The first problem worth handing to AI in your firm

Every firm trying AI for the first time has to pick a first problem to hand to it. That choice shapes what the team learns and what client information ends up inside the tool.

The timing matters. The Office of the Australian Information Commissioner’s Australian Privacy Principles guidelines set out new APP 1 rules for some automated decisions, starting 10 December 2026. An APP entity must include additional information in its APP Privacy Policy if it “arranges for a computer program to use personal information to make decisions that could reasonably be expected to significantly affect the rights or interests of an individual.”

For a firm choosing its first AI project, two principles matter before anything is rolled out: APP 1 and APP 5.

The guidelines describe APP 1 as the first step in the information lifecycle, which means “planning and explaining how personal information will be handled before it is collected.”

Under APP 1.2, an APP entity must take reasonable steps to put practices, procedures and systems in place that keep it compliant with the APPs. A new AI project is one of those practices. It needs the same planning as any other change to how a firm handles client information.

Not every firm is an APP entity. In general, a small business operator with an annual turnover of $3,000,000 or less is not covered by the APPs, unless an exception applies. Firms above that threshold, or caught by an exception, need to work through these obligations before rollout.

The automated decision rule in APP 1.7 applies when three things are true. The firm has arranged for a computer program to make a decision, or do something substantially and directly related to making one. The decision could reasonably be expected to significantly affect an individual’s rights or interests. Personal information about that individual is used in the process.

Where the rule applies, APP 1.8 requires the APP Privacy Policy to describe the kinds of personal information used and the kinds of decisions involved. The OAIC has said it will publish detailed guidance on these obligations in 2026.

Whether a firm’s first AI project falls inside the rule depends on what the program decides and how much that decision affects the individual. That is worth settling while the project is still on paper.

APP 5 covers the moment information is collected. An APP entity must take reasonable steps to tell the individual about certain matters, or make sure they are already aware of them. Those matters include the purposes of collection and who the information is usually disclosed to.

The guidelines expect this to be built in from the start. They say notification should be “built into information collection processes and systems” where practicable. For online forms, they suggest displaying the APP 5 matters clearly in the form or linking prominently to a notice.

The obligation does not end once a client has been notified. The guidelines say a change in how information is collected can mean a client needs to be told again. If the change affects any of the APP 5 matters, the entity should take reasonable steps to make sure the individual is aware. If a firm’s first AI project changes how it gathers documents and information from clients, the notice may need to change with it.

The APPs set the obligations. Which problem a firm hands to AI first is a decision each firm makes for itself.

Where to start with AI: Lessons from the industry

Gus McLennan is Managing Director of AI Dojo, an AI tool built for accounting firms. James Rose is Co-founder of Content Snare, which firms use to collect documents and information from clients. With practitioners Denise Twigger and Reuben Bergola, they share the first problem worth solving and what to put in place before rolling anything out. They also cover what they would skip if they were starting again. Their session is a chance to learn more about where to start with AI in your own firm.

Thursday 12 November 2026, 3:00pm AEDT

Register for the session

Part of The AI in Practice Summit, 11 and 12 November 2026. Free, online, every session recorded.