OAIC guidance: commercially available AI products
The regulator's guidance on what the Privacy Act expects when a business adopts an off-the-shelf AI product, including due diligence and what can go into public tools.
- Status
- In force · Australia (Commonwealth) · OAIC
- Applies to
- APP entities using off-the-shelf AI tools
- Primary source
- Official document →
- Last reviewed
- 17 July 2026
Certrak’s verdict
The short version
One or two plain sentences: what this is, and whether it bites for a typical business.
What it actually requires
The substance in plain language. Quote the source where the exact wording matters.
Does this reach your business?
Who it applies to, and the common situations where it does or does not.
What sensible looks like
Practical, proportionate steps. Not legal advice: what a reasonable operator would do.