The deadline
10 December 2026. Your privacy policy has to talk about AI.
From 10 December 2026, the Privacy Act requires privacy policies to disclose where software, including AI, makes or substantially shapes decisions that significantly affect people. If the Act applies to your business, your policy has to say so, accurately.
Privacy and Other Legislation Amendment Act 2024 (Cth), Schedule 1, Part 15. Commencement 10 December 2026.
What changes
A privacy policy that says nothing about AI stops being a neutral document. It becomes a statement you have to stand behind. From 10 December, if the Privacy Act applies to your business, your policy has to describe where software, including AI, makes or shapes decisions that significantly affect people.
What it asks of you
Describe the kinds of personal information your software uses. Describe the kinds of decisions made by software alone, and the kinds where software substantially shapes the outcome. In plain words, and accurate to what actually happens in your business. You cannot write that down if you do not know which tools your team uses.
What ready looks like
- A current register of every AI tool in use, including the ones nobody approved.
- A rule for each tool against each kind of data.
- A record of what was produced, with what, and who approved it.
- An evidence pack you can hand over on any given day.
And all of it current today, not as at the last review.
A policy that keeps up
AI rules, tools and guidance keep moving. A policy written in January is out of date by June. Ready means a live document: rules your team can check in seconds, updated as tools change, with every version kept. Live management of your AI policy is exactly what HighSign is built for.
Your policy as plain-language rules per data class. Edit it, see the impact, publish.
The Act asks you to disclose. Disclosure is only as good as what you can see. Howll Govern gives you the controls, the records and the evidence. The obligation stays yours.
Also on the calendar: from 1 July 2026 lawyers, accountants, conveyancers and real estate agents providing designated services became AUSTRAC reporting entities. On 22 July 2026 the Tax Practitioners Board finalised TPB(GS) 55/2026, its guidance on AI and the Code of Professional Conduct. Using AI does not reduce or transfer a practitioner's responsibility.
HighSign · AI tool governance
Answers, not documents.
Your people ask the same question a hundred times a week: can I use this? HighSign answers it. They look up any tool and get a verdict in seconds, green, amber or red, citing the rule in your own policy. Every tool in the register carries a verdict for each class of data. When the policy changes, every verdict changes with it. Leadership gets the register, the audit trail and the evidence pack. Proof, not promises.
- Verdicts per data class. Client, Financial, Health, Internal and Public. Each tool, each class, one answer.
- Anonymous team lookup. People ask honestly when nobody is watching who asked.
- Amnesty survey and the reveal. Find the tools already in use, without turning it into a hunt.
- Exceptions that are loud, owned and always expiring. No quiet workarounds that live forever.
- One-click evidence pack. Board-ready, with attestations, stamped with the hash of the policy it was built on.
“Your team uses 23 AI tools. You knew about 6.”
Illustrative example of the reveal. Your numbers will be your own.
The limits
What we won't tell you.
Governance products love to overclaim. Here is where we draw our lines.
We are not watching your people.
No screen recording. No reading every prompt. No surveillance dashboard. Team lookups in HighSign are anonymous by design. Governance that feels like Big Brother gets worked around, and then it governs nothing.
We do not promise outcomes.
No software can guarantee you pass an audit, win a tender or satisfy a regulator. Nobody can honestly promise that, so we do not.
We do not make you compliant.
Compliance is a judgement about your whole business, not a feature you switch on. The obligations, and the decisions, stay with you.
What you get is readiness.
The visibility, the rules and the records to stand behind what your policy says. If you ever need to show how AI was used in your business, you can.
The rules don't govern your AI. You do. Howll Govern is how you show it.
2 ways to get it
One package. 2 parts. Ready now.
Howll Govern is HighSign and the Howll MCP together. It comes with every embedded engagement, or you can take it on its own.
HighSign
Do you know which AI tools your team is using today? Most businesses do not.
- People using AI tools nobody approved
- No clear answer on which tool can touch client data
- A policy in a folder that nobody reads and nobody updates
HighSign finds the tools, answers the question in seconds, and keeps your policy live.
Howll MCP
Does AI output sound different depending on who prompted it? It does not have to.
- Every person prompting their own way, getting their own results
- No record of which version of a template produced the work
- Nothing to show when a client asks how the work was made
Howll MCP serves everyone the approved version, in the AI they already use, and keeps the record.
Included from day one
Howll Govern comes with every embedded engagement.
It is part of every Embedded engagement from day one. You get the controls, the records and the evidence from the start, not added on later.
Want Howll Govern on its own?
Leave your email and we will come back to you with how it works and what it costs.
Prefer to talk it through? Book a governance briefing with Josh or Dirk.
Questions we get asked.
Who approves our content?
You do. You nominate the approvers. In Howll MCP a named person approves each version of a skill or template, and you can require a second approver. In HighSign your policy owner sets the rules behind every verdict. Howll AI never approves your content for you.
What if our people use tools we haven't approved?
They probably already do. HighSign's amnesty survey finds those tools without punishing anyone for being honest. Each tool then gets a verdict per data class, and anything that needs an exception gets one that is owned and has an expiry date. Howll MCP cannot see use that never touches it, which is exactly why the 2 come as one package.
Does this slow the team down?
It should make them faster. A verdict takes seconds, which beats emailing a manager and waiting. Approved skills and templates arrive inside the AI tool they already use. The approval step sits with the approver, not with every person doing the work.
Do we need both products?
They come together. Howll Govern is one package: HighSign and the Howll MCP. HighSign shows you which tools are in use and what each one can touch, but it cannot see what those tools produce. The Howll MCP controls and records what gets produced, but it cannot see use that never touches it. Each covers the other's gap, so you get the whole chain from day one.
What happens to our data if we leave?
It is yours. Howll MCP produces a full export archive that never passes through Howll AI's servers. HighSign exports the register, logs and evidence packs. The audit log is append-only while you are with us, and it leaves with you when you go.
Is this legal advice?
No. Howll Govern gives you controls, records and evidence. It does not tell you what the law requires of your business, and it does not make you compliant on its own. For advice on your obligations, talk to your lawyer. We are happy to work alongside them.