OAIC AI Guidance for Accounting Practices

The OAIC AI guidance applies existing privacy duties to AI tools. For accounting practices, it means assessing client-data use before adoption and explaining that use to clients.

What the OAIC Guidance Covers

The Office of the Australian Information Commissioner (OAIC) has two main AI guides. They address different roles, so start with the one that matches your practice’s task.

Guidance on privacy and the use of commercially available AI products is the guide for a practice choosing or using an AI product. It covers purchased products, free public tools and AI used internally.

The commercial-products guide was published in 2024 and updated in 2025. It explains obligations under the Privacy Act alongside recommended privacy practices. It is not a separate law approving particular AI products.

Guidance on privacy and developing and training generative AI models was published and updated in 2024. It addresses developers using personal information to build or train models, including fine-tuning an existing model.

A practice buying an AI assistant normally starts with the commercial-products guide. A practice fine-tuning a model using client files must also consider the development guidance. Data already available to the practice does not automatically become lawful training data.

Privacy Act coverage still matters. An exemption from the Australian Privacy Principles does not remove separate TFN obligations or a registered tax practitioner’s confidentiality duties.

Using AI Products With Personal Information

The OAIC recommends that organisations keep personal information, especially sensitive information, out of publicly available generative AI tools. Its top five takeaways state this as a best-practice recommendation because of the privacy risks.

That recommendation does not mean every paid AI account is suitable for client records. Assess the exact product and account settings, including AI embedded in software the practice already uses.

Use the OAIC’s product-selection checklist to document the proposed task and what happens to the information:

• Establish whether the product has been tested for the intended task and whether its training data suits that use.
• Identify the information entering the product, its outputs and everyone who can access either.
• Examine security measures and the environment where the product operates.
• Determine whether the provider uses client information for its own purposes. Check whether you can disable training on that information.
• Assign human review that can identify errors and change the result before anyone relies on it.

Keep the contract and relevant settings with the assessment. An account marketed to businesses does not answer those questions on its own. The AI risk assessment can help turn the findings into permitted tasks and restrictions.

The OAIC’s AI-use checklist also asks whether an input serves the original collection purpose. A different purpose needs an applicable APP 6 exception, such as consent or the reasonable-expectations exception with its related-purpose conditions.

An output about an identifiable client can itself be personal information. Mark AI-generated inferences as such and check accuracy before adding them to the client file. Invented information about a real person still needs privacy handling.

Review the arrangement when the provider changes its terms or the practice adds another use. Include staff training and monitoring in the approval, so the written restrictions affect everyday work.

For a collection workflow, Tax Genie removes every TFN before AI review. It checks submitted client answers for common mistakes and asks clients to correct fixable issues. The TFN exclusion is a specific part of that handling.

Transparency With Clients

Explain how your practice uses AI in its privacy policy and relevant collection notices. If clients interact with an AI chatbot, identify it as AI where that interaction happens.

Describe the task in language a client can understand. “We use technology to improve services” does not explain that a provider receives their information or that AI generates a summary about them.

A practice’s policy and notices need to reflect its actual arrangements. Explain the information used and the AI-related purposes, including relevant provider access and disclosures. Include generated personal information where that is part of the work.

The APP 5 notification guidance requires reasonable steps to notify people before or at collection. Where that is impracticable, take those steps as soon as practicable afterwards.

Usual disclosures and likely overseas recipients are among the matters to address. Identify overseas countries where practicable. A short notice beside a collection form can link to the fuller explanation.

Publishing a notice does not itself establish consent for every AI use. Separate the explanation of your arrangements from any permission you need to obtain.

For a hypothetical meeting-summary tool, tell the client that AI processes the recording to prepare a draft summary. Explain provider access and how the practice handles the result. Staff need to answer questions about that arrangement.

OAIC and TPB Guidance Together

The OAIC addresses personal-information handling under privacy law. The Tax Practitioners Board (TPB) addresses registered practitioners’ professional duties when providing tax agent services. The same AI task can engage both.

The TPB’s AI Guidance Statement 55/2026 applies existing Code obligations to AI use. These include competence, reasonable care and confidentiality. Practitioners remain responsible for their services and must apply professional judgement to AI outputs.

Under Code item 6, a third-party disclosure of client affairs requires the client’s permission unless a legal duty applies. Client affairs can include company information, so the TPB duty extends beyond personal information about an individual.

Consider a hypothetical AI summary of a client’s rental-property records. The practice must first assess the proposed personal-information use and provider access. If it discloses client affairs to a third party, it must also address the TPB permission requirement.

Before using the summary in tax work, the practitioner checks its claims against the underlying records and applies the tax law. Record that review and any corrections. A privacy assessment cannot establish that the tax advice is correct.

Use the TPB AI guidance for the Code assessment. For each approved task, keep the privacy decision, any required client permission and the practitioner’s review record together. Staff then have evidence for both obligations when the task runs again.