The same argument, run on your figures.
The briefing walks the four questions through one worked example from your practice. You leave with a one-page gap read of where your current AI use stands against the dates above.
REP 798 is a structural problem, not a tooling one.
In October 2024 ASIC published REP 798, a review of how 23 AFS and credit licensees govern their use of AI. It reads like a complaint about process, but the problem is structural. This brief is written to be forwarded: to your licensee, your audit committee, or the partner who signs what your practice sends out.
What ASIC actually found
The review covered 624 AI use cases across 23 licensees. Three findings matter for a practice of our readers’ size. First, adoption is running ahead of governance: roughly half the licensees reviewed had not updated their risk management policies to address AI at all. Second, where policies existed, coverage was thin: only 12 of the 23 had policy documents that addressed fairness, discrimination or bias. Third, and least noticed, arrangements for a client to contest a decision shaped by AI were close to absent across the sample.
ASIC’s title for the report was “Beware the gap”. The gap is not between good and bad models. It sits between what the model produced and what the licensee can prove about it.
Why “AI accuracy” is the wrong frame
None of those findings are about output quality. They are about evidence: where the input came from, who saw it, what happened to it between the model and the client, and what the adviser actually signed. Those are provenance, attribution, retention and authorisation questions, and they have answers a regulator can check. Accuracy does not.
This is also why the obligation does not soften as models improve. A better model produces a better unverifiable paragraph. Section 286 of the Corporations Act still requires the artefact to be reconstructable on demand for seven years. s912A still asks whether the licensee took reasonable steps. The model cannot answer either question. The record around it can.
The four questions every output must answer
The deficits ASIC named collapse into four columns: provenance (where each figure came from), attribution (how it was produced and from which systems), retention (a tamper-evident record that outlives staff turnover and platform migrations), and authorisation (a named person who signed it, with the evidence in front of them). A practice that can answer those four questions for every AI-assisted output has nothing to fear from the next review. A practice that cannot is exposed on every file.
What this looks like in a practice
Take the work our readers actually do: a fee-for-no-service remediation review across a 25-adviser book. The AI drafts the provision figure in minutes. The question that decides whether that figure is usable is not whether it is right; it is whether the practice can show the fee ledger rows it came from, the platforms that were reconciled, the calculation that was replayed, and the Responsible Manager who signed it. That is what separates an AI experiment from a defensible file.
The dates that make this a 2026 problem
AML/CTF Tranche 2 brings accountants and other DNFBPs under AUSTRAC obligations from 1 July 2026. The Privacy Act’s APP 1.7 transparency obligation for automated decision-making commences 10 December 2026. Both assume records that most practices are not yet producing. The record needs to exist before the dates do, in a form an auditor can read in one sitting.
Where Fydis stands
We build Fydis on one rule: every output is evidence. A practice runs its AI work through it. Brief it the way you would brief a junior, and what comes back has its provenance, attribution, retention and authorisation record attached, so what your people sign is verified rather than asserted. It cannot sign and it cannot advise; that stays with you. We are early, and we say so plainly: the build is reviewed by a working lead auditor, our certifications are in progress and stated honestly on the trust page, and we are taking a small number of design partners rather than running a volume funnel.