Yes, with care. ASIC describes the financial services rules as technology neutral, and its 2024 review of AI use focused on governance rather than banning tools. But using AI to draft a file note or a Statement of Advice moves none of the obligations: the adviser must still act in the client's best interests, give appropriate advice and keep records that prove it, and client information is still covered by privacy law. Treat AI as a drafting assistant that works from the client's own file, with an adviser who checks and owns every word that goes out.
What has ASIC said about AI in financial services?
ASIC's main statement so far is Report 798, Beware the gap: Governance arrangements in the face of AI innovation, published on 29 October 2024. ASIC reviewed 23 licensees across banking, credit, insurance and financial advice, and analysed 624 AI use cases that were in use or being developed as at December 2023.
What it found:
- AI mostly augmented human decisions or improved efficiency. It generally didn't make decisions on its own, and most use cases didn't deal with consumers directly.
- Use was growing quickly. 61% of the licensees planned to increase their AI use in the next 12 months.
- Generative AI made up only 5% of use cases already in use, but 22% of those in development.
- Only 12 licensees had AI policies that referenced fairness or related concepts, and only 10 had policies that referenced telling consumers when AI was used.
- For two licensees, AI governance arrangements lagged their AI use.
The report also spells out what licensees should already be doing. Licensees should consider whether they have staff "with the skills and experience to understand the AI used, and who can review AI-generated outputs". Licensees also "remain responsible for outsourced functions", which includes AI tools supplied by a third party.
In ASIC's media release on the report, Chair Joe Longo put it plainly: "Existing consumer protection provisions, director duties and licensee obligations put the onus on institutions to ensure they have appropriate governance frameworks and compliance measures in place to deal with the use of new technologies." In other words, don't wait for an AI law. The existing rules already apply.
Which obligations stay with the adviser when AI drafts?
All of them. The conduct obligations for personal advice to retail clients sit in Division 2 of Part 7.7A of the Corporations Act, and ASIC's guidance on them is Regulatory Guide 175 (current version issued 21 November 2024). The core duties are:
- Act in the client's best interests (s961B).
- Give appropriate advice (s961G).
- Warn the client if the advice is based on incomplete or inaccurate information (s961H).
- Prioritise the client's interests where there's a conflict (s961J).
Licensees also have to take reasonable steps to make sure their representatives comply with these (s961L), and the Statement of Advice requirements sit in s946A to 947E. None of this changes because a model wrote the first draft. If an AI-drafted SOA recommends something that isn't in the client's best interests, it's the adviser's advice and the licensee's problem.
Why file notes matter more than people think
Licensees must keep records of personal advice under the ASIC Corporations (Record-Keeping Requirements for Australian Financial Services Licensees when Giving Personal Advice) Instrument 2024/508. According to ASIC's explanatory statement, that means records of:
- the information relied on and the action taken that shows the adviser acted in the client's best interests;
- the information and actions behind the "safe harbour" steps, if the adviser relies on them;
- the advice given, including why it was appropriate; and
- where there's a conflict, how the adviser gave priority to the client's interests.
Records must be kept for at least seven years after the advice is given, and the licensee must be able to produce them throughout that period. The instrument runs until 1 October 2029. ASIC's explanatory statement notes that without these records it would be difficult for a dispute body such as AFCA to resolve a complaint.
That's the real risk with AI-drafted file notes. A file note isn't a summary for convenience. It's evidence of what the client told you and what you relied on. If a model summarises a meeting and adds a goal the client never mentioned, or drops a health condition they did, the error is now in the record your advice rests on. Accurate file notes are the point, not speed.
What about client privacy?
The OAIC's guidance on privacy and the use of commercially available AI products (published October 2024, updated January 2025) is the reference here. For organisations covered by the Privacy Act, the key points are:
- Privacy obligations apply to personal information you put into an AI system and to any output that contains personal information.
- You should do due diligence before adopting a product: whether it has been tested for your use, how human oversight fits in, the privacy and security risks, and who can access the information.
- Under APP 6 you can generally only use or disclose personal information for the purpose you collected it, unless you have consent or another exception applies.
- Incorrect or made-up information an AI produces about an identifiable person, such as a hallucination, is still personal information.
- As best practice, the OAIC recommends not entering personal information, and particularly sensitive information, into publicly available generative AI tools.
That last point bites for advice practices. Health information is sensitive information under privacy law, and insurance advice files are full of it. We cover the general question in more detail in can I put client information into ChatGPT?
What does a sensible AI workflow look like?
This is the pattern we'd recommend to any practice, whatever tool you use:
- AI drafts from the client's own file. The fact find, your meeting notes or transcript, and the existing client record. Not the model's general knowledge, and not the internet.
- Where the source doesn't say, the draft leaves a blank. A gap the adviser fills is better than a confident guess the adviser misses.
- The adviser reviews and owns the result. Check every fact against the source, edit freely, and only then sign off. The draft is a starting point, not the advice.
- Keep an audit trail. Store what the AI generated, what the adviser changed, who approved it and when. We're not aware of a rule that requires this specific trail, but it's how you show a review actually happened if your licensee audits the file or a complaint reaches AFCA.
- Approved business tools only. Never paste client information into a personal ChatGPT, Claude or Gemini account. Use tools your practice has assessed, under business terms that say where data goes and that it isn't used for training.
- Follow your licensee's AI policy. If your licensee doesn't have one, ask. REP 798 shows plenty of licensees were still writing theirs.
What should you ask an AI vendor?
Before you put client files into any product, get written answers to these:
- Where is our data stored and processed, and which AI providers touch it?
- Is our data ever used to train models?
- Does it draft only from our records, and can it show the source for each fact?
- Can we see what the AI generated versus what the adviser changed?
- Who at your company can access our client data?
- Can we export everything, including drafts and the audit trail, for the seven-year retention period and if we leave?
- Has it been tested for advice work, and how does it fit our licensee's policy?
If a vendor can't answer the first three clearly, keep looking.
How we approach it
We built a CRM for a financial services practice that keeps client records, policies, documents and communication in one workspace, with AI-assisted drafting that an adviser checks before anything goes out. The same principles apply to any build we do for an advice practice: data we host is stored and processed in Australia, every provider that touches client data is named in the proposal, client data is never used to train models, and a person reviews anything a client or regulator sees. More on our custom CRM development work, or read is a custom CRM worth it? if you're deciding between building and staying with what you have.
Frequently asked questions
Does ASIC allow financial advisers to use AI? ASIC hasn't banned it. Its 2024 review, REP 798, says the regulatory framework is technology neutral, and ASIC has said adequate governance needs to be in place before AI is deployed, including staff who can review AI-generated outputs.
Who is responsible if an AI-drafted Statement of Advice is wrong? The adviser and the licensee, the same as for any other advice. The best interests duty and related obligations in Division 2 of Part 7.7A of the Corporations Act apply regardless of who or what wrote the first draft.
How long do AI-drafted file notes need to be kept? Records of personal advice must be kept for at least seven years after the advice is given, under ASIC's record-keeping instrument. Keep the final, adviser-approved version, and ideally the AI draft and the edits too.
Can I use the free version of ChatGPT for file notes? Not with client information. The OAIC recommends against entering personal information, especially sensitive information, into publicly available AI tools. Use a business tool your practice and licensee have approved.
If you're working out how to use AI in your advice process without creating a compliance headache, book a free 30-minute chat. We'll look at how your files and notes work today and tell you what's worth building, and what isn't.
This article is general information, not legal or financial advice. Check with your licensee before using AI in your advice process.