AI use-case register and impact assessment.
Structured to the National AI Centre's Guidance for AI Adoption and its six essential practices, so your board can see accountability, risks, testing and human oversight documented for each workflow.
Built for the regulators you actually answer to.
Australia hasn't legislated a standalone AI Act, but that doesn't mean nothing applies. The Privacy Act, the Corporations Act, ASIC's licensee obligations and APRA's prudential standards are all technology-neutral, which means they already apply to every AI-assisted decision your firm makes. Pitt Street is designed so that using it makes those obligations easier to meet, not harder.
What ships with every engagement
ASIC-ready explainability.
ASIC's REP 798 made clear that licensees can't rely on black-box outputs to meet their obligation to act efficiently, honestly and fairly. Every Pitt Street output carries its sources and reasoning, and every decision remains with your people.
APRA service-provider documentation.
For super funds, insurers and banks, we provide the CPS 230 material-service-provider schedule and support your CPS 234 information-security assessment.
Privacy Act compliance.
Data minimisation by design, privacy impact assessments for any workflow touching personal information, and transparency documentation for automated decision-making ahead of the 10 December 2026 commencement under the Privacy Act.
Where your data lives
- Hosted in Australian regions only (AWS Sydney or Microsoft Azure Australia East)
- Separate environment per client. No shared data, no cross-client learning
- Your data is never used to train models
- Model-agnostic architecture, so you choose the provider and the residency terms
- SSO, role-based access, and full audit logs on every query and output
- ISO/IEC 27001 alignment [certification status / target date] and AS ISO/IEC 42001 AI management alignment [status]
- On-premise or private-cloud deployment available for firms with data-residency mandates
Vendor and third-party diligence
We'll complete your vendor security questionnaire, provide our data-flow diagrams and sub-processor list, and sit in front of your risk committee if that's what it takes.