What a Migration Agency Can Safely Automate, and What Must Stay With a Registered Agent

Most migration agencies we talk to have the same problem. The registered agents are spending hours a week on work that needs no migration knowledge at all: acknowledging enquiries, finding a time for a consultation, sending the same document list again, reminding a client that their police certificate is still missing. Automation can take most of that off their desks. The harder question is where to stop.

For a migration agency, that line is drawn by law, not by taste. Only certain people can lawfully give immigration assistance, and registered agents are bound by the Code of Conduct for registered migration agents. This article sets out what we think is safe to automate, what should stay with a registered agent, and the privacy points to check before you switch anything on. It is general information, not legal advice; if you are unsure how a rule applies to your practice, check the source or get advice from a professional.

Where the line sits: immigration assistance

The Department of Home Affairs describes immigration assistance as using knowledge of, or experience in, migration procedure to assist with visa applications or other visa matters by preparing or helping to prepare an application or other document, advising about a visa application or visa matter, or representing someone in, or preparing for, proceedings before a court or review authority. Only registered migration agents, Australian legal practitioners and exempt persons can lawfully give it. OMARA's factsheet notes that giving unlawful immigration assistance is an offence carrying a penalty of up to 10 years imprisonment.

The same OMARA factsheet lists what immigration assistance does not include: clerical work such as scanning or posting documents, translation or interpretation, advising someone that they must apply for a visa, and passing on information produced by a third person without substantial comment or explanation. That list is a useful test for automation. A system that schedules, reminds, files and forwards is doing clerical work. A system that tells someone which visa suits them, whether their evidence is good enough or what their chances are is giving advice, and that belongs with a registered agent.

The Code duties that matter most for automation

The current Code came into effect on 1 March 2022 and is prescribed by the Migration (Migration Agents Code of Conduct) Regulations 2021. It replaced the older Code that sat in Schedule 2 of the Migration Agents Regulations 1998, so make sure any checklist you rely on refers to the 2021 instrument. These are the sections we keep in front of us when designing a workflow for an agency:

What is safe to automate, with guardrails

What must stay with a registered agent

• Assessing eligibility or recommending a visa subclass or pathway
• Reviewing whether evidence meets the criteria, and anything that comments on documents beyond receiving them
• Discussing prospects, timeframes or risks with a client
• Drafting or settling applications, submissions and responses to departmental requests
• Explaining a refusal, a review deadline or a change in the law to a client
• Accepting a new client, including the identity checks in section 36 and the service agreement

A practical rule: if the message could change what a client decides to do about their visa, a registered agent writes it or approves it before it goes.

Privacy: the questions to answer first

The Australian Privacy Principles in the Privacy Act 1988 govern how covered organisations collect, use, disclose and secure personal information. The OAIC notes that most small businesses with annual turnover of $3 million or less are not covered, but some are, so check your position using the OAIC's small business guidance rather than assuming. Either way, the Code's confidentiality duty in section 35 applies to every registered agent regardless of turnover.

If your automation uses AI, the OAIC's guidance on commercially available AI products is worth reading in full. It says privacy obligations apply to personal information entered into an AI system and to output that contains personal information, that businesses should do due diligence on a product and build in human oversight, and that privacy policies should explain the use of AI clearly. As a matter of best practice, the OAIC recommends not entering personal information, and particularly sensitive information, into publicly available generative AI tools. Pasting a client's passport details or relationship history into a free chatbot fails that test.

One more date to note. From 10 December 2026, APP entities must include information in their privacy policy where a computer program makes, or does something substantially and directly related to making, decisions that could reasonably be expected to significantly affect individuals' rights or interests. An automation that only acknowledges, schedules and reminds is unlikely to be making decisions of that kind, but if you are using software to screen out enquiries or rank clients, read the OAIC's APP 1 resources first.

A short checklist before you switch anything on

• Every template has been read and approved by a registered agent, and contains no eligibility or outcome statements
• Automated messages identify the agency and say when a person will follow up
• Booking confirmations include the agent's name, MARN and the consultation fee
• Documents arrive through a secure portal, not as loose email attachments
• Every automated message to a client is saved to the client file
• Anything the system cannot classify goes to a named person, not into a generic inbox
• You know where your tools store data and have checked your privacy policy against them