We recommend a balanced growth allocation of 70/30 with an 0.85% indirect cost ratio. On the evidence reviewed, the Best Interests Duty discharged in favour of the proposed switch.
Three claims, none of them backed by a source. You can’t sign this.
How it is governed
Every answer comes with its proof.
AI is already inside the practice; the risk sits with whoever signs. Fydis runs every brief through one chain and returns documents with their working attached, ready for the signature that the law actually recognises.
Mapped to: ASIC REP 798 · APRA CPS 230 · OAIC APP 6 · Corp Act s961B / s912A · DBFO Tranche 2
How a draft becomes a signed file
The path to a signed advice file.
A prompt is not enough for work you have to stand behind. Fydis runs every AI output through the same checks before it can be signed.
- 00INPUTAI draft
Any LLM, any vendor, any prompt. Fydis does not replace the model.
- 01BRIEFBrief
The question enters Fydis, marked unverified. It can’t be signed or exported yet.
- 02RETRIEVERetrieve
Source rows read where they live. Citations land on the cell, the row, the paragraph.
- 03VERIFYVerify
Every claim is checked against a primary record, and figures reconcile to the dollar.
- 04EVIDENCEEvidence
Sign-off captured, with a clause map, replay hash and 7-year retention. Everything needed to defend the file sits with the file.
- 05SIGNEDAdviser signs
Two-eyes review. Named approver on the file.
Fydis sits between the model and the file the adviser signs.
What you have to cover
Three obligations under APP 6, s912A, and PI insurance.
Using AI in a regulated firm puts three obligations on you. Fydis covers all three inside the same workflow.
- 01
Privacy.
APP 6 in plain English: the data that came in for one purpose can’t go into a chatbot for another. The OAIC said so in writing in October 2024. It would be “difficult to establish,” the regulator wrote, that a public AI tool was a reasonable secondary use. Pasting a fact-find into a public LLM is exactly the case the OAIC flagged.
APP 6 · OAIC GEN-AI GUIDANCE · OCT 2024
- 02
Traceability.
Every recommendation needs a traceable source. AI drafts don’t carry that source. s912A doesn’t care that the draft was fast. It cares that the licensee took reasonable steps. If your firm can’t trace a draft, it can’t defend it.
s912A · AFSL OBLIGATIONS · CORP ACT 2001
- 03
Your name on it.
The advice document ends with the adviser’s name and authorised representative number. AI content with no provenance is a personal exposure, not a firm one. PI underwriters know it. The US benchmark forms (ISO Form CG 40 47, Berkley PC 51380) already exclude AI losses without governance evidence; AU policies are following.
s961B BID · PI AI EXCLUSIONS (US BENCHMARKS) · 2024 ONWARD
A worked example
Every claim, checked against a source.
A raw AI draft next to the same output after Fydis. Only the second one shows where each claim came from, so the adviser can sign it and the firm can defend it.
- C1SOURCED✓ verified
“balanced growth allocation”
- C2EVIDENCED✓ verified
“0.85% indirect cost ratio”
- C3GOVERNED✓ policy match
“Best Interests Duty discharged”
What it does and doesn’t do
What Fydis produces, and what stays with the adviser.
- Fydis cannot sign. Every output leaves ready for a signature, not signed. The Responsible Manager signs, and Fydis records who signed, when, and against what.
- Fydis cannot advise. You brief it like a junior, and it returns the working, never a recommendation in its own name. Advisers write the advice. Fydis shows the proof behind it.
- Fydis does not train on your data. Customer data never enters training corpora. Model providers Fydis routes to are configured with training opt-out at the API level.
- Fydis does not move data offshore. AU residency is the default. Data leaves Australia only with an explicit Admin authorisation and only to the model regions you approve.
- Fydis is not a regulator. No regulator approves AI products. ASIC, APRA and the OAIC publish obligations, and Fydis produces the evidence that lets the licensee meet them.
Standards and regulators
Every regulator citation links to the source document.
No badge soup. Every regulator citation links to the source document. Every standard links to its current Fydis status.
Regulators Fydis maps to
What the client gets
What you hand the client.
A Fydis analysis produces three things: the verified workspace, the signed advice document, and the audit pack you keep on file.
Institutional Workspace
Where the adviser does the work.
Open the workspaceSigned advice document
The document you send the client, with every figure traced to its source.
See a sampleSign-off log
A tamper-evident record of who signed off and when, kept for 7 years.
See the logFAQs
- Q01Where does inference run? What data leaves Australia?
- Inference runs in AWS ap-southeast-2 (Sydney). Customer data does not leave Australia without an Admin in your organisation explicitly authorising a model route to a non-AU region. Default deployment is AU-only.
- Q02Do you train on our data?
- No. Customer data is never used to train models. The model providers Fydis routes to (under the AU-hosted Bedrock / Vertex deployments) are configured with training opt-out at the API level.
- Q03Is this approved by ASIC or APRA?
- No regulator approves AI products. ASIC, APRA, and the OAIC publish obligations and we map to them. Fydis is the verification layer that lets you discharge AFSL s912A, CPS 230, and APP 6 with the artefacts the regulator will ask to see. Approval remains with the licensee.
- Q04What about PI insurance? Some policies now exclude AI-related losses.
- The leading US benchmark forms (ISO Form CG 40 47, Jan 2026; Berkley PC 51380, Jun 2024) exclude AI losses unless governance evidence is in place. AU PI policies are following that direction. Fydis maintains that evidence by design: model cards, change logs, evaluation results, audit trail.
- Q05Who is personally on the hook for an output?
- The authorised representative who signs. Fydis is governance over AI, not advice. Fydis does not pre-approve client output, does not perform a licensee's sign-off, does not substitute for the responsible manager's review. The chain produces the evidence the adviser signs against.
- Q06What standards are in place today?
- AU residency. Privacy Act NDB scheme alignment with a 24-hour internal notification SLA (the Act’s statutory standard is “as soon as practicable” within a 30-day assessment window; the 24-hour SLA is Fydis’s commitment on top). CPS 234-aligned incident classification. 30-day sub-processor change notice. ISO 27001 (71 of 93 Annex A controls in place), ISO 42001, SOC 2 Type II all in progress, auditors named in the briefing. Nothing is certified yet.
- Q07Can we run a sandboxed pilot before signing?
- Yes. Design partner programme: four to six weeks, one regulator-facing analysis end to end, twelve-month price lock at the Firm tier. Five to eight design partners taken before Firm tier publishes broadly.
- Q08What happens if Fydis goes away?
- Termination rights are in the DPA. Customer data export is available in PDF + JSON at any point during the contract and for 90 days after termination. The audit trail is exportable as a standalone tamper-evident archive. CPS 230 contractual minimums met.
These questions map to CAIQ v4 and SIG Lite 2026 line items
How an evaluation usually goes
Three steps before a regulated procurement closes.
AU procurement does not run on a single demo call. Each step below is a smaller commitment that earns the next without burning a procurement cycle on the wrong vendor.
01Zero commitment Read the regulatory primer
Six pages. APP 6, s912A, CPS 230, DBFO Tranche 2, REP 798. Zero email.
Open the primer0230 minutes Book a compliance briefing
Thirty minutes with the team. Bring a real figure. We show you the chain end to end.
Scope the assessment034 to 6 weeks Run a sandboxed pilot
Four to six weeks. One regulator-facing analysis end to end. Twelve-month price lock.
Apply as a design partner