Data and privacy
- What data does the product collect, and where is it stored and processed? Including any offshore locations and subcontractors.
- Is our data used to train or improve your models? Can we opt out, and is that the default?
- How long is data retained, and can it be deleted on request?
Security
- What security certifications or independent assessments do you hold? Ask for current reports, not just logos.
- How will you notify us of a security incident or data breach, and how quickly?
Performance and fairness
- How is accuracy measured, and on what data? Is it representative of Australian customers or staff?
- How do you test for and reduce bias? Especially important for recruitment, credit and insurance decisions.
- How do you monitor the model over time, and tell us about significant changes?
Transparency and control
- Can the product explain why it produced a particular output or decision? You may need this for complaints and for privacy policy disclosures.
- Can our staff review, override and log decisions?
- What audit logs are available to us?
Accountability
- What do you commit to in the contract? Data use, security, notification, support for audits and what happens at exit.
Tip: score each vendor’s answers and record them in your AI register. Higher-impact uses deserve deeper checks.
Where to find authoritative guidance
Refer to the OAIC, the Federal Register of Legislation, and the Australian Department of Industry. New to the terminology? See our AI governance glossary. This article is general information, not legal advice.
Not sure where you stand? Try the free automated decision scope check or the AI governance readiness checker. Both are indicative starting points, not certifications.