assess-ai-privacy-cybersecurity-use-case-l0cka

Assess AI Privacy and Cybersecurity Use Case

Assess a defined AI-system use case, not an AI product in the abstract. Produce a provisional recommendation supported by verified law, evidence and controls.

Read references/ai-use-case-method.md before starting. It defines the intake schema, risk domains, suitability outcomes, control tests and authority boundaries.

Workflow

1. Define the use case and decision.
   • Record the intended purpose, accountable owner, users, affected people, deployment context, jurisdiction, sector, benefit, decision supported or made, consequence of error, level of automation and requested decision.
   • Identify the exact system, model, version, hosting arrangement, provider, integrations and proposed change. Do not treat vendor marketing as proof of system behaviour or controls.
   • Use de-identified inputs and minimum necessary extracts. Do not request credentials, model secrets, live malicious content, unnecessary personal information or complete client files.
2. Map data and system behaviour.
   • Trace collection or generation, prompts and inputs, retrieval sources, training or fine-tuning, inference, outputs, logs, human review, onward disclosure, storage, retention, deletion, monitoring and incident paths.
   • Classify personal, sensitive, health, confidential, privileged, security- classified and synthetic data separately. Record uncertainty about identifiability and re-identification.
   • Separate supplied facts, vendor claims, tested evidence, assumptions and unknowns. Never invent a control or infer that a setting is enabled.
3. Test law and governance scope.
   • Invoke $route-australian-privacy-jurisdiction for public-sector, government-contractor, health, surveillance, workplace and State or Territory automated-decision overlays.
   • Identify candidate privacy and cyber legislation using the linked reference. Verify Commonwealth propositions with $check-commonwealth-legislation and NSW propositions with $check-nsw-legislation, including point-in-time and known-future-change qualifications.
   • If deployment, review or retention extends across a Commonwealth legislative change, invoke $trace-commonwealth-legislative-change and distinguish present requirements, future requirements and transition actions.
   • If personal information or APP-entity coverage is possible, invoke $check-australian-privacy-principles using the legal as-at date and a decision horizon covering the pilot, deployment, retention and next review dates that are actually known.
   • Invoke $assess-statutory-privacy-tort independently of APP coverage for surveillance, recording, scraping, profiling, inference, deepfakes, publication or intimate, location, health or financial information.
   • Invoke $assess-automated-decision-transparency whenever a program makes or performs a material step related to a decision. Include the 10 December 2026 Commonwealth transition and WA IPP 10 where relevant.
   • Invoke $map-australian-cyber-incident-obligations when the proposed system, smart product or response plan could engage sector incident, outage, control-weakness or cyber-extortion obligations.
   • Do not issue SUITABLE, SUITABLE WITH CONTROLS or PILOT ONLY while an APP layer requires legal-content or application-law review, or while the result is APP FRAMEWORK NOT VERIFIED – DO NOT RELY. Use INSUFFICIENT INFORMATION or NOT SUITABLE ON CURRENT INFORMATION, as the facts warrant, until a lawyer refreshes the APP analysis.
   • For another State or Territory, inspect its official legislation publisher. Use PRIMARY TEXT CHECK REQUIRED or NOT VERIFIED when an applicable version cannot be established.
   • Label OAIC, ACSC, National AI Centre, standards and organisational policies as guidance, standards or internal controls, not legislation.
   • State that case law was not considered. Flag discrimination, consumer, employment, intellectual-property, administrative, records, professional and sector-specific law for separate review where material.
4. Assess risks and controls.
   • Test necessity and proportionality, purpose compatibility, notice and transparency, lawful authority, data quality, security, access, vendor and subprocessors, overseas handling, retention, individual rights, human oversight, contestability, monitoring, incident response and exit.
   • Test AI-specific failure modes: unreliable output, automation bias, prompt injection, data or model leakage, insecure tool use, excessive agency, poisoned retrieval or training data, model or supply-chain change, weak identity/access control and inadequate auditability.
   • Link each risk to a fact, affected person, plausible harm, evidence, existing control, residual gap, owner and acceptance criterion. Do not use a numerical score unless the organisation supplied an approved method.
5. Recommend and gate.
   • Apply the suitability outcomes exactly as defined in the reference. A legal or factual unknown cannot be cured by optimistic assumptions.
   • Specify conditions precedent, pilot limits, prohibited data or actions, required testing, monitoring, review date, stop triggers and approval owner.
   • Do not approve, procure, deploy, connect, upload data to, or change the AI system. The lawyer and accountable owner make the decision.