Broker guide
OAIC AI Guidance for Mortgage Brokers
The OAIC’s guidance on commercial AI products says what to check before staff enter personal information. See the steps applied to a brokerage.
- Published
- Updated
The OAIC AI guidance asks businesses to assess privacy risks before using AI with personal information and to keep reviewing that use. For a mortgage brokerage, that means approving specific tasks and controlling which client details staff can enter.
The Office of the Australian Information Commissioner (OAIC) explains how existing privacy obligations apply to AI. Its guidance combines explanations of the law with best-practice recommendations. Keep that distinction in your approval records and staff instructions.
What the OAIC AI Guidance Covers
The OAIC’s commercial-products guidance covers organisations using AI systems that handle personal information, including information generated in their outputs. Its separate development guidance covers building or adapting models.
- Guidance on privacy and the use of commercially available AI products was published in 2024 and updated in 2025. This is the starting point for a brokerage choosing tools.
- Guidance on privacy and developing and training generative AI models was published and updated in 2024. It also covers fine-tuning and supplying personal information to a developer for training.
Using a tool for file summaries differs from providing client files to train a model. If a proposed contract includes training on those files, assess that use separately before approving it.
For entities covered by the Privacy Act, the Australian Privacy Principles still govern their handling of personal information. Buying an AI subscription doesn’t transfer those obligations to the vendor.
Due Diligence Before You Choose an AI Tool
Assess the tool against the task your staff will perform, then retain the evidence behind the approval. The OAIC’s selection checklist covers suitability, data sources and security, alongside access to inputs.
Use the following questions for any vendor. Write the answer beside the supporting contract clause or technical document.
- Define the task. Separate drafting general marketing copy from summarising identifiable client files. Record which information the task actually needs.
- Establish suitability. Ask which training data supports the task and how the vendor tests its outputs. Identify likely errors and how a broker will detect them.
- Trace the information. Record what leaves the brokerage, where it is processed and which parties can access it. Include connected systems.
- Examine security. Record the access controls and the vendor’s response to security incidents. Identify who can remove a departing staff member’s access.
- Check secondary use. Establish whether prompts or uploads can be used for training. Record the controls available under the actual account and contract.
- Assign oversight. Name the person who checks outputs before they enter a client file or reach a client. Set a review trigger for changed terms.
For example, a hypothetical brokerage approves an AI tool for drafting generic email wording. That approval doesn’t cover uploading a client’s payslips. The approval record must identify the permitted task, so staff can see when a new assessment is needed.
Keep a rejected use in the record too. A missing explanation of who receives client data is a reason to withhold approval for that task. Record what evidence would allow reassessment.
Do Not Enter Personal Information Into Public Tools
The OAIC recommends, as best practice, keeping personal information out of publicly available generative AI tools, especially sensitive information. This recommendation appears in its commercial AI takeaways.
Make the staff rule explicit in your AI policy: public AI tools must not receive identifiable client material. Cover pasted text and file uploads, as well as meeting recordings and connected accounts.
Removing a name alone can leave a client identifiable. An employer, property address or unusual combination of circumstances can reveal who the person is. Use a wholly fictional example when asking a public tool for generic wording.
Incorrect information about an identifiable person can also be personal information. An invented explanation of a client’s financial position needs correction before anyone relies on it or saves it as fact.
An enterprise account needs its own assessment. The OAIC’s workplace guidance discusses managing training access and retention settings. A paid account label alone doesn’t establish what happens to client data.
If staff enter client information into an unapproved tool, stop further uploads and notify the brokerage’s privacy lead. Preserve the facts needed to assess the incident under your existing response process.
Privacy Impact Assessment
A privacy impact assessment (PIA) records how a proposed activity affects people’s privacy and how the brokerage will manage those effects. Begin before the tool’s design and contract are settled.
The OAIC’s PIA guide recommends an initial threshold assessment for projects involving personal information. More complex information flows call for a fuller assessment. Treat AI access to client files as a reason to assess the proposed use before enabling it.
Use these fields as a practical privacy impact assessment template for your approval record.
| Record | What the brokerage writes |
|---|---|
| Proposed use | The task, users and intended output |
| Information flow | The client information collected, its recipients and storage locations |
| Privacy effect | What could happen to a client if information is exposed or an output is wrong |
| Controls | Restrictions on inputs, access, retention and reliance on outputs |
| Remaining risk | The risk after controls, with the person authorised to accept it |
| Follow-up | Actions, owners and the events that trigger reassessment |
For example, an AI meeting summary can record a client’s health disclosure even when the intended task is summarising loan requirements. Assess how to prevent unnecessary collection before recording starts.
A completed form doesn’t resolve an unmanageable risk. Change the proposed task or keep that use disabled when the controls don’t protect the client. Your AI governance process can assign the approval and follow-up responsibilities.
Transparency With Clients
Explain how the brokerage uses AI where that use affects its handling of personal information. Keep the privacy policy consistent with the actual tools and approved tasks.
Australian Privacy Principle 1 requires covered entities to maintain a clearly expressed, up-to-date privacy policy. Describe the information handled and its purposes, including relevant disclosures to service providers.
The collection notice serves a different moment. Under Australian Privacy Principle 5, take reasonable steps to give the relevant information at or before collection. If that isn’t practicable, do so as soon as practicable afterwards.
For a proposed AI meeting recorder, explain the recording and processing before the meeting starts. Make the explanation understandable to the client and provide a contact for questions. Identify a client-facing chatbot as AI.
Updating a notice doesn’t itself authorise every use of client information. Assess the permitted purpose and any consent requirement separately. Before enabling the tool, compare the approved information flow with what clients are told and what staff are allowed to do.
