About this policy
This policy explains how we may use artificial intelligence (AI) when assisting with a migration matter, the safeguards that apply and the choices available to you. It applies to our registered migration agents, employees, contractors and support personnel in Australia and overseas. Read it with our Privacy Policy and your service agreement.
1. Professional responsibility
The immigration assistance we provide remains the responsibility of the registered migration agent handling your matter. AI is a support tool and does not hold registration, exercise our professional judgement or determine your visa outcome. Approval or refusal of an application rests with the relevant government authority or review body.
Our use of AI must comply with the Migration Act 1958 (Cth), the Migration (Migration Agents Code of Conduct) Regulations 2021 as amended (Code), and applicable privacy law. OMARA requires advance explanation of AI use and written client consent before personal details are entered into an AI platform. AI does not create an exception to restrictions on who may lawfully provide immigration assistance.
2. Permitted assistance
Subject to the controls in this policy, approved AI features in practice management software and approved business AI assistants may help us to:
- Prepare initial drafts of correspondence, checklists, file notes and submissions for review.
- Summarise or extract information from authorised documents and organise file material.
- Locate publicly available legislation, policy or research leads, which the agent independently verifies.
- Improve spelling, grammar and presentation without changing the facts, meaning or your instructions.
2.1 Scope of permitted use
AI is not used in every matter or for every task. Any use involving your personal information must fall within the specific purpose and systems described in your written consent. A feature embedded in software is subject to the same controls as a separate AI application.
3. Prohibited uses
We do not permit AI to:
- Give you personalised immigration assistance that a registered migration agent has not reviewed and approved, or autonomously select a visa pathway, assess credibility, character or health, or decide whether to lodge a matter.
- Invent facts, evidence, employment histories, relationship accounts, references, signatures, certifications or legal authorities; conceal material information; or alter evidence to create a misleading impression.
- Submit an application, send substantive advice, make a declaration, accept instructions or commit you to a transaction without the required human approval and authority.
- Train or fine-tune a general AI model using client information, create reusable client datasets, or use that information for advertising or unrelated profiling.
- Process client work through free, trial, consumer or personally controlled accounts, unapproved browser extensions, public sharing links or unapproved AI meeting assistants.
3.1 Translation and supervision
AI translation is not represented as a certified translation or used in place of a qualified interpreter where one is required. Staff must not use an AI system to bypass professional supervision or access restrictions.
4. Approval of tools and providers
The responsible registered migration agent must approve the provider, product, account type and intended use before client information is processed. A paid subscription, business label or built-in feature is not sufficient by itself. We require an assessment of confidentiality, data locations, provider and subcontractor access, retention, deletion, security and the ability to honour a refusal or withdrawal of consent.
Approval for personal information requires suitable contractual protections and settings that prohibit model training or unrelated reuse of our client data. Any provider access for support, security or abuse monitoring must be assessed and disclosed where relevant. If the required protections cannot be established, the tool must not receive client personal information.
Approved tools and permitted uses must be recorded in a practice register and reviewed when features, terms or processing arrangements materially change. AI access to a file must remain disabled until the necessary consent and controls are in place. The provider and feature proposed for your matter will be identified before you are asked to consent.
5. Protection of information
We use only the information necessary for an approved task. Wherever practicable, staff must remove names, contact details, identifiers, document metadata and distinctive facts that could identify a person. Replacing a name with initials or a file number does not make information anonymous if the person remains reasonably identifiable.
Passports, financial records and complete client files must not be uploaded merely for convenience. Health and character material, family violence or protection claims, information about children and other highly sensitive material require an additional assessment of necessity and risk by the responsible agent. If use is approved, the exact information must be covered by specific written consent and processed in the minimum necessary amount.
Passwords, access codes, authentication credentials and tax file numbers must not be entered into AI tools. We also protect confidential business information belonging to sponsors and employers. Client consent does not authorise us to disregard another person’s privacy, a confidentiality restriction or a legal prohibition.
6. Advance explanation and written consent
Before using AI to give immigration assistance, we explain the proposed role of AI. Before entering your personal information into an AI platform, we obtain an affirmative written choice. The notice identifies the provider and product, the task, the information involved, likely overseas processing, relevant retention arrangements, material risks and the human review that will occur.
Consent may be recorded in a separately accepted clause in the service agreement, an electronic consent record, an email expressly agreeing to the stated use, or the consent form attached to this policy. Merely visiting our website, receiving this policy, making an enquiry, supplying documents or signing a general engagement clause is not treated as AI consent. Options must not be preselected.
Consent must be voluntary, informed and specific. We provide an explanation or interpreter assistance where needed. Each adult whose information is involved must provide the necessary consent, or we must verify that a person has lawful authority to act for them. For children or people who lack capacity, we assess capacity and verify the appropriate representative’s authority.
We seek fresh consent before a material change to the agreed purpose, information, provider or overseas arrangements. Consent to ordinary cloud storage, support work or government lodgement does not, by itself, authorise AI processing.
7. Refusing or withdrawing consent
You may decline AI processing of your personal information or withdraw consent by emailing visa@nanakmigration.com.au. We will not refuse service or increase your agreed fee solely because of that choice. Your matter will continue through our registered migration agent using a workflow that does not enter your personal information into AI tools. We will discuss any practical scheduling implications promptly.
On receiving withdrawal, we stop new AI inputs and further AI processing of your personal information within our control, disable relevant features and instruct relevant providers as appropriate. We confirm the arrangements with you. Withdrawal does not invalidate processing already lawfully completed. We take reasonable steps to delete provider-held material no longer needed, subject to legal retention duties and disclosed technical limits; immediate removal from all backups cannot be guaranteed.
Withdrawal does not require destruction of the client file or affect records we must retain. General research using public material without identifying information may continue. A request to restrict all overseas handling is a separate request and is addressed under our Privacy Policy.
8. Overseas processing and support
Our support team in Jammu, India may assist with file administration under the supervision of our registered migration agent. AI and other technology providers may process information in the United States and other locations identified for the relevant service. Overseas remote access can involve handling outside Australia even where the main file is stored in Australia.
Before an AI use involving overseas processing is authorised, we explain the likely countries and relevant safeguards. Confidentiality obligations, access limits and supervision apply to our overseas support personnel. We do not treat AI consent or acceptance of this policy as a waiver of Australian Privacy Principle 8.1 or of our confidentiality obligations. Further details are in section 6 of our Privacy Policy.
9. Accuracy and human review
AI can omit important facts, produce biased or outdated material, mistranslate a statement or generate convincing but false information. The agent must independently check substantive work against the original evidence and current authoritative sources, including relevant legislation, instruments, departmental requirements and any cited decisions. Particular attention must be given to dates, visa conditions, eligibility requirements, calculations and filing deadlines.
A registered migration agent must review and approve substantive advice, submissions and application material before it is issued or lodged. Administrative outputs are checked by an appropriately trained person under supervision. Review must involve the substance of the work, not merely its spelling or presentation. Where a draft records your experiences or makes a declaration, we also obtain your confirmation of its accuracy and the required authority before use.
You may ask how AI was used on your matter, raise a concern about an output, request a correction or ask for an explanation from your registered migration agent. AI does not reduce our responsibility for the assistance we provide.
10. Chatbots and recording
If we introduce an AI chatbot or automated voice service, it must identify itself as AI before interaction. It must be limited to general information and administration, provide a way to contact a person, and obtain the required consent before receiving personal information. Personalised immigration assistance must pass through the agent’s review process.
We do not activate AI recording or transcription of a consultation without first explaining the purpose, provider, handling and retention of the recording and obtaining the necessary express permission from participants. Written AI consent is also required for personal information processed by that service. A participant may choose a consultation with ordinary written file notes instead. Applicable recording and surveillance laws must be observed.
11. Records and incident response
For material AI use on a client matter, the file must record the tool, date, purpose, consent, categories of information used, material output and the agent’s verification and approval. Relevant prompts or extracts are retained where necessary to understand the work, without creating unnecessary duplicate stores of sensitive information. Client-file retention follows section 11 of our Privacy Policy.
Personnel must complete appropriate training, use only authorised systems and immediately report an incorrect output, unauthorised upload, consent failure or suspected data exposure. The responsible agent must contain the issue, preserve necessary evidence, investigate, correct affected work and consider timely notification to the client, provider, insurer or regulator as legally required. A material error must not be concealed.
12. Questions and complaints
Privacy and AI enquiries: Navpreet Aulakh, Registered Migration Agent (MARN 2619467), Nanak Migration Group, 21 Ravenwoods Way, Craigieburn VIC 3064. Email visa@nanakmigration.com.au · Phone 1300 644 728.
We acknowledge complaints promptly, investigate them and aim to provide a written response within 30 days. If more time is needed, we explain why and give an expected response date. You may complain to OMARA about an agent’s conduct without our permission. Privacy complaints may also be taken to the OAIC where it has jurisdiction, generally after giving us a reasonable opportunity to respond.
13. Review and effect of this policy
The responsible registered migration agent oversees this policy. We review it at least annually and earlier when our AI use, providers, legal obligations or regulatory guidance change. Material changes affecting current clients will be notified, and new consent obtained where needed. A policy update does not retrospectively authorise processing.
This policy does not replace the service agreement or the OMARA Consumer Guide. Nothing in it excludes a legal duty, limits a non-excludable right or releases us from responsibility for our professional services.
14. Legal framework and guidance
The following sources inform this policy. Legislative duties and regulatory guidance are distinct; the additional operational safeguards above are practice standards. Sources reviewed on 15 September 2026.
- OMARA guidance on the use of artificial intelligence.
- Migration Agents Code of Conduct — including professional conduct, confidentiality, supervision and record keeping.
- OAIC guidance on commercially available AI products.
- OAIC guidance on consent.
- OAIC guidance on overseas disclosure.