External Party Requirements

All contractors, volunteers and vendors must sign a written acknowledgment of this policy and complete mandatory AI policy training before being granted system access. Such acknowledgment must include certification that they will not submit NDIS participant data to external AI systems. EduLinked Pty Ltd retains audit rights to verify compliance with data handling requirements, and external parties must report any suspected breaches within 24 hours. Non-compliance may result in contract termination and regulatory notification, with records of acknowledgments and training completion maintained for a minimum of 7 years.

External parties must maintain their own records demonstrating compliance with this policy, including logs of system access, data handling procedures, and training completion certificates. These records must be made available to EduLinked Pty Ltd upon request within 24 hours and must be retained for the same minimum period as required by EduLinked Pty Ltd. Failure to maintain or produce such records constitutes a material breach of contract and may result in immediate suspension of system access pending investigation.

Quarterly Audits

EduLinked Pty Ltd will conduct quarterly audits of external party compliance through documented record review and spot-check verification of system access logs, data handling procedures, and training certifications. All external party acknowledgments, training completion records, and audit findings must be documented in a centralized repository maintained by EduLinked Pty Ltd for regulatory review purposes, with all records retained for a minimum of 7 years in accordance with NDIS regulatory requirements.

Risk Assessment Requirements

Before implementing AI text generators in any workflow, users must complete a basic risk assessment considering:

1. Data sensitivity and privacy implications
2. Accuracy requirements of the output
3. Potential impact on service quality
4. Compliance with existing workflows

Document this assessment and store it according to EduLinked Pty Ltd's record-keeping practices.

All risk assessments must be completed using EduLinked Pty Ltd's standardised risk assessment template and submitted to the user's manager or compliance officer for review and approval before AI implementation commences. Risk assessments involving participant data, service delivery decisions, or clinical workflows must be escalated to Sarah Ailish McLoughlin, Director for approval. All completed risk assessments must be stored in EduLinked Pty Ltd's centralised risk assessment repository, with records maintained for a minimum of 7 years.

Quarterly Risk Assessment Review

EduLinked Pty Ltd must establish a quarterly risk assessment review process to identify:

• Patterns of high-risk AI implementation across teams or workflows
• Systemic vulnerabilities requiring policy amendments or additional controls
• Teams or individuals requiring supplementary training or support
• Emerging risks from new AI technologies or use cases

The quarterly analysis must be documented in a written report submitted to the Director within 14 days of quarter end.

Content Retention

Users must ensure that AI-generated content is retained only for the minimum period necessary for its intended purpose:

• Content used in participant service delivery must be retained in accordance with NDIS record-keeping requirements
• Content used for internal administrative purposes should be deleted within 90 days unless required for compliance or legal purposes
• All AI-generated content containing personal or sensitive information must be securely destroyed using encryption or certified destruction methods

EduLinked Pty Ltd must maintain a centralised deletion register documenting all AI-generated content destruction. Deletion certifications must be retained for 7 years.

Three-Point Validation Process

All AI-generated content must undergo the following validation process:

1. Fact-checking against at least 2 authoritative sources
2. Quality assessment against EduLinked Pty Ltd's quality benchmarks including accuracy, relevance, and completeness
3. Human review by a qualified team member

Each validation step must be documented with a standardised checklist, and content failing any validation criteria must be either revised or discarded. The time required for this validation process should be factored into the assessment of whether using AI generators improves overall efficiency.

Validator Qualifications

Validators must possess relevant professional qualifications and expertise appropriate to the content type being reviewed:

• Support coordination content must be validated by qualified support coordinators
• Clinical or therapeutic content by appropriately credentialed clinical staff
• Participant-facing materials by staff with demonstrated expertise in disability-affirming communication and NDIS Practice Standards

All validators must complete training in accessibility requirements, plain language principles, and participant-centred practice before conducting validation activities.

Training Requirements

• Training shall be conducted annually, with mandatory completion of assessment modules and certification
• Records of training completion and assessment results must be maintained for a period of 7 years
• Role-specific training modules must be completed based on staff responsibilities
• All staff must achieve a minimum assessment score of 80% and obtain certification before being granted access to AI systems
• New staff required to complete training prior to commencing duties involving AI tools

Annual Refresher Training

Annual refresher training must be completed by all staff, incorporating updates to:

• NDIS Code of Conduct requirements
• Privacy Act obligations
• AI system capabilities

Training completion rates must be tracked and reported quarterly to management, with staff failing to complete required training within 30 days of the due date subject to suspension of AI system access until training is completed.

Breach Involving NDIS Participant Data

Following any breach involving NDIS participant data:

• Conduct root cause analysis within 5 business days
• Implement corrective actions to prevent recurrence
• Document all findings in a breach review report submitted to the Director
• All breach incident records retained for 7 years
• Notify the NDIA within 5 business days using the NDIA breach notification template
• Notify affected participants within 7 days using accessible formats appropriate to their communication needs

Compliance Audits

The organisation must conduct quarterly compliance audits of AI system usage, data handling practices, and disclosure documentation. A designated compliance officer is responsible for:

• Reviewing access logs, validation records, and participant disclosure compliance
• Documenting findings and corrective actions
• Submitting an annual summary report to the Director for governance review

All audit records retained for a minimum of 7 years.

Policy Review Schedule

This policy will be formally reviewed at least every 6 months by a governance committee comprising representatives from operations, compliance, and disability services. Reviews will assess alignment with:

• Current NDIS legislation
• Disability services standards
• AI regulatory developments

All review outcomes will be documented, and policy updates will be communicated to staff within 14 days of approval, with mandatory training provided on material changes.

Training Requirements

Training must include:

• NDIS Code of Conduct obligations
• Participant rights under the NDIS Practice Standards
• Privacy requirements under the Privacy Act 1988 (Cth)
• Prohibited data categories
• Validation standards for disability services
• Documentation requirements

Training must be completed before AI tool access is granted and refreshed annually, with completion records maintained for compliance purposes.

Participant Disclosure Requirements

When AI text generators are used in preparing participant communications, support plans, progress reports, or service documentation for NDIS participants, this must be disclosed to the participant or their representative in writing and documented in participant records. The disclosure must include:

• The purpose of AI use
• The type of content generated
• Confirmation that human review and validation by qualified personnel occurred

For all external communications with NDIS participants or their representatives, AI use must be explicitly stated within the communication itself to ensure compliance with NDIS Practice Standards and participant rights frameworks.

Accessible Disclosure Standards

Disclosure must be provided in plain language appropriate to the participant's communication level and needs, with alternative formats offered including:

• Visual supports
• Audio recordings
• Easy-read documents
• Support person involvement based on documented communication preferences

Staff must use a standardised disclosure template explaining what AI was used, what content was generated, how it was validated by qualified staff, and how the participant can provide feedback or request changes.

Staff must verify participant understanding through conversation, confirmation processes, or support person involvement, documenting the disclosure method, format used, date, verification method, and outcome in participant records.