Anyone here who uses AI follows this page. Fill in the blanks, keep it next to the computer, and show it to new staff on their first day.
| Written with AI | Checked by | What they check |
|---|---|---|
| Emails and messages to clients | Whoever wrote it | Names, subclasses and deadlines are right; no promises like “this will be approved” |
| Visa requirements, conditions and document checklists | Registered migration agent ______ | Every statement is on the Home Affairs website or in the law, or it comes out |
| Draft statements and support letters for lodgement | Registered migration agent ______ | Every fact comes from the client’s own documents, none from AI |
| Tool and plan | Account owner | Used by | Chats used for training |
|---|---|---|---|
| Off / no switch (where to turn it off: page 2) | |||
Ask ______. If you’re still not sure, leave it out and write it yourself.
Client information can’t go to a third person without the client’s written consent (Code s 35, page 2). If you’re not sure whether pasting it into AI counts, get written consent first or leave it out.
When someone leaves or an account isn’t needed, change the password that day and remove them.
Which AI tools use your chats for training, and where to turn it off, changes often, so we keep one table and check it against the official pages every month: Do ChatGPT, Claude, Copilot and Gemini train on your chats? The printable PDF has the table as of the date printed on it.
The OMARA’s Code of Conduct for registered migration agents (in force since 1 March 2022) has a few sections that matter most for AI (full text, PDF):
Section 35: except as required by law, an agent must not disclose, or allow to be disclosed, to a third person any personal information about a client or former client, or their affairs, without the client’s written consent.
Section 53: documents belonging or relating to clients and former clients must be kept securely.
Section 56: every client needs a client file, including copies of all written communications (electronic too) with the client; keep it for 7 years after the last action on it.
Sections 15 and 26: no false or misleading statements, including when promoting your business.
Most small businesses with an annual turnover of $3 million or less aren’t covered by the Privacy Act, but some are (OAIC). The OAIC recommends that organisations “do not enter personal information, and particularly sensitive information, into publicly available generative AI tools” (OAIC). Passports and health information are exactly that kind.
This is a free template, not legal advice. The OMARA and OAIC pages and the law itself are what count; if you’re unsure, ask the MIA or a lawyer.
Want two everyday jobs in your office written up as step-by-step instructions you can follow? melb.si/book