Insurance Brokers and AI in Australia: No New Law, Plenty of Blind Spots

Australia has no AI law for insurance brokers, and the 10 December 2026 privacy change is unlikely to reach most of them. Existing Australian law, including the Corporations Act 2001 and the Privacy Act 1988, still applies to every AI tool a broker uses, and regulators expect firms to meet it.

Brokers advise and place cover. Their decisions about clients usually come from a person, not from software. The risk for a broker sits somewhere else: staff using AI tools to summarise files and draft documents, with client information going in and unchecked answers coming out.

At a glance

What applies	Status	What it means for a broker
Privacy Act 1988, Australian Privacy Principles (APP) 1.7 to 1.9 (10 December 2026)	Binding, if the Privacy Act applies to you	Test whether any software makes or substantially drives a decision that significantly affects a client. Most brokers will find little or nothing.
Privacy Act, other APPs (6, 8, 10, 11)	Binding, if the Privacy Act applies to you	Controls what client information goes into AI tools, where it goes, and whether the output is accurate.
Corporations Act s912A	Binding for Australian Financial Services Licence (AFSL) holders	Risk management, resources and supervision cover AI use by your staff.
CPS 230 and CPS 234	Binding for APRA-regulated insurers	Do not apply to brokers. They reach only brokers that hold binding authority from an insurer, through that agreement.
Australian Prudential Regulation Authority (APRA) AI letter (30 April 2026) and Australian Securities and Investments Commission (ASIC) cyber letter (8 May 2026)	Expectations	ASIC's letter speaks to brokers as AFSL holders. APRA's letter is addressed to APRA-regulated entities and does not reach brokers directly.
Office of the Australian Information Commissioner (OAIC) guidance on generative AI at work	Guidance	Sets out the privacy risks when staff use public AI tools.

Where 10 December fits for brokers

From 10 December 2026, privacy policies must describe decisions made, or substantially driven, by software that significantly affect people and use their personal information. The OAIC reads "computer program" broadly: rule-based processes, machine learning, generative AI and everyday software.

Three conditions must all be met before the rule bites, and for most brokers at least one is missing. A broker's advice and recommendations are usually made by a person who reads the file, talks to the client and decides.

Test the exceptions once, and write down the answer:

A quoting or comparison tool that ranks or filters insurers and products without a person reviewing the result.
Software that decides whether a client is offered a product, a referral or a premium funding option.
A scoring tool that rates clients for retention or cross-sell and changes what they are offered.

If none of these apply, the finding is "no decisions made or driven by software", and there is nothing new to add to your privacy policy under this rule. Confirm first whether the Privacy Act applies to your firm, because some small businesses are exempt.

What still applies without a new AI law

A broker does not need a new law to be accountable for AI. Principles-based rules apply to the outcome, whatever tool produced it.

Corporations Act s912A. AFSL holders must run risk management, resources and supervision that match what the business does. An AI tool used by staff is part of that. See ASIC's AFS licensee obligations and RG 104.
Privacy Act, if it applies to you. APP 6 limits how client information is used and disclosed. APP 8 covers sending it overseas, which many AI tools do. APP 10 requires reasonable steps to keep information accurate, so an AI error that reaches a client file is a privacy matter as well as a service one. APP 11 requires reasonable steps to keep it secure.
CPS 230 and CPS 234. These are APRA standards for insurers and do not apply to brokers. They reach only brokers that hold binding authority from an insurer (a binder or delegated authority agreement), through the terms of that agreement. A broker without one is outside them.
Regulator expectations. The APRA letter on AI (30 April 2026) is addressed to APRA-regulated entities and does not reach brokers directly. The ASIC cyber resilience letter (8 May 2026) asks licensees to lift their cyber defences as AI speeds up attacks. Neither is law. ASIC's letter is the one that speaks to brokers, as AFSL holders.
ASIC Report 798. Beware the gap reviewed how licensees govern AI, and is a useful benchmark for a broker's own policy.

The common thread is plain: know which AI is in use, keep client information protected, check the output, and keep a record that you did.

Insurers and underwriting agencies (MGAs) carry more, including CPS 230 and CPS 234. See our AI compliance checklist for Australian insurers, brokers and underwriting agencies.

Personal subscriptions outside the firm's tools

This is the most likely gap. Where a firm bans AI, or provides only a basic tool, individual brokers can still use a personal ChatGPT, Claude or Gemini account on their own phone or laptop. They do it to save time, and they rarely mean any harm.

The firm then has client names, policy details and claim facts sitting in accounts it does not control. It cannot see what was entered, cannot delete it, and may not know a disclosure happened. The OAIC's guidance on generative AI at work advises against entering personal or sensitive information into public tools.

A ban alone does not remove the risk. What works is a short list of approved tools that are good enough to use, a plain rule on what client information may go in, and a way for staff to say what they already use without being in trouble.

Summaries and document processing

Brokers handle long documents: policy wordings, schedules, endorsements, insurer correspondence, claim reports and client questionnaires. AI makes them quick to read, and two things need guarding.

Personal information. Check where the tool stores the document, whether it is used to train a model, and whether it is processed overseas.
Accuracy. AI can state an exclusion, limit or condition that is not in the document, or leave one out. A summary that misstates cover can reach a client as advice. Check every summary against the source before it is used, and keep a note of who checked.

Other places AI shows up

Use case	What can go wrong	A control that works
Meeting note-takers and call transcription	Client calls recorded and stored by a third party, sometimes offshore, without clear consent	Approved tool only, tell clients, set retention and deletion
Drafting client emails, renewal letters and file notes	Wrong facts, wrong tone, or detail from another client carried over	Named reviewer before sending, no shared chat history between clients
Comparing quotes and policy wordings	Differences missed or invented, so the recommendation rests on a wrong comparison	Broker checks each difference against the wordings
Extracting data from proposals and submissions into broking systems	Errors in sums insured, dates or answers, which go on to the insurer	Sample checks and a rule that a person confirms key fields
Claims support: notifications, summaries of loss adjuster reports	Facts misstated at a stressful time for the client	Review against source before it goes to the insurer or client
Drafting complaint responses	Wrong facts or obligations in a response that is itself regulated	Treat AI as a drafter only, a person decides and signs
Website chatbots, marketing and social posts	Statements about cover or the firm that are inaccurate or misleading	Approval of content, clear limits on what a bot may answer
AI built into tools the firm already pays for (email, CRM, broking platform)	Features switched on by the vendor without the firm noticing	Ask each supplier what AI is on, and record it in the supplier register
AI-enabled fraud: cloned voices, fake client instructions, convincing phishing	Payments redirected or client data handed over	Call back on a known number before changing payment details

Must-haves and nice-to-haves for brokers

This split is our reading of the rules and expectations above. Must-haves are what a regulator, an insurer or a client complaint can ask you to show today. Nice-to-haves make the firm stronger but are not yet asked for.

Must-haves

☐ A list of the AI in use, including tools staff pay for themselves, with a named owner for each.
☐ A short AI policy. Which tools are approved, what client information may go in, and what may never go in.
☐ Checked output. A named person confirms any AI summary, comparison or draft against the source before it reaches a client or insurer, and a note records it.
☐ The 10 December test. Confirm whether the Privacy Act applies, check the three cases in this article, and record the finding. Update the privacy policy if a case applies.
☐ A supplier check. For each tool, find out where data is stored, whether it trains a model, and whether it is processed overseas. Ask existing suppliers which AI features are on.
☐ A way to report a slip. Staff know who to tell when client information goes into the wrong tool, so the firm can assess it quickly.
☐ Binding authority agreements. If you hold binding authority from an insurer, keep evidence ready on AI suppliers and cyber controls, because the agreement may require it.

Nice-to-haves

☐ Table the ASIC cyber letter at your board or leadership meeting and minute it.
☐ Controls that flag when personal information is pasted or uploaded into a public tool.
☐ Sample testing of AI output, with a log of the errors found.
☐ Training for all staff on what AI gets wrong, and what is safe to enter.
☐ A leadership statement on how much AI risk the firm will accept.
☐ A scheduled review of AI controls, for example twice a year.
☐ A comparison of your AI policy against the findings in ASIC Report 798.

Frequently asked questions

Is there an AI law for insurance brokers in Australia?

No. There is no AI-specific law or standard for brokers. The Corporations Act and the Privacy Act already apply to how a broker uses AI. APRA's standards do not apply to brokers.

Does the 10 December 2026 privacy change apply to brokers?

It applies only if the Privacy Act covers the firm and software makes, or substantially drives, a decision that significantly affects a client using their personal information. Most brokers will find that their advice and recommendations are made by people. Test the cases listed above and record the result.

Can brokers put client information into ChatGPT or similar tools?

The OAIC advises against entering personal or sensitive information into public generative AI tools. A firm can approve a tool after checking where data is stored, whether it trains a model and where it is processed, and then set rules for its use.

What if a broker uses a personal AI subscription for work?

The firm is still responsible for the client information. Find out which tools staff use, provide an approved option, and set a clear rule on what may be entered.

How do brokers deal with AI hallucinations?

Treat AI output as a draft. A named person checks any summary, comparison or letter against the source document before it goes to a client or insurer, and a note records the check.

Do the APRA and ASIC letters on AI apply to brokers?

Neither letter is law. APRA's letter is addressed to APRA-regulated entities and does not reach brokers, apart from those with binding authority from an insurer, where the agreement may carry the insurer's requirements. ASIC's cyber letter is relevant to AFSL holders.

What is the first step?

Write down every AI tool in the firm, including the ones staff bring themselves, and name an owner for each.

Author:

Tetiana George, CEO of Curium, Co-Chair of Insurtech Australia and member of ASIC Digital Finance Advisory Committee. LinkedIn Profile.