What ASIC has actually said about AI
ASIC's main public statement is REP 798, 'Beware the gap: Governance arrangements in the face of AI innovation', published on 29 October 2024. ASIC reviewed 23 licensees across banking, credit, insurance and financial advice, and analysed 624 AI use cases that were in use or being developed as at December 2023. Its finding was that adoption was moving faster than governance. The report does not single out note-takers, and it does not prohibit any category of tool.
Two messages from the release matter to an advice practice. First, the existing framework applies. ASIC Chair Joe Longo said existing consumer protection provisions, director duties and licensee obligations 'put the onus on institutions to ensure they have appropriate governance frameworks and compliance measures in place to deal with the use of new technologies'. Second, vendors are your problem too: 'This includes proper and ongoing due diligence to mitigate third-party AI supplier risk.'
For an AFS licensee those obligations sit in s 912A of the Corporations Act 2001: provide services efficiently, honestly and fairly (s 912A(1)(a)), take reasonable steps to ensure representatives comply with the financial services laws (s 912A(1)(ca)), and have adequate risk management systems (s 912A(1)(h), which does not apply to APRA-regulated bodies). An AI tool that touches client files falls inside all three. This is why the approval decision belongs to the licensee, not the individual adviser.
Record-keeping: what the note has to prove
The specific record-keeping duty for personal advice is s 912G, a provision ASIC inserted into the Corporations Act by instrument. It began as Class Order [CO 14/923] and now sits in the ASIC Corporations (Record-Keeping Requirements for Australian Financial Services Licensees when Giving Personal Advice) Instrument 2024/508, which ASIC made in September 2024 and which runs to October 2029. In short, the licensee must ensure records are kept for at least seven years after the advice is provided, covering:
- the information relied on about the client's relevant circumstances, and the inquiries made to get it
- the consideration and investigation of the subject matter of the advice
- the advice itself, including the reasons it was considered appropriate
Those records are how you evidence the best interests duty in s 961B, the appropriate advice duty in s 961G and the conflicts priority rule in s 961J. ASIC's conduct expectations are in RG 175 (reissued November 2024). Standard 8 of the Financial Planners and Advisers Code of Ethics 2019 adds that client records must be kept in a form that is complete and accurate. We cover the detail in file notes for financial advisers and the s 961B safe harbour steps.
Nothing in s 912G says who or what must draft the record. What matters is that the record exists, is accurate, can be produced for seven years, and shows your reasoning. That gives you four tests for any AI note-taker:
| Test | Why it matters | What to look for |
|---|---|---|
| Does it capture reasoning, not just topics? | s 961B is evidenced by why, not what. A generic meeting summary lists topics. | Templates with headings for objectives, circumstances, options considered, basis for advice, and client decisions. |
| Is the final note fixed and dated? | A note that can be silently edited later is weak evidence in an audit or at AFCA. | Locking, version history or an audit trail, with amendments shown as amendments. |
| Can you get it out and keep it seven years? | The retention duty outlives most software subscriptions. | PDF export into the client file in your own system. Do not rely on the vendor as the archive. |
| Does it keep more than you need? | Audio and full transcripts are extra personal information to secure, and extra records that can be called for. | Clear retention settings. Know what is kept, where, and for how long. |
Privacy Act: APPs 1, 5, 6, 8 and 11
Advice conversations are full of personal information, and often sensitive information such as health details for insurance advice. The OAIC's 'Guidance on privacy and the use of commercially available AI products' (21 October 2024) names note-taking and transcription tools as in scope, and says privacy obligations apply to what goes into an AI tool and what comes out. If the Privacy Act 1988 applies to your business, five APPs do most of the work. If you are under the small business threshold, check your licensee agreement, which usually requires you to act as though it applies. The Privacy (Tax File Number) Rule 2015 binds anyone who holds TFNs regardless of size.
| APP | What it requires | What it means for an AI note-taker |
|---|---|---|
| APP 1 | Open and transparent management of personal information, and an up-to-date privacy policy. | The OAIC expects policies and procedures for AI use. Update your privacy policy to say you use AI-assisted tools to prepare records. |
| APP 5 | Tell people what you collect, why, and who you disclose it to. | Your collection notice or FSG pack should cover third-party service providers, and whether any are overseas. |
| APP 6 | Use or disclose information only for the purpose it was collected, unless an exception applies. | Writing the client's file note is squarely the primary purpose. A vendor training its model on your client's conversation is not. Get 'no training' in the contract. |
| APP 8 | Before disclosing to an overseas recipient, take reasonable steps to ensure it will not breach the APPs. Under s 16C you are accountable if it does. | Most global note-takers host offshore. Find out where the data sits and where the AI model is called. Australian hosting avoids the question. |
| APP 11 | Reasonable steps to secure information, and destroy or de-identify it when no longer needed. | Encryption, access controls, breach terms, and a deletion path for audio and transcripts once the note is final. |
The OAIC also recommends, as best practice, that organisations do not enter personal information into publicly available generative AI tools. Pasting a client meeting transcript into a free chatbot is the clearest example of what to avoid. APP 10 (accuracy) is relevant too: the OAIC says a human should be responsible for verifying AI output that contains personal information.
Recording consent depends on the state
A lot of AI note-takers work by recording the call or joining the meeting as a bot. That brings in state listening and surveillance devices laws, which sit outside ASIC's remit and carry criminal penalties.
| Jurisdiction | General rule for recording a private conversation you are part of |
|---|---|
| NSW, WA, SA, TAS, ACT | All-party consent. Get clear consent from everyone on the call before recording. |
| VIC, QLD, NT | One-party consent. A participant can record, but there are limits on publishing or sharing the recording. |
| Commonwealth | The Telecommunications (Interception and Access) Act 1979 separately prohibits intercepting a communication passing over a telecommunications system. |
Clients move and advisers work across borders, so most licensees set one national rule: tell every client and get consent every time. The OAIC's guidance says the same from a privacy angle: make participants aware that the meeting is being recorded and a transcript produced, and get consent where sensitive information is collected. See is it legal to record phone calls in Australia?, or check a specific call with the can I record this call tool.
Not every tool records. Some work only from a transcript your phone or meeting platform already produced, or from a memo you dictate after the meeting. The difference is explained in do AI note-takers record your calls? and meeting bots vs transcript-only note tools. Note that if your phone system or Teams is producing the transcript, the consent question still exists. It just sits with that platform's recording settings, where you probably already handle it.
Licensee approval comes first
If you are an authorised representative, the licensee carries the s 912A obligations and decides which tools touch client data. Many licensees now handle software the way they handle products: an approved list, and a request process for anything new. Using an unapproved tool can breach your AR agreement even if the tool is excellent. Before you trial anything with real client information:
- Check whether the licensee has an AI or technology policy and an approved software list.
- If the tool is not listed, submit it for review. Attach the vendor's privacy policy, data processing terms, hosting location, subprocessor list and security summary. It speeds things up.
- Ask how the licensee wants AI-assisted notes stored. Most want the final note in Xplan, AdviserLogic or whatever system they audit from.
- Test on a mock call first. No real client data until approval is in writing.
If you hold your own AFSL, you are the approver. Document the due diligence, record the decision, and set a review date. REP 798's phrase is 'proper and ongoing', so a one-off tick does not cover it.
Accuracy: you sign the note, not the software
AI drafts get things wrong in predictable places: dollar amounts, contribution types, dates, product names, and who said what. In advice, the dangerous error is a softened or dropped caveat. If you said an NCC was only possible subject to the client's total super balance, and the note records that you recommended an NCC, the record now says something you did not advise.
So the workflow needs a review step that actually happens. Read the draft the same day. Check figures and the basis for advice first. Add what the transcript cannot know, such as what you observed or what you considered and rejected. Then lock it. A reviewed note looks like this (the clients are invented):
- What the clients want
Helen wants to retire at 62 and Ravi at 64. They want the mortgage cleared first.
- Their situation
- Helen's salary is up to $148,000. Ravi's is unchanged.
- Mortgage of $212,000.
- No change to health.
- Helen's risk profile confirmed again as balanced.
- What we discussed
Salary sacrifice compared with extra mortgage repayments. Helen has unused room under her cap on before-tax (concessional) super contributions from earlier years. Her total super balance was under $500,000 at 30 June, so she can carry those unused amounts forward.
- Advice
General discussion only, with a record of advice (ROA) to follow. We will model putting about $30,000 of carried-forward contributions into Helen's super this financial year, against putting the same amount on the mortgage. No change to insurance.
- Clients' views
Helen prefers the super option if the tax saving is confirmed. Ravi wants the mortgage cleared by 60.
- Conflicts
None. No product change.
- Next steps
- Get Helen's carry-forward figure from the ATO.
- Model both options.
- Record of advice by 23 September.
- Ongoing fee arrangement renewal is due in November. Flagged with the clients.
- Sign-off
Reviewed and lodged by the adviser on 9 September at 4:10 pm.
For a fuller list of what belongs in the note, see what to record in a financial advice file note and the best interests duty file note checklist.
Due-diligence checklist for an AI note-taker
| Check | Ask the vendor | Obligation behind it |
|---|---|---|
| Recording | Does it record audio or join meetings as a bot? If so, how is consent captured? | State listening devices Acts; TIA Act 1979; APP 5 |
| Training | Is client data used to train any model, including the underlying AI provider's? | APP 6 |
| Location | Where is data stored, and where is the AI model processed? | APP 8; s 16C |
| Subprocessors | Who else handles the data? Is there a published list? | APP 8; APP 11; REP 798 third-party risk |
| Retention | What is kept (audio, transcript, note), for how long, and can we delete it? | APP 11.2 |
| Security | Encryption, access controls, breach notification terms? | APP 11; s 912A(1)(h) |
| Templates | Can the note follow our licensee's file note format? | s 912G; s 961B evidence |
| Review and lock | Is there an approval step, and is the final note tamper-evident? | s 912G; Code of Ethics Standard 8 |
| Export | Can notes be exported to PDF and stored in our own system for seven years? | s 912G |
| Approval | Has the licensee approved it in writing, with a review date? | s 912A(1)(ca); REP 798 |
Where CallNote sits
We built CallNote for the record-keeping half of this problem. It never records calls, never joins a meeting as a bot and never stores call audio. It takes a transcript that already exists (pasted, uploaded from Teams, Zoom or Meet, forwarded by email, or sent automatically from Dialpad or Aircall) or a voice memo you dictate after an in-person meeting, and turns it into a file note in your own format. You review it, then publish it seals it with a SHA-256 checksum. Amendments are append-only and every action is in the audit log. Data is hosted in Sydney, encrypted, and not used to train AI.
The limits: CallNote has no native integration with Xplan or AdviserLogic, so the note gets there by PDF or copy and paste. It does not write SOAs or ROAs. If you want a tool that records and transcribes the meeting for you, or one built around advice documents, look at the options in our Claras comparison and Zocks comparison. More detail is on the financial advisers page.
Common questions
Does ASIC allow financial advisers to use AI note-takers?
Yes. ASIC has not prohibited AI note-takers. Its position, set out with REP 798 in October 2024, is that existing obligations are technology neutral and the onus is on licensees to have governance and compliance measures for new technology, including ongoing due diligence on third-party AI suppliers. In practice that means the licensee approves the tool, and the adviser reviews every note.
Do AI-generated file notes meet the s 912G record-keeping requirement?
They can. Section 912G, now in ASIC Instrument 2024/508, requires records of the client information relied on, the inquiries made, the consideration and investigation of the advice, and the advice and reasons, kept for at least seven years. It does not say who drafts the record. An AI-drafted note meets it if it is accurate, reviewed by the adviser, captures reasoning, and can be produced for the full seven years.
Do I need client consent to use an AI note-taker?
If the tool records the call, yes in practice. NSW, WA, SA, Tasmania and the ACT require all-party consent to record a private conversation, and most licensees apply that standard nationally. Separately, under APP 5 clients should be told that their information is handled by third-party service providers. A tool that works only from an existing transcript does not make a recording, but the platform that produced the transcript still needs to be used lawfully.
Is it a Privacy Act problem if the AI note-taker stores data overseas?
It is a Privacy Act obligation, not an automatic breach. APP 8 requires reasonable steps to ensure an overseas recipient does not breach the APPs, and s 16C makes you accountable if it does. You also need to disclose likely overseas recipients in your privacy policy under APP 1. Many licensees simply require Australian hosting because it removes the issue.
Do I need my licensee's approval before using an AI note-taker?
If you are an authorised representative, almost certainly yes. The licensee holds the s 912A obligations to supervise representatives and manage risk, and most now keep an approved software list. Using an unapproved tool with client data can breach your AR agreement. Send the vendor's privacy, security and hosting details with your request and test on mock data until approval is confirmed in writing.
Can I paste a client meeting transcript into ChatGPT to write the file note?
Do not use a public or consumer AI tool for this. The OAIC's October 2024 guidance recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. You would also struggle to show your licensee where the data went, how long it is kept, or that it is not used for training.