WHAT IS INSIDE Four information categories What may be pasted into an approved tool, what may never be, and a five-second decision staff can make at their desk
Approved tools Six questions to add one without convening a committee, plus the eight vendor changes that undo an approval
Client, patient and other regulated information Nine conditions, all of which have to be met and recorded. Written to be quotable to a client, an insurer or a regulator
Connected AI, agents and automated actions What the tool is allowed to do, not just what goes in. Follows the Australian Signals Directorate guidance on agentic AI published in May 2026
Human review, ownership and provenance Which outputs a person must check, who owns what came out, and what the vendor terms actually permit
Automated decision transparency The disclosure obligation under Australian Privacy Principles 1.7 to 1.9, which commences 10 December 2026
Disclosure and reporting a mistake When AI involvement has to be declared, and a no-fault reporting clause, because concealment is the expensive outcome
A two-page staff quick guide Sent alongside the policy. The desk version, printable and pinnable, with the same four categories on one page
