Australian government compliance and integrity teams can use AI agents to assemble freedom of information requests, draft privacy impact assessments, check procurement files for probity gaps and keep the agency's AI transparency records current. Decisions affecting people's rights, benefits or debts must stay with authorised officers, under administrative law, the Privacy Act 1988 and OAIC oversight.
What do public sector compliance teams in Australia spend their time on?
In an Australian government department or agency, compliance work is spread across legal, integrity, privacy, FOI and governance teams. What ties it together is a public body's duty to act lawfully, fairly and transparently, and to be able to show it did.
Freedom of information. Agencies must answer requests for documents within statutory periods, consult third parties, apply exemptions with reasons and publish certain information proactively.
Privacy. The Privacy Act 1988 and its principles apply to Australian Government agencies, and agencies must carry out privacy impact assessments for projects with high privacy risk. Any new system that processes personal information at scale, including an AI agent, will usually need one.
Procurement probity. Purchases must follow procurement rules on value for money, fair competition, conflicts of interest and record-keeping.
AI governance. Agencies are expected under whole-of-government policy to name officials accountable for AI and to publish statements explaining how they use it.
Lawful decision-making. Administrative decisions must be authorised by legislation, made by someone with the power to make them and explained with reasons. Australia has seen, through a public inquiry into an automated debt-raising scheme, what happens when automation runs ahead of the law and of human review.
Where can agents help?
Depth limits how far an agent may act: 1 reads, 2 drafts for a person, 3 executes routine work within bounds.
FOI document assembly (depth 2). The agent searches records systems for documents in scope, removes duplicates, marks personal information and passages that may attract an exemption, and drafts the schedule of documents. The FOI officer decides and signs.
Privacy impact assessment drafts (depth 2). For a new project, the agent reads the business case, data flows and system design, maps them to the privacy principles and drafts the assessment with open questions for the privacy officer.
Procurement probity checks (depth 1). The agent reads procurement files and checks that conflict of interest declarations were made by every evaluator, that evaluation followed the published criteria and that required approvals are recorded. It lists gaps.
AI transparency register (depth 2). The agent keeps the internal register of AI use current from project records and drafts updates to the published transparency statement for the accountable official.
Deadline tracking (depth 3). The agent tracks FOI and privacy complaint deadlines and sends internal reminders.
What stays with a person, and why?
Administrative decisions about people. Granting, refusing or cancelling a benefit, raising a debt, or imposing a penalty must be made by an officer with legal authority to make it, on the evidence, with reasons. An agent can prepare material; it cannot hold the power. Whether an agent can go further for benefit claims is examined in can an AI agent decide public benefit claims.
FOI decisions. Applying an exemption and any public interest test is a statutory decision for an authorised officer.
Privacy conclusions. The privacy officer decides whether risks are acceptable and what mitigations are required.
Probity findings. Concluding that a procurement was flawed, or that an officer had an undeclared conflict, affects careers and contracts.
Public statements. The transparency statement is the agency's account of itself, approved by the accountable official.
Which Australian rules apply?
Australia has no AI-specific law in force. The government has published a voluntary AI safety standard, and whole-of-government policy sets expectations for agencies' AI use. Binding duties come from existing law. The broader view is in how AI agents are regulated in Australia.
Privacy Act 1988 and the OAIC. The privacy principles govern collection, use, disclosure, security and access for agencies, and privacy impact assessments are required for high-risk projects. The OAIC also oversees FOI at the Commonwealth level.
Administrative law. Decisions must be lawful, made by authorised decision-makers, procedurally fair and explained. Automation is permitted only where legislation allows it, and agencies remain accountable for outcomes. Ombudsman and tribunal review apply.
Freedom of information law sets access rights, timeframes and exemptions.
Public resource management and procurement rules govern how agencies spend money and record decisions.
APRA and ASIC regulate financial firms and do not reach an agency's compliance agent, though agencies that regulate or contract with financial firms will meet their standards.
State and territory agencies have their own privacy, FOI and procurement laws with similar intent.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How to start in the first 90 days
Month one. Register the agent in your AI register, name the accountable official and complete a privacy threshold assessment. Start with FOI document assembly, which helps officers meet deadlines without the agent making any decision.
Month two. Replay the agent against closed FOI requests. Compare the documents it found and the passages it marked with what officers released and exempted, and review any document it missed.
Month three. Run live on new requests, with officers making every decision. Add procurement probity checks. Public bodies elsewhere start from different laws and capacity; see compliance agents in Nigeria's public sector for a contrast.
Where Pryme fits
In Pryme, a public sector compliance agent's role scope excludes any administrative decision, so a request to grant, refuse or raise a debt is refused, with the verdict naming the bound. Its FOI and privacy drafts arrive held for the authorised officer. Every verdict is filed, which supports transparency statements and review by the Ombudsman. The guide to AI compliance agents explains the principle.
Questions people ask
Can an AI agent make FOI decisions for an Australian agency?
No. FOI decisions must be made by an authorised officer. The agent can find documents and suggest exemptions with reasons for the officer to consider.
Does an AI compliance agent need a privacy impact assessment?
If it processes personal information in a way that carries high privacy risk, an assessment is likely to be required. Start with a threshold assessment and record the outcome.
Should the agency's transparency statement mention compliance agents?
Statements describe how the agency uses AI. Including internal compliance uses gives a complete picture and avoids later questions about omissions.