AI READINESS

Is your firm ready for AI?Find out in ten minutes.

Your staff are already using AI on client work. Check whether the firm has the controls to match: who can use which tools, what data goes in, and what you keep. Free score, no sign-up.

The self-check

Fifteen questions and the Essential Eight

Answer for the firm as it works today. "Don't know" is an answer, and an honest one scores better than a guess.

Step 1 of 3

How the firm uses AI

Is there a written AI policy?

Yes means: names the approved tools, the data each may handle (public, de-identified, confidential) and who approves new integrations.

Was each AI provider's contract checked before client data was sent?

Yes means: every tool: training, retention, access, deletion and processing location.

Are TFNs, bank details, salaries and identity documents kept out of AI services not approved for them?

Yes means: in policy and checked.

Are identifiers removed or masked before anything leaves your systems?

Yes means: every tool handling client data.

Do engagement terms and privacy notices explain AI use, including any substantially automated decisions?

Yes means: both, naming the third parties, with consent obtained where required and automated decisions disclosed in the privacy policy.

Is there a register of AI tools and the data each can reach?

Yes means: every tool, reviewed in the last 6 months.

Is MFA on every AI account, and are those accounts covered by onboarding and offboarding?

Yes means: both, every account.

Does the breach response plan cover AI incidents?

Yes means: yes, with an owner named, reviewed in the last 12 months.

Are AI figures reconciled to source records before use?

Yes means: every time, recorded.

Is AI output checked like a staff member's work, with a named person signing off?

Yes means: every time, recorded.

Keeping and deleting data

Is there a written retention schedule that covers AI data (prompts, chat history, uploaded files, outputs)?

Yes means: written; AI data has a set deletion period of 90 days or less; financial, tax and AML/CTF records are listed separately with their legal periods.

Is every AI tool set to delete chat history and uploads within that period, with training on your data switched off?

Yes means: every tool, with the settings exported for each.

Are financial, tax and AML/CTF records protected from that deletion and kept for their legal periods?

Yes means: kept at least 5 years after the service (Tax Practitioners Board), 7 years for company financial records (Corporations Act s286) and 7 years for customer due diligence records (AML/CTF Act), with a hold so AI clean-up cannot delete them.

Are tax file numbers destroyed or de-identified once no longer required, including copies in AI tools, downloads and email?

Yes means: a written procedure, with the last clean-up recorded; identity documents held for customer due diligence are kept, not destroyed.

Is deletion verified, including at the AI vendor?

Yes means: vendor deletion confirmation or a log for the last cycle.

0 of 15 answered

The full report, A$29

What the full report adds

A PDF of your own answers, worked through. Bought from your result, delivered the moment you pay.

Where you stand

All fifteen questions, and how firms like yours answered each one.

The path to ready

What closes each gap, in the order that matters.

Every gap, ranked

How serious each one is, and the requirement that closes it.

What is at stake

The obligations behind each question, in plain English.

Essential Eight

Your self-rating against the level a firm holding tax file numbers usually needs.

How it was worked out

The method, and what a self-assessment can and can't tell you.

Want it checked?

A self-check reports what you told us. A verified assessment starts from those same answers and checks them: the evidence behind each one, every user account against your staff list, and the Essential Eight assessed by a cyber security partner. It ends in a report you can show a client, an insurer or a regulator.

Questions

What happens to my answers?

They are kept by Allwis to produce your result and your report, and we may contact you about them. They are not shared with anyone else. Only tick "keep me posted" if you want our updates as well.

What is the Essential Eight?

The Australian Cyber Security Centre's eight baseline protections, from multi-factor authentication to backups. Your own rating here is indicative only; a cyber security partner assesses the real maturity level.

What does "self-assessed" mean?

The result reflects your own answers, which nobody has checked. The free result and the full report both say so on every page. A verified assessment is the version someone has checked.

Is this legal advice?

No. It describes common obligations in general terms. Real cases turn on facts the check doesn't ask about.

How long does it take?

About ten minutes. You see your score as soon as you finish, and we email you a copy.

Want a verified assessment, or to talk your result through?

Talk to us