AI Compliance Checklist

This checklist helps you implement "reasonable steps" for AI oversight under the Privacy Act 1988.

Phase 1: Discovery & Assessment (Critical)

Discover Shadow AI (Week 1)

• Run Shadow AI Discovery Scan (WAID Snapshot or manual audit)
• Inventory Current AI Tool Subscriptions
• Assess AI Usage Patterns

Risk Assessment (Week 1)

• Identify High-Risk AI Usage
• Assess Privacy Act Applicability
• Document Current State

Phase 2: Immediate Controls (Week 2-3)

Stop High-Risk Practices (Critical)

• Block Immediate Threats (e.g. sensitive data in free tools)
• Secure Approved AI Tools (DPAs, MFA)

Update Privacy Policy (Important)

• Add AI Disclosure to Privacy Policy
• Make Privacy Policy Accessible

Phase 3: Policy Development (Week 3-4)

• Draft AI Acceptable Use Policy
• Review Policy with Legal/HR
• Publish and Distribute Policy

Phase 4: Staff Training (Month 1-2)

• Prepare Training Materials (Privacy Basics, AI Risks)
• Deliver Training Sessions
• Document Training Completion

Phase 5: Technical Implementation (Month 2-3)

• Implement Monitoring (WAID Gate or equivalent)
• Implement Access Controls (MFA, Browser Security)
• Update Client-Facing Documents

Phase 6: Incident Response (Month 2-3)

• Create AI-Specific Incident Response Plan
• Assign Incident Response Roles
• Test Incident Response Plan

Phase 7: Ongoing Compliance

• Repeat Shadow AI Discovery (Quarterly)
• Review AI Usage Reports (Monthly)
• Update Staff Training (Quarterly)
• Comprehensive Privacy Audit (Annual)