Why a small firm needs a written policy
In many firms nobody chose the AI note taker. Someone turned on transcription or let a meeting bot in, and client conversations started going into a tool nobody had checked. A one-page policy fixes that, and gives you something to show a regulator, an insurer or a client.
Several Australian bodies have now said, in writing, that they expect firms to have rules for AI use.
- Lawyers. On 6 December 2024 the Law Society of New South Wales, the Legal Practice Board of Western Australia and the Victorian Legal Services Board and Commissioner issued a joint statement on AI in legal practice. It says lawyers "cannot safely enter confidential, sensitive or privileged client information into public AI chatbots/copilots (like ChatGPT), or any other public tools", and asks firms to adopt "clear, risk-based policies" on which tools may be used, by whom, for what and with what data. The Law Society of New South Wales also hosts a Sample AI Policy for Law Firms, which is a Lawcover resource.
- Queensland lawyers. A Queensland Law Society Proctor article of 9 July 2026 on AI note-taking tools treats choosing a transcription provider as a confidentiality assessment. It tells firms to check whether the provider uses your data to train models, where the data is stored, and what the contract says, because the contract governs where it differs from the marketing.
- Tax and BAS agents. The Tax Practitioners Board issued TPB(GS) 55/2026 on 22 July 2026. Under Code item 6, a practitioner must have the client's permission before disclosing client information to a third party, which the Board says can include entering it into AI tools, depending on how the tool is set up. The Board recommends telling the client who the information goes to, where it is stored and whether AI tools may be used. The permission can sit in a signed engagement letter.
- Advisers and brokers. ASIC reviewed how 23 Australian financial services and credit licensees use AI, and how they govern it, in Report 798 (29 October 2024). Licensees already carry general obligations to have adequate arrangements and supervise their representatives under the Corporations Act 2001 s 912A and the National Consumer Credit Protection Act 2009 s 47. Those obligations apply to new tools too.
- Everyone covered by the Privacy Act 1988. The OAIC's guidance on commercially available AI products (21 October 2024) says organisations should update their privacy policies and notices with clear information about their use of AI. It also recommends, as best practice, that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools.
The 10 December 2026 privacy policy change
From 10 December 2026, Australian Privacy Principles 1.7 to 1.9 require an organisation covered by the Privacy Act to say in its privacy policy when a computer program makes, or does something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, using their personal information. The change was made by the Privacy and Other Legislation Amendment Act 2024, and the OAIC's guidelines on Australian Privacy Principle 1 (updated 30 September 2026) explain the test.
On our reading, a tool that only drafts a file note for a person to check is unlikely to be caught, because the note records a conversation and the person still decides what to advise. The OAIC's guidelines say a program used for purposes other than facilitating the decision, such as a word processor used to document it, is not captured. A tool that recommends or guides the decision can be. So list every piece of software that touches client information and decide which ones need a line in your privacy policy. Many small firms fall under the small business exemption in section 6D of the Privacy Act (annual turnover of $3 million or less), which has exceptions. Your duty of confidentiality to clients applies either way.
See what a finished file note looks like.
Pick your line of work and we'll send a sample note written from a mocked call. No account, no card, and nothing from your own client files.
One sample note, plus the occasional CallNote update. Unsubscribe any time by replying. We never ask for your call recordings or client files.
The one-page AI note taking policy template
Copy the eight sections below into your own document. Square brackets mark the parts to change.
For the retention period in section 7, see how long to keep file notes in Australia.
Client disclosure wording you can copy
Section 3 needs a written clause and a spoken line.
For more versions, including phone system announcements and wording for when you transcribe without keeping a recording, see our call recording disclosure wording examples. The consent rules differ by state, so read is it legal to record phone calls in Australia before you settle on a process.
Variations by profession
Law firm
- Confidentiality. Add to section 2: "Client information may only go into a tool where our contract with the provider keeps it confidential and stops the provider using it to train AI models." This reflects rule 9 of the Australian Solicitors' Conduct Rules and the December 2024 joint statement.
- Privilege. Add to section 5: "Before transcribing, consider whether the conversation is privileged and who else can see the transcript. If in doubt, do not transcribe." See are attendance notes privileged.
- Supervision. Add to section 4: "A supervising solicitor reviews AI-drafted attendance notes prepared by junior and support staff until [name] is satisfied with their checking." Rule 37 requires reasonable supervision of legal services.
- Costs. Add: "Time billed for an attendance reflects the work done. We do not bill for time the tool saved." The joint statement asks that billed time accurately represents the legal work done.
Financial advice practice
- Licensee first. Add to section 2: "A tool may only be approved if our licensee [name] permits it." Many licensees keep their own approved software list.
- Advice stays with the adviser. Add to section 4: "The adviser checks that the note records the client's goals and circumstances in the client's own terms, the options discussed and the reasons for the recommendation. The tool does not form the recommendation." Our guide on what to record in a financial advice file note lists the content.
- Health and other sensitive information. Insurance and retirement conversations often cover health. Add to section 3: "We ask for consent before collecting health information and note that consent on file."
Mortgage brokerage
- Aggregator and licensee. Add to section 2: "A tool may only be approved if our aggregator and credit licensee permit it."
- What the broker checks. Add to section 4: "The broker checks that the note records the client's requirements and objectives, income and expense figures as the client stated them, the loans compared and why the recommended loan is in the client's best interests." See how to write a compliant NCCP file note.
- Lender documents. Add to section 5: "Payslips, bank statements and identity documents are never uploaded to a note-taking tool."
- Phone calls. Most broker conversations are phone calls. Add to section 3: "On outbound calls the broker asks for consent in person, because the caller will not hear a recorded announcement."
Tax and BAS agents can use the core template too. Add the permission step from TPB(GS) 55/2026 to section 3.
Six questions to ask before a tool goes on the approved list
| Question | What a good answer looks like | Where to find it |
|---|---|---|
| Does it record audio, join the meeting as a bot, or work from a transcript? | You know exactly which, and your consent wording matches | Product documentation, then test it yourself |
| Where is our data stored? | A named country and region, in writing | Contract, data processing terms |
| Is our data used to train AI models? | No, stated in the contract and not only in marketing | Terms of service, privacy policy |
| How long are audio, transcripts and notes kept, and can we delete them? | Clear periods and a way to delete on request | Retention settings, contract |
| Who can see each note? | Access limited by role, with a log of who did what | Admin settings |
| Can a filed note be changed without a trace? | No. Edits are tracked or the note is locked | Test it: file a note, then try to edit it |
The first question decides what you have to tell clients. See whether AI note takers record your calls and meeting bots compared with transcript-only tools for the differences.
How CallNote answers those questions
We make CallNote, so here are our own answers. CallNote never records calls, never joins a meeting as a bot and never stores call audio. It turns a transcript that already exists, from Aircall, Dialpad, Microsoft Teams, an upload or a paste, into a file note in your own format. Data is hosted in Sydney, encrypted, and not used to train AI. Members see only their own notes, and owners and admins see all of them. When you publish a note it is sealed with a checksum and locked, later changes are added as amendments, and there is a full audit log.
CallNote does not make the consent decision for you. The transcript comes from your phone or meeting system, so section 3 of your policy still applies to that system. More detail: law firms, financial advisers, mortgage brokers.
A filled-in example
This fictional note shows what sections 3 and 4 look like on a file.
- Consent
Sam asked Dana at the start of the call whether the call could be transcribed to prepare a file note. Dana agreed. No audio recording was kept.
- What was discussed
Dana wants pre-approval to buy a unit for up to $620,000 with a 15 percent deposit. She confirmed her salary and that her car loan will be paid out in November 2026. Sam explained that with a 15 percent deposit lenders mortgage insurance would apply, and compared three lenders.
- Next steps
- Dana to send two recent payslips by 18 September 2026.
- Sam to send a written comparison of the three loans by 22 September 2026.
- How this note was made
Drafted by AI from the call transcript. Read in full and corrected by Sam Okafor on 15 September 2026 (deposit figure corrected from 50 percent to 15 percent). Filed and locked the same day.
Common questions
What should an AI note taking policy include?
At a minimum: which tools are approved and who approves new ones, how and when clients are told and asked for consent, a rule that a person reviews every AI-drafted note before it is filed, what information must never go into an AI tool, where transcripts and notes are stored, how long they are kept, and who is responsible for the policy. One page is enough for a small firm.
Is an AI note taking policy required by law in Australia?
No single law says "have an AI note taking policy". But lawyers, advisers, brokers and tax agents all have confidentiality, supervision and record-keeping duties that apply to AI tools, and bodies including the legal regulators in NSW, Victoria and WA and the Tax Practitioners Board have issued guidance expecting firms to control how AI is used. A written policy is the simplest way to show you did.
Do we have to tell clients we use an AI note taker?
In practice, yes. Recording or transcribing a call generally needs the consent of everyone on it in NSW, WA, SA, Tasmania and the ACT. Privacy law expects you to tell people what you collect and why. For tax and BAS agents, TPB(GS) 55/2026 says client permission is needed before client information is disclosed to a third party, which can include an AI tool. Put it in your engagement letter and ask again at the start of the call.
What changes on 10 December 2026?
From 10 December 2026, organisations covered by the Privacy Act must state in their privacy policy when a computer program makes, or substantially helps make, decisions that could significantly affect a person's rights or interests using their personal information. A tool that only drafts a note for a person to check is unlikely to be caught, but check every other system you use and update your privacy policy if one is.
Can staff use ChatGPT to write file notes?
Not with a personal or free account and real client details. The OAIC recommends that organisations do not enter personal information into publicly available generative AI tools, and the legal regulators in NSW, Victoria and WA say lawyers cannot safely enter confidential client information into public AI chatbots. A policy should name the approved tools and ban the rest for client work.
Who should own the policy in a small firm?
One named person, usually a principal or the practice manager. They keep the approved tool list, decide on new tools, hear about mistakes and review the policy each year. Each person who files a note stays responsible for checking that note.