Guide
Privacy compliance kits: what they do, what they miss and when software is the better buy
Privacy compliance kits vs a living AI register. What a kit covers, where it goes stale under the new automated decision rules and when software wins.
What do privacy compliance kits do, and when is software the better buy?
A privacy compliance kit gives you professionally drafted templates, such as a privacy policy, a self-assessment questionnaire, checklists and registers you fill in yourself. For a lean organisation that just needs somewhere to start, that is useful, and it is why kits and template packs are a well-established corner of the Australian privacy market. But a kit has one structural property no amount of drafting quality fixes. It describes your organisation as at the day you completed it. The automated decision-making obligations arriving on 10 December 2026 are not met once on a single date. They are standing ones.
This guide explains what a kit covers well, where it goes stale and how to decide whether a kit or a living register is the right spend for your organisation.
Why this decision is in front of you now
From 10 December 2026, Australian Privacy Principles 1.7 to 1.9 require your privacy policy to disclose the kinds of decisions computer programs make, or substantially and directly help make, where those decisions could significantly affect people, and the kinds of personal information the programs use. Meeting that requirement takes two things. You need to know which of your systems actually make those decisions, and you need to keep the answer current as systems change. The first is a project. The second is the part that never finishes, and it is the part a kit cannot do.
What a kit gives you
A good kit gets you moving. Template policies mean you are not drafting from a blank page. A self-assessment walks you through questions you might not have thought to ask. A register template gives you the columns worth filling in. If your organisation has never done structured privacy work, completing a kit will teach you a great deal about your own operations, and the discipline of working through one is real work with real value.
The drafting quality from the established providers is usually high. The problem is not the quality. It is the tense.
Where a kit goes stale, and how fast
Everything a kit produces is true on the day you finish it. Then your organisation keeps moving. You adopt a new tool with scoring built in. A vendor adds AI features to software you already run. A team starts using an eligibility check, a triage model, a hiring screen. None of those events updates your completed questionnaire, your filled-in register or your published policy. Each one quietly pulls the documents out of true.
The December obligation makes this a legal problem rather than a housekeeping one, because the disclosure duty attaches to what your systems do now, not what they did when you bought the kit. An organisation that completed a kit in March and adopted two new automated decision tools by September has a privacy policy that no longer describes its automated decision-making, and nothing in the kit will tell them so.
What a living register does differently
The alternative is to hold the same information as a system rather than a document. The systems in use live in a register, each system’s record keeps a new version as things change, and a new tool lands on the register when it is adopted rather than when someone remembers to update a spreadsheet.
Where Aicura fits
Aicura’s Privacy tier compares your AI register with your privacy policy. It reviews the policy against APP 1.7 to 1.9, surfaces the registered automated-decision systems the policy does not yet mention and drafts language you can use. When you add or change a system, or upload a new version of the policy, the review runs again, so the two stay reconciled as your organisation changes.
A kit gives you the artefacts. A register gives you the artefacts plus the mechanism that keeps them true. Aicura provides guidance, not certification, an audit or legal advice, and what your policy says stays your decision, which is the same footing a kit puts you on.
When a kit is enough
If your organisation runs no automated decision-making, adopts new systems rarely and mostly needs baseline privacy documents once, a kit may be all you need. The kit-versus-register question only has teeth where systems change. If you expect to add, upgrade or retire tools with any regularity, or you are not confident you even know where automation already sits in your operations, the problem of documents frozen at the day you finished them will find you.
The cost comparison, plainly
A template pack is a one-off spend, plus your team’s hours to complete it, plus the same hours again each time it needs redoing. Aicura is a subscription that holds the register and runs the policy review as things change, so it does not go stale between efforts. Current rates are on the pricing page. If the obligation were one-and-done, the kit would often win on price. Because the obligation is standing, the comparison is really between paying once for a snapshot and paying for the thing staying true.
Where to go next
If you are starting from zero either way, the guide to building an AI system register covers the same first project a kit’s questionnaire covers, and the framework page on automated decision-making under the Privacy Act sets out which systems are in scope.
Questions
What is in a privacy compliance kit?
A privacy compliance kit gives you professionally drafted templates, such as a privacy policy, a self-assessment questionnaire, checklists and registers you fill in yourself. For a lean organisation that needs somewhere to start, that is useful.
Is a privacy compliance kit enough for the December 2026 automated decision rules?
Only if your systems rarely change. From 10 December 2026, APP 1.7 to 1.9 require the privacy policy to disclose the kinds of decisions computer programs make, or substantially and directly help make, that could significantly affect people. That duty attaches to what your systems do now, and a completed kit describes your organisation only as at the day you finished it.
Why does a privacy kit go out of date?
Everything a kit produces is true on the day you finish it. New tools with scoring built in, AI features added by vendors and new eligibility checks or triage models do not update a completed questionnaire, register or published policy, so each one pulls the documents out of true.
When is a privacy compliance kit the right choice?
A kit may be all you need if your organisation runs no automated decision-making, adopts new systems rarely and mostly needs baseline privacy documents once. If you expect to add, upgrade or retire tools with any regularity, a living register that keeps the record current is the better fit.
Keep your privacy policy in step with your AI
Aicura reviews your privacy policy against the automated decision rules and shows which registered systems it does not yet disclose.