TECHNOLOGY, CLOUD AND PROVIDER SCHEDULE

3. Government and professional systems

AIMS also interacts with ATO and other government systems where authorised or required. Those disclosures arise under taxation law, client authority or another lawful basis and are not treated as discretionary technology-provider permission. AIMS may interact with the TPB, professional bodies, insurers, courts, tribunals or regulators where required or lawfully permitted.

4. Client permission under tax-practitioner confidentiality obligations

The client-specific Engagement Letter or another written authority contains the client permission required, where applicable, before AIMS discloses information relating to a client’s affairs to a third-party technology/cloud provider. The permission should identify the relevant provider or provider category, purpose, information involved and location information to the extent required and reasonably ascertainable.

This Schedule is a disclosure document and does not itself constitute consent or permission. AIMS obtains fresh or additional permission where a materially new provider, materially different professional outsourcing arrangement or materially different disclosure is not reasonably covered by the existing authority and fresh permission is required by law or professional standards.

5. No overseas professional preparation under the standard model

AIMS does not currently outsource client tax/accounting professional preparation or advice to overseas contractors under its standard service model. If that position changes, AIMS will address competence, supervision, professional responsibility, confidentiality, privacy, security, professional-indemnity, provider disclosure and client permission before client information is disclosed.

6. AI-enabled and unlisted technology

AIMS may use approved general-purpose artificial-intelligence-enabled tools only for general professional-support purposes, such as research assistance, drafting, summarisation, issue spotting, document organisation, template development and quality-control assistance. A general-purpose AI service is not an AIMS system of record and AI output is not a substitute for professional judgment; material output is subject to competent human review and verification before it is relied upon or communicated as professional work.

Under AIMS’ standard workflow, identifiable or reasonably re-identifiable client-affairs information is not submitted to a general-purpose AI service. Before any client-derived material is used with such a service, AIMS takes reasonable steps to remove, mask or generalise identifiers and to minimise the information so that the provider cannot reasonably associate it with a client or another individual. This includes, as applicable, names, TFNs, ABNs, dates of birth, addresses, contact details, bank details, identity documents, account or reference numbers, signatures, login credentials, property addresses and combinations of facts reasonably capable of re-identification.

De-identification does not displace Code item 6 or any other confidentiality obligation. If material could still reasonably reveal or be linked to a client’s affairs, it must not be submitted to a general-purpose AI service. AIMS’ standard policy does not provide a client-specific authorisation pathway that permits identifiable client-affairs information to be submitted to a general-purpose AI service.

The restriction above governs AIMS’ direct use of general-purpose AI services. Approved core software providers may themselves use affiliates or subprocessors, including AI-related subprocessors, as part of their services. AIMS treats that as a separate provider-governance issue: it reviews available subprocessor disclosures and relevant optional features, does not deliberately enable an optional AI feature to process identifiable client-affairs information unless the feature and provider arrangement have first been assessed, and obtains or refreshes client permission where required by Code item 6 or another applicable obligation.

Internal provider approval, security settings or client permission do not create an exception to this standard de-identified/public-information-only rule for a general-purpose AI service.

7. Security and access controls

Provider use is subject to AIMS’ access-control, multi-factor-authentication, least-privilege, secure-sharing, account/device review, retention, cyber-awareness and incident-response procedures as applicable. Provider security controls reduce but do not eliminate residual risk. AIMS assesses provider incidents under its confidentiality, privacy, data-breach, insurance and business-continuity procedures.

8. Subprocessors, overseas access and change management

Providers may use corporate affiliates and subprocessors and may change infrastructure or support arrangements over time. AIMS reviews material provider changes under its provider-governance process. Where APP 5 requires reasonably practicable overseas-country information, AIMS uses current provider information and this Schedule to communicate what is reasonably ascertainable without representing that a dynamic global provider architecture is fixed.

9. Version control and updates

This Schedule is current as at 7 September 2026. It is reviewed on material provider, contract, subprocessor, account-configuration, data-location, service-function or security changes and under AIMS’ periodic provider review cycle. The client file retains the version incorporated into or made available with the engagement where appropriate. Material changes are communicated and fresh client permission is obtained where required.