The licensee chooses the method. ASIC does not prescribe how a consumer remediation is scoped, so every assumption inside that scope belongs to the entity that applied it. An assistant grounded in the licensee's own de-identified file can draft candidate cohorts, candidate assumptions and the evidence trail behind both. It cannot own any of them.
The practitioner change is procedural rather than technical. Build an assumption register as the artefact the model fills and an accountable executive signs, and start no payment run before that signature is on it. The drafting speeds up. The decision does not move.
What does RG 277 actually leave to the licensee?
ASIC's Regulatory Guide 277 Consumer remediation puts the choice on the licensee in the key points to Section F, Methodologies for determining the scope and appropriate outcome: "Licensees must decide what methodology to use to determine the scope of the remediation (see Section D) and appropriate outcome (see Section E)." Data analyses, file reviews, assumptions, or a combination are all open. The guide constrains the quality of the choice, not its shape.
That matters for dating as much as for method. The ASIC landing page for RG 277 records that "This guide comes into effect on the date of publication (i.e. 27 September 2022)", and that remediations initiated before that date remain under RG 256. As at 26 September 2026, the version ASIC publishes is the September 2022 guide as amended in April 2026. The document history records an October 2024 update for record-keeping instrument references and Australian Financial Complaints Authority (AFCA) systemic issues, and an April 2026 amendment reflecting the updated RG 181. Cite the paragraph and the edition, never "current".
The scale sits in ASIC's media release 22-260MR, published 27 September 2022, which states that "Over the past six years ASIC has overseen at least $5.6 billion in remediation for an estimated seven million Australian consumers for failures identified across the financial system." Those are point-in-time totals as at 27 September 2022, and ASIC's position moved after that release: its news item of 25 September 2023 records more than $7 billion overseen for an estimated 8.42 million consumers over the preceding seven years. At that scale the assumption register is the only record that explains why one consumer was in scope and another was not.
RG 277 says nothing about artificial intelligence. The obligation underneath it is the general obligation ASIC names in that release, on Australian financial services (AFS) licensees and credit licensees alike, to provide the financial services or credit activities covered by the licence efficiently, honestly and fairly. For an AFS licensee that is section 912A(1)(a) of the Corporations Act 2001, which requires a licensee to "do all things necessary to ensure that the financial services covered by the licence are provided efficiently, honestly and fairly". That wording was read on the consolidated text against Compilation C2026C00382, compilation 148, effective 27 August 2026 and registered 9 September 2026, the compilation the Federal Register of Legislation served as at 26 September 2026. A model in the workflow changes none of it.
The artefact is an assumption register, not a report
RG 277.137 sets the test an assistant cannot pass on its own: "Before applying an assumption, licensees must ensure it is evidence based, documented and appropriately justified. ASIC may request these records if necessary." RG 277.230 adds that licensees "should document the remediation methodology and process. Records should track key steps and decision milestones ...".
Read those two together and the artefact designs itself: a row per decision, an owner on each row, and the thing produced when ASIC asks how the scope was reached.
The model fills the first eight columns. The last four are human, and the signature column gates the money. Keep the drafter column honest: a reviewer reads a machine draft differently.
Step one: de-identify before anything reaches a model
The task through this article is one scope: a fee charged for [PRODUCT] across [REVIEW_PERIOD_START] to [REVIEW_PERIOD_END], where the entitlement records that would show whether the fee was earned are incomplete.
The Office of the Australian Information Commissioner (OAIC) guidance on privacy and the use of commercially available AI products, published 21 October 2024 and updated 17 January 2025, is direct: "As a matter of best practice, the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools". Its worked example, an insurer entering claim details into a public chatbot, is the failure this workflow designs out. Where personal information does reach an AI product, the Australian Privacy Principle 10 (APP 10) accuracy obligation carried in the same guidance applies on top.
Vendor terms are no substitute for that step. As one dated example, an Anthropic privacy centre article dated 18 August 2026 states that inputs and outputs from its commercial products are not used for model training by default, and draws a separate policy for consumer plans. That is one vendor, on one date, and an overseas provider. The page was checked as at 26 September 2026 and still carried that date. Read the terms attached to the account the remediation team uses, and record the answer in the scoping paper.
TheAICommand works to the Verified Draft Method: de-identify the inputs, ground the model in your own source material, keep a person at the decision point, verify against the primary source, and log what happened.
In practice, the model receives the scoping paper for [REMEDIATION_ID], the product terms for [PRODUCT], the data dictionary, and a de-identified data profile: counts by field, with null and row counts by month. The consumer record set never reaches the model, and neither do names, account numbers or balances. Scoping is an argument about fields and cohorts, not about individuals.
Step two: which cohorts can the file actually evidence?
For larger or more complex remediations, RG 277.142 asks licensees to "consider whether there are cohorts of consumers who share common features or experiences that can be identified", and RG 277.144 lists what the decision on triage order could consider, including "cohorts that are experiencing situational vulnerability (this may include financial difficulty or hardship)". The risk with a model here is invention: plausible cohorts drawn from general knowledge of the product, presented in the same tone as the evidenced ones.
What to check: open the NOT EVIDENCED list first, because it is the honest half of the output. Then take three cohorts from the evidenced list at random, confirm the named field exists in the data dictionary with that exact name, and confirm the presence claim traces to a printed count in the profile. A field name the model has smoothed into something more readable is the first sign it is writing from pattern rather than from the file.
On the worked scope, one line from each list comes back like this. Evidenced: holders of [PRODUCT] charged in a month where the entitlement flag is null, identified by ENTITLEMENT_FLAG, from section 3 of the scoping paper, present because the profile prints a row count for every month in the period. Under NOT EVIDENCED: consumers in financial hardship during the period, because no hardship field appears in the data dictionary.
Step three: turning data gaps into register rows
RG 277.115 sets the direction: licensees "should only use assumptions in a remediation if they are beneficial to consumers ...". RG 277.116 points the same way, at the risk of any affected consumers falling out of scope when identifying affected consumers. RG 277.127 goes further where the gap is the licensee's own doing: if a licensee has breached its record-keeping obligations and as a result is unsure whether a consumer has suffered a loss, it "must make assumptions that are beneficial to consumers where there are reasonable grounds to suspect loss may have occurred".
The output wanted here is rows, not prose. Prose invites a reviewer to read for tone. Rows force them to read for the empty field.
What to check: every NOT EVIDENCED field, because those rows are the work list. Then check the evidence base column names a document and paragraph the licensee holds, not a plausible external benchmark. Treat a row whose assumption is a rounded number with no distribution behind it as unfinished.
On the worked scope, the first row comes back like this.
That row is not finished. Its evidence base cell reads NOT EVIDENCED, which puts it at the top of the work list rather than in front of a signatory. A finished row names the document and paragraph in the licensee's own file where the null convention is recorded, and states the remedy as the full fee for the period rather than a figure the model produced.
Step four: can the model argue against its own assumption?
This step costs one more pass, and it is the one the register cannot fake. RG 277.125 names five factors that may indicate an assumption is not beneficial to consumers, among them "unjustifiably narrow scoping" and "unjustified discounting or inappropriate averaging", and says the list is not exhaustive. RG 277.123 is blunter still: "There will be limited circumstances when it will be appropriate to use a median or mean as the basis for an assumption."
Run the draft back through the model as the opposing case before a person reads it.
What to check: first, that the five headings the model worked through are the five factors printed at RG 277.125 in the attached guide, word for word. A factor phrased more helpfully than the guide phrases it is a fabrication, and the whole pass is void. Then read the numbered data list rather than the argument. A pass that names three fields the licensee could pull this week has done its job; one that produces elegant reasoning and no data request has not. Every CANNOT TELL FROM THE FILE line is a candidate for a file review rather than an assumption.
On the worked scope the strongest return is under unjustified discounting or inappropriate averaging, and its data list opens with the ENTITLEMENT_FLAG null count by month in the profile for [REVIEW_PERIOD_START] to [REVIEW_PERIOD_END]. A null rate flat across the period supports the assumption; a spike in one quarter does not.
Where does this go wrong?
Four failure modes show up here, and each maps to a paragraph.
- Averaging. A model reaches for a mean because a mean is easy to justify, and RG 277.123 says the circumstances where that is appropriate are limited. The margin of error column is the defence: a mean with no distribution behind it cannot fill it.
- Narrowing. Asked to scope from the data, a model scopes to the data it can see cleanly, which is RG 277.125(a) unjustifiably narrow scoping. The defence is the NOT EVIDENCED list from step two, read before the evidenced list.
- Treating an absent record as no loss. Where the records are missing because a record-keeping obligation was breached, that is the direct inverse of RG 277.127. Where no breach is in play, RG 277.115 still points the other way. A silent record is a data gap, and a data gap gets a register row, not an exclusion.
- The plausible citation. A model will name an industry benchmark or a prior remediation it was never given, in the same register format as everything else. The evidence base column is the control: an answer that is not a document and paragraph in the licensee's own file fails on sight.
Who signs, and when
RG 277.213 states that "Large remediations should have a level of oversight by a senior person who is able to make, and is experienced in making, decisions for the business on a day-to-day basis", and RG 277.215 lists what that oversight could involve, the first item being "reviewing and testing the design of the remediation (including any assumptions used)". The register turns that into a date on a page. The term accountable executive is this article's label for whoever the licensee's governance pack names as the signatory.
RG 277.214 is the paragraph behind the reviewer column: oversight by a senior person removed from the operation of the remediation. That is why the reviewer names someone outside the team that built the calculation. RG 277.227 is the separate reason the people who caused the failure stay out of the remediation. It ties the conflicts obligation at section 912A(1)(aa) of the Corporations Act to remediation staffing, saying staff or providers who engaged in the misconduct should generally be "not involved in the remediation and ... unable to influence anyone who is involved in the remediation".
Report 798 Beware the gap: Governance arrangements in the face of AI innovation, released 29 October 2024, analysed 624 AI use cases in place or in development across 23 AFS and credit licensees as at December 2023, found that AI was augmenting rather than replacing human decisions, and recorded that "in the case of two licensees, AI governance arrangements lagged AI use". That report covers licensee AI use generally, not remediation scoping, on 2023 data. Read as at 26 September 2026, its transferable point is narrow: the governance artefact exists before the tooling, not after.
Two things follow the signature. RG 277.140 sets the revisit trigger: where new information suggests an assumption is no longer beneficial to consumers, licensees "should revisit the assumptions and consider whether any supplementary compensation is necessary". That is what the twelfth column records. And complaints arriving mid-remediation run under the RG 271 internal dispute resolution timeframes covered in the piece on AI-assisted complaints handling, on a separate clock from the scope.
Do this Monday
The artefact is the assumption register. The owner is the remediation lead, the reviewer is a second line risk or internal audit officer with no role in building the calculation, and the signatory is the accountable executive named in the governance pack.
First step, inside an hour, with no data request: open a spreadsheet, create the twelve columns above, and take the single largest data gap already named in the current scoping paper. Attach the scoping paper and the published copy of RG 277, then run the step three prompt with two edits. Cut the product terms, the data dictionary and the data profile from its attachment list. Add one line at the end: draft one row only, for the data gap pasted below, and write NOT EVIDENCED in MARGIN OF ERROR until the profile lands. Then paste the gap. Raise the data profile request the same morning, and run step two when it lands.
The check that tells you it worked is one someone else runs. Where the evidence base cell names a document and a paragraph, hand the row to the person named in the reviewer cell and ask them to open it without asking you where it is. If they cannot find it inside five minutes, the cell fails and the row goes back. Where the cell reads NOT EVIDENCED, the hour still worked, and the check is that the reviewer agrees the row names the largest gap in the scoping paper and that nothing in it came from outside the two documents you attached.
The bottom line
RG 277 leaves the methodology to the licensee, and that choice carries every assumption made under it. An assistant grounded in a de-identified file can draft cohorts, rows and the opposing case, which changes the tempo of scoping and none of its accountability. The control is an assumption register with an evidence base column that survives the question of where the number came from, and a signature before the money moves. Build the register first. Then let the model fill it.
TheAICommand. Intelligence, At Your Command.
