48 hours.
Yes. APP 1.7, 1.8 and 1.9 were introduced by the Privacy and Other Legislation Amendment Act 2024 (Cth) and commence on 10 December 2026. They apply to any APP entity that arranges for a computer program to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests — using personal information about that individual. The OAIC's published guidance on Chapter 1 of the APP guidelines confirms this commencement date.
For failing to maintain a compliant privacy policy under APP 1.4, the OAIC can issue compliance notices and infringement notices of up to $66,000 per breach for corporations under s.13G. The larger civil penalties ($3.3M for moderate, up to $50M / 30% of turnover for serious or repeated interference) are reserved for civil penalty proceedings, which require demonstrating serious or repeated interference with privacy. The Scorecard gives you the realistic figure for your firm's profile, not the maximum statutory cap.
No. Attesta delivers practitioner-prepared compliance documents — not legal advice. The Scorecard maps your firm's obligations against APP 1.7. Your existing solicitor should review the output before you act on it.
Templates require you to inventory your own tools and judge your own obligations. The Scorecard is the reverse: practitioners have already reviewed your firm's published policy, identified the AI-adjacent tools in your firm's public digital footprint, and separated them into undisclosed (absent from policy) and partial (named, but not as AI). You confirm or correct. The final document is specific to your firm.
Ready to handle this before 10 December?
See your firm's gap — $497 →Signed PDF · 48-hour delivery · practitioner-prepared