Govern · Second step, AI Governance & Compliance stream
Are you exposed under the Privacy Act's AI reforms?
The Privacy Act's automated decision-making transparency obligation takes effect 10 December 2026, already confirmed law, with penalties reaching $50 million or 30% of turnover for serious breaches. A further reform package (AI-training consent, data minimisation, human review rights) is still before Parliament. This is a fixed-scope gap assessment against the confirmed deadline and the National AI Centre's 6 Essential Practices, with a roadmap that tracks what's coming next, not a generic audit.
What this covers
Privacy Act 2026 gap assessment
The confirmed automated decision-making transparency obligation (10 December 2026), plus the AI-training consent, data minimisation and human-review provisions still before Parliament, assessed against what your business actually does today, not a generic checklist.
6 Essential Practices alignment
The National AI Centre's Guidance for AI Adoption framework: governance and accountability, impact assessment, risk management, transparency, testing and monitoring, and human oversight, mapped against your current AI use.
AI acceptable-use policy
Which tools are approved, what data can and cannot go into them, and who signs off a new tool before staff start using it: a policy ready to publish, not a template to fill in yourself.
Governance accountability structure
A named owner for AI governance, not diffuse responsibility spread across IT, legal and whoever raised it last. The same discipline behind founding and chairing a Cyber Risk Committee from scratch at a four-country children's services enterprise.
Outcomes
What you can expect
"We'll deal with it later" has a hard deadline now. This assessment gives you a defensible, evidenced answer for the board on where you stand against the Privacy Act's confirmed AI disclosure obligation, with a roadmap sequenced against 10 December 2026 rather than a generic audit.
- A requirement-by-requirement compliance scorecard against the Privacy Act 2026 reforms and the 6 Essential Practices
- An AI acceptable-use policy ready to publish
- A governance accountability structure with a named owner
- A prioritised remediation roadmap sequenced against the 10 December 2026 deadline
Frequently asked questions
What does the AI Governance & Compliance Strategy assessment cover?
A gap assessment against the confirmed automated decision-making transparency obligation (Privacy Act 1988, commencing 10 December 2026), the further AI-related reforms (consent for AI training, data minimisation, human review rights) still before Parliament, and the National AI Centre's 6 Essential Practices, an AI acceptable-use policy, a governance accountability structure, and a prioritised remediation roadmap.
What's the 10 December 2026 deadline?
The Privacy Act 1988's automated decision-making transparency obligation commences that date, already law, added by the Privacy and Other Legislation Amendment Act 2024. Privacy policies must disclose when personal information is used in automated decisions that could significantly affect someone, and what kind of decisions those are. A further package (consent for AI training, data minimisation, a right to human review) is still before Parliament, with no confirmed date. Penalties for a serious or repeated privacy breach reach whichever is greatest of $50 million, three times the benefit obtained, or 30% of adjusted turnover.
How much does the AI Governance & Compliance Strategy assessment cost?
A fixed-price, fixed-scope engagement. Get in touch for pricing.
What happens after the assessment?
Most clients move into AI Governance Advisory, the ongoing retainer that keeps the policy current and reviews new AI use cases as they come up. If you're already on, or considering, Fractional Technology Executive, this is simply folded in as one of that retainer's tailored dials instead.
A gap assessment against the confirmed Privacy Act disclosure obligation (10 December 2026) and the National AI Centre's 6 Essential Practices, an AI acceptable-use policy, a governance accountability structure, and a remediation roadmap that tracks what's still before Parliament.
Book a discovery call →Ready to know where you stand?
Book a 30-minute discovery call. No pitch, no obligation: a direct conversation about your exposure under the Privacy Act's AI reforms before the deadline narrows your options.
Book a discovery call →