INSIGHT · AI GOVERNANCE & COMPLIANCE

An AI audit trail answers one question:
who approved what, on what evidence.

2 November 2026

An AI audit trail for an Australian construction business records, for each decision an AI tool helped with, the inputs, the tool and version, the output, the person who approved it, what they changed and when. As read on 2 November 2026, no source we read creates a general AI audit log duty, and the Commonwealth says it will not proceed at this time with mandatory AI guardrails. Other rules attach to the underlying statements and records: APP 1.7 privacy policy content, which commences on 10 December 2026, and 7-year company financial records under s 286 of the Corporations Act.

A wall of metal filing drawers with rows of bound volumes on top

Analysed 2 November 2026 · OAIC APP 1.7-1.9 Fact Sheet and APP Guidelines Chapter 1 Version 2.0 (both September 2026) · Privacy and Other Legislation Amendment Act 2024 (Cth) · Privacy Act 1988 (Cth), Compilation No. 104 · Corporations Act 2001 (Cth), Compilation No. 149 · National AI Centre Guidance for AI Adoption · National AI Plan · joint media release of 20 July 2026 · Work Health and Safety Act 2011 (Qld), current from 3 August 2026 · QBCC Act 1991 (Qld), current from 1 February 2026 · SafeWork NSW consultation page, modified 23 October 2026.

Key takeaways

We found no general AI audit log duty: None of the Commonwealth, Queensland or NSW sources read on 2 November 2026 requires a business to keep a log of AI decisions as such. The National AI Plan says the government's approach "will continue to build on Australia's robust existing legal and regulatory frameworks". We read those sources, not every Australian law, so this is a statement about what we read.
APP 1.7 is a privacy policy rule, and it starts on 10 December 2026: Where its trigger is met, an APP entity's privacy policy must state the kinds of personal information used and the kinds of decisions a computer program makes solely, and the kinds for which it does a thing substantially and directly related to making the decision. The text does not mention a log. Answering it accurately still depends on knowing which decisions a program touched.
A human review does not by itself settle APP 1.7: The OAIC's September 2026 Fact Sheet says a decision may be in scope "even where a computer program output does not replace the entire decision-making process or is subject to human review", and that the OAIC considers machine learning or generative AI outputs "used to make decisions that significantly affect the rights or interests of individuals" would generally fall within scope "unless subject to extensive human oversight and control". Its Example 3 says further steps, such as interrogating outputs and documenting why a person diverged from them, "could indicate" an output was not substantially related to a decision. Neither statement settles a given case.
Keeping records of AI use is guidance, in plain words: The National AI Centre's Foundations guidance says: "Keep clear records of the actions you take under each practice. Good documentation supports audits, reviews and ongoing improvement." It is guidance. It is not a statutory duty.
We would store one trace per decision: A system-design recommendation, not a legal requirement: a decision ID that joins the inputs, the tool and version, the unedited output, the named reviewer, what changed, the release and any financial entry.

What each source is,
and what it says about records.

As read on 2 November 2026, none of the laws in force or commencing on a fixed date that we read mentions an AI log.

"Silent" here means the text we read does not address the point. It is not a finding that no other law applies. The National AI Centre's page on AI and Australian law lists general laws that may apply to AI use.

Source	Status at 2 November 2026	What it says that touches records	What it does not say
Corporations Act 2001 (Cth) s 286	Law in force (Compilation No. 149)	A company must keep written financial records that correctly record and explain its transactions, retained for 7 years after the transactions are completed	Nothing about AI. Whether an AI log is a financial record is not settled by the section
Work Health and Safety Act 2011 (Qld) s 38(7)	Law in force (current from 3 August 2026)	A person conducting a business or undertaking keeps a record of each notifiable incident for at least 5 years from the day notice is given to the regulator	Nothing about AI
Privacy Act 1988 (Cth), APP 11.2	Law in force (Compilation No. 104)	Personal information no longer needed, and not required to be retained by law or court or tribunal order, must be destroyed or de-identified by reasonable steps	Nothing about AI. It applies to APP entities and pulls against keeping everything forever
Privacy Act 1988 (Cth), APP 1.7 to 1.9	Enacted; commences 10 December 2026 (2024 amending Act, s 2 table item 7)	Privacy policy must state the kinds of personal information used and the kinds of decisions covered	No log, no retention period and no record format in the text
OAIC APP Guidelines Chapter 1, Version 2.0	Regulator guidance, September 2026	On APP 1.2: "An entity could consider keeping a record of the steps taken to comply". Lists factors for assessing a program's role, including reliance and override	It says "could consider", which is not a requirement
OAIC guidance on commercially available AI products	Regulator guidance	Due diligence "should not amount to a 'set and forget' approach"; regular reviews of performance, staff training and monitoring	No prescribed AI log
National AI Centre, Guidance for AI Adoption: Foundations	Voluntary guidance	"Keep clear records of the actions you take under each practice"; "Create and maintain an AI register"	No penalty of its own in the pages read
Mandatory guardrails proposals paper	Not proceeding at this time	The Department's consultation page states: "The Australian Government will not proceed at this time with previous proposals" "to introduce mandatory guardrails for AI development and deployment"	No date on that statement
AI consumer safety priorities	Announced workstreams, joint media release of 20 July 2026	A digital duty of care, a second tranche of privacy reform, workplace AI safety, consumer law options and a framework for automated decision-making in federal agencies	None is described as an obligation in force
Work Health and Safety Amendment (Digital Work Systems) Act 2026 (NSW)	Passed; duties not commenced. SafeWork NSW says the remaining provisions commence on a date or dates to be announced	Once commenced, s 21A requires a business to consider four named risks when work is allocated by a digital work system	No record format, as read for our page on the NSW duties

The audit trail record,
field by field.

"Required by" means an instrument requires the underlying record or statement, not this particular field. "Suggested by guidance" means a guidance document points to it. "Our design" means neither does, and it is our recommendation.

Field	What it holds	Why it matters	Rule or guidance behind it	Label
Decision ID and type	A claim, quote, approval or inspection reference	Joins every other field to one decision	None	Our design
AI use, tool name and version	The use as listed in the AI register, and the version running that day	Tools change between versions, and the same tool can carry different risk in different uses	Foundations: "Create and maintain an AI register"	Suggested by guidance
Accountable person for the use	A named person	Answers who owns the use, separate from who approved one output	Foundations: "Make a specific person accountable for every AI system your organisation uses"	Suggested by guidance
Inputs and parameters	Documents and data the tool was given, by reference and version; prompt or settings	Shows what evidence the output rested on	OAIC Guidelines 1.52: "the sources of information used to generate the output" and "the parameters provided"	Suggested by guidance (a scope factor, not a record rule)
Personal information flag	Whether personal information was used, and its kind	The privacy policy has to state the kinds used, where APP 1.7 applies	APP 1.7(c) and 1.8(a), from 10 December 2026	Required by (the policy statement, where APP 1.7 applies); the field is our design
Output as produced	The unedited draft, with time	Without it, a reviewer's changes cannot be shown	None	Our design
Reviewer, and what they saw	Name, role, the sources opened, the time	Shows the review was more than a click	Foundations: "Ensure meaningful human oversight"; OAIC Guidelines 1.53: ability and likelihood of human override	Suggested by guidance
Decision and changes	Approved, changed or rejected; what changed and why	Shows how far the output influenced the person	OAIC Guidelines 1.52: how the output "ultimately influenced the human decision-maker's judgement"	Suggested by guidance
Release	What went out, to whom, by what means, when	Fixes the moment the decision left the business	For a Queensland regulated contract variation: QBCC Act Sch 1B s 40(2) and (5)	Required by (the step, in that case); the timestamp is our design
Financial entry link	Invoice, ledger or claim reference	Connects the decision to the books	Corporations Act s 286(1) and (2): written financial records, 7 years	Required by (the financial record, for a company); the link is our design
Disclosure category	Solely by a program, substantially and directly related, or neither, and who judged it	Feeds the privacy policy	APP 1.8(b) and (c), from 10 December 2026	Required by (the policy statement, where APP 1.7 applies); the field is our design
Retention class	Which rule sets the period, and the review date	Separates what must stay from what must eventually go	Corporations Act s 286(2); Qld WHS Act s 38(7); APP 11.2	Our design

One variation claim,
traced from site to ledger.

This worked trace is an invented example: the builder, the owner, the amounts and the times are made up, and it describes no real business or product. It follows a variation under a Queensland regulated contract through an AI drafting step, a human approval and a release.

The trace does not determine whether this step is a decision within APP 1.7. That depends on the entity, the decision and the effect on the individual. The contents of the variation document are set by Sch 1B s 41; our page on variations by state sets them out.

Step	Who acts	What happens	What the record gains
1. Instruction	Site supervisor (person)	Day 1, 9.12 am: the owner asks for a change of bathroom tile. The supervisor records it in the site diary	Decision ID V-014; diary entry reference; who asked and how
2. Draft	AI tool	Day 1, 11.40 am: the tool drafts a variation from the diary entry, the supplier quote and a rate table	Tool and version; input references; unedited draft showing 6 labour hours and an invented price of $4,180 including GST; personal information flag: owner's name
3. Review	Contract administrator (person)	Day 1, 2.05 pm: she opens the quote and rate table, changes labour to 8 hours because the wall needs preparation, and approves	Reviewer's name; sources opened; the change and the reason; revised invented price of $4,520 including GST
4. Release	Contract administrator (person)	Day 1, 2.20 pm: the variation goes to the owner by email. Day 2: the owner agrees in writing	What was sent, when and how; the owner's written agreement. Sch 1B s 40(5) bars starting the varied work before that agreement
5. Work and payment	Builder (business)	Day 6: the varied work starts. The increase is invoiced under the contract	Start date, invoice reference and retention class. Sch 1B s 40(2) requires the written copy before 5 business days elapse from the day the parties agree to the variation, or before the varied work starts, whichever is first
6. The later question	Anyone asking	Month 5: the owner queries the 8 hours	The trace shows the tool proposed 6, a named person changed it to 8, on which document, why and when

APP 1.7 from 10 December 2026:
what changes, and what applied before.

Australian Privacy Principle 1.7 (APP 1.7) commences on 10 December 2026 under Schedule 1, Part 15 of the Privacy and Other Legislation Amendment Act 2024 (Cth). The register's current compilation of the Privacy Act, No. 104, shows an end date of 10 December 2026. Before that date, APP 1.3 and 1.4 set the general content of a privacy policy, with no automated decision content.

The OAIC's non-exhaustive list of decisions generally in scope names recruitment software, reports used to rank employee performance or decide bonuses, and insurance eligibility. It names no construction claim, quote or inspection, and we do not infer that any is in or out of scope.

Transitional rule: Item 89 of the amending Act applies the change to decisions made after commencement, whether the arrangement for the program, the use of personal information, or the acquisition of that information happened before or after that date. A tool bought in 2025 is treated the same as one bought in 2027.
OAIC guidance is now published: The OAIC announced its resources on 30 September 2026: a Fact Sheet, a flowchart, a supplementary sheet for government agencies and APP Guidelines Chapter 1, Version 2.0.
Writing up a decision is different from informing it: Guidelines paragraph 1.40: where a human decision-maker uses a program for purposes other than facilitating the decision-making, "such as using a word processing program to document a decision", this "will not be captured".
If in doubt: The Fact Sheet says entities in doubt "should take a cautious approach and include information in their APP privacy policy".
Who is covered is a separate question: APP 1.7 applies to APP entities. Our page on the APP 1.7 deadline covers the small business exemption and its exceptions. Coverage is not determined here.

Audit trail retention:
what the law sets, and what it does not.

No instrument we read on 2 November 2026 sets a retention period for an AI audit trail in Australia. The period for a trace depends on the records it holds or supports, and the Privacy Act can pull the other way for personal information no longer needed.

The last row is a records-design suggestion. It is not legal advice on how long any record must be kept. A contract, insurer or other law may set a longer period.

Record	Period	Source	Set by
Company financial records	7 years after the transactions covered are completed	Corporations Act 2001 (Cth) s 286(2)	Law (companies, and the other entities the section names)
Notifiable incident record	At least 5 years from the day notice is given to the regulator	WHS Act 2011 (Qld) s 38(7)	Law (Queensland; other states not read for this page)
Personal information no longer needed	No fixed period: reasonable steps to destroy or de-identify, unless an Australian law or a court or tribunal order requires retention	Privacy Act 1988 (Cth), APP 11.2	Law (APP entities)
AI audit trail as such	No period found in the instruments read	None	Not set by the instruments read
Trace for a decision linked to a financial entry	Match the linked record, so 7 years after the transaction is completed for a company	Our design	Good practice (our view)

What we would put in a system

A system-design recommendation for a construction business that uses AI to draft or check decisions.

Where agents help here is narrow. An agent can draft a variation or quote, list the documents it read and store its own output for review, and a person confirms or changes it. In this design, no agent decides whether APP 1.7 applies, whether a record is a financial record, how long it must be kept, or whether a claim is valid. Our page on how we deploy AI sets out our general approach.

Field	Why it is load-bearing
One decision ID across tools	Drafting, approval and accounts often sit in different software. Without a shared ID, the trace has to be rebuilt by hand.
Unedited output kept beside the final	The OAIC's factors turn on reliance and override. A final document alone cannot show either.
A named approver, recorded by the system	"Approved by office" cannot answer who approved what.
A retention class on each trace	Financial links point to 7 years for a company, while personal information no longer needed falls under APP 11.2.

Questions worth asking
of your own AI records

For a builder's director: for the last AI-drafted claim that went out, can you name who approved it?

The National AI Centre's Foundations guidance asks for a person accountable for every AI system; the approver of one output is a further name. If the record says only "office", the question stays open. General information as read on 2 November 2026, not legal advice.

For a contract administrator: when you change an AI draft, is the original kept?

The OAIC's APP Guidelines Version 2.0 list reliance on the output and the ability to override it as factors in assessing a program's role. Keeping the draft beside the final is our design suggestion for showing both. General information as read on 2 November 2026, not legal advice.

For whoever owns the privacy policy: which AI uses touch personal information, and has each been assessed against APP 1.7 before 10 December 2026?

APP 1.8 requires the policy to state kinds of information and kinds of decisions where APP 1.7 applies. Whether it applies is a legal question; a list of uses is what the question is asked against. General information as read on 2 November 2026, not legal advice.

For a finance manager: which AI outputs flow into the company's financial records?

Section 286 of the Corporations Act requires written financial records retained for 7 years after the transactions are completed. Whether a given AI log is itself a financial record is not determined here. General information as read on 2 November 2026, not legal advice.

Questions people ask
about AI audit trails

What is an AI audit trail?

An AI audit trail is a linked record of a decision an AI tool helped with: the inputs, the tool and version, the output, the person who reviewed it, what they changed, and what was released and when. The term is not defined in the Australian instruments we read on 2 November 2026; this description is ours.

Is an AI audit trail required by law in Australia?

As read on 2 November 2026, none of the Commonwealth, Queensland or NSW sources we read requires an AI audit log as such. Existing record rules still apply, such as 7-year company financial records under s 286 of the Corporations Act 2001, and the National AI Centre's voluntary guidance says to keep clear records. We did not read every Australian law.

What is the audit trail retention period for AI records in Australia?

No instrument we read on 2 November 2026 sets one. Periods attach to the underlying record: 7 years for company financial records (Corporations Act s 286(2)) and at least 5 years for notifiable incident records in Queensland (WHS Act 2011 s 38(7)). APP 11.2 requires APP entities to destroy or de-identify personal information no longer needed, unless a law or order requires retention.

Does human approval take an AI tool outside APP 1.7?

Not by itself. The OAIC's APP 1.7-1.9 Fact Sheet (September 2026) says a decision may be in scope even where an output is subject to human review, and that the OAIC considers machine learning or generative AI outputs used to make decisions that significantly affect the rights or interests of individuals would generally be in scope unless subject to extensive human oversight and control. Scope still depends on all three conditions in APP 1.7, which commences on 10 December 2026.

Are mandatory AI guardrails law in Australia?

No, as read on 2 November 2026. The Department of Industry, Science and Resources' consultation page states the Australian Government "will not proceed at this time" with previous proposals to introduce mandatory guardrails for AI development and deployment. The National AI Plan says its approach builds on existing legal and regulatory frameworks.

What should an AI policy for a construction company say about records?

The National AI Centre's Foundations guidance asks for a named accountable person, an AI register, disclosure of AI use and human override points. As our suggestion, a construction company's policy can add which decisions need a named approver and how long each trace is kept. No instrument we read prescribes this content. General information as read on 2 November 2026.

What this analysis
does and does not show.

Evidence note

What it shows: What the Commonwealth, Queensland and NSW sources read on 2 November 2026 say about records relevant to AI-assisted decisions, a record design with each field labelled as required by, suggested by guidance or our design, and an invented worked trace of one Queensland variation.
Key facts quoted: APP 1.7 to 1.9 commence 10 December 2026 (2024 amending Act s 2 table item 7), applying to decisions made after commencement (Sch 1 item 89); OAIC Fact Sheet and Guidelines Version 2.0, September 2026; Corporations Act s 286: 7 years; Qld WHS Act s 38(7): at least 5 years; APP 11.2; QBCC Act Sch 1B s 40: a written copy within 5 business days of agreement, or before the varied work starts if earlier; mandatory guardrails: "will not proceed at this time"; Foundations: "Keep clear records of the actions you take under each practice."

We did not read every Australian law. Our statement that no source creates a general AI audit log duty covers the sources listed, and no listed primary source states it as a general rule of Australian law.
The Corporations Act, Privacy Act and amending Act were read from the Federal Register of Legislation. APP 1.7 to 1.9 were read in the amending Act, because they are not yet in the compilation.
NSW commencement status is SafeWork NSW's statement on its page modified 23 October 2026. The NSW legislation register blocks automated access and was not read on 2 November 2026; the NSW text is as described on our page on those duties.
The Department's mandatory guardrails statement was read through a plain page fetch of its consultation site. The statement carries no date of its own.
WHS retention is Queensland's rule. Other states' WHS laws, state AI guidance and sector rules were not read for this page, and bills before any Parliament were not surveyed.
The worked trace is invented. Its labels (required by, suggested by guidance, our design) are our reading of the instruments.
General information, not legal, privacy or WHS advice. Nothing here determines whether APP 1.7 applies, whether a business is an APP entity, whether a record is a financial record, or how long any record must be kept.

What to watch next

10 December 2026: APP 1.7 to 1.9 commence under the Privacy and Other Legislation Amendment Act 2024.
Late 2026: SafeWork NSW Stage 2: SafeWork NSW says it will undertake further targeted consultation on the digital work systems guidelines in late 2026. The remaining provisions of the Act commence on a date or dates to be announced.
A second tranche of privacy reform: The joint media release of 20 July 2026 lists consulting on a second tranche as a priority led by the Attorney-General. It gives no date.

Bring us one decision
an AI tool touched.

Send us one claim, quote or inspection record where AI helped. We will show you which fields your records already hold, which are missing, and where the trace breaks between tools.

General information about published legislation, regulator guidance and government statements, as read on 2 November 2026. Not legal, privacy or WHS advice. Commonwealth, Queensland and NSW sources only.

Send us the record · How we deploy AI

Sources

Suggested citation: Privacy and Other Legislation Amendment Act 2024 (Cth) Sch 1 Pt 15; OAIC, APP 1.7-1.9 Transparency Obligation Fact Sheet and APP Guidelines Chapter 1 Version 2.0 (September 2026); Corporations Act 2001 (Cth) s 286; as read 2 November 2026. Derived figures: none. The worked trace's amounts and times are invented.

An AI audit trail answers one question: who approved what, on what evidence.