Free business resources · Australia
Can AI assess your website’s risks?
AI can turn a pile of website notes into a more useful first draft. It still needs reliable evidence and someone responsible for the decisions. A polished report is not proof that a website is safe.
This page explains a possible workflow. There is no automated assessment, report-email service or compliance certificate offered here.
What a useful assessment would need
- Scope: the service, audience, features, connected suppliers and areas the review can access.
- Evidence: owner answers, relevant policies and authorised public-page observations, with their dates.
- Clear findings: observed facts, reported practices, assumptions and missing evidence shown separately.
- A risk register: potential harm, people affected, controls, reasons for priorities and remaining uncertainty.
- An action plan: named responsibilities, review dates and questions that need professional advice.
Where automation could help
Automation could organise a feature inventory, flag missing information, compare supplied evidence with a maintained checklist and turn reviewed findings into consistent report sections. It could also record the source and assessment version so a later review can explain what changed.
A public scan can see only what is exposed on the pages it visits. It cannot establish how staff handle complaints, whether a private account is secure, what a supplier retains or whether a policy is followed. The report must label those areas as unverified.
A responsible report and email workflow
- The client confirms the scope and is told what information would be processed and by whom.
- The service collects only necessary answers and authorised evidence, then checks for missing information.
- AI produces a draft with source references and uncertainty labels.
- A responsible reviewer resolves material gaps and reviews high-risk findings before a final report is released.
- The client receives a notification at a verified address, preferably linking to an authenticated report with limited access.
- The service records delivery status, supports corrections and applies an explained retention and deletion policy.
A low-risk, clearly labelled preliminary summary might be suitable for automatic delivery after validation. Serious findings, unresolved evidence and legal conclusions should be escalated for review. An email provider accepting a message does not establish that the client received or read it.
What it must never promise
No guaranteed legal compliance, government endorsement, complete detection of harm or exemption from liability. Avoid an unexplained “pass” badge or a confidence score that disguises unknowns. The organisation remains responsible for its decisions.
eSafety’s existing tools are learning resources and do not establish regulatory compliance. Their outputs and branding cannot simply become a commercial certification scheme. Read eSafety’s limitations and promotion rules ↗
What you can use today
Download the free worksheet and discuss it with your website team. For implementation help, contact DigiThat. The assessment concept is not included as an available PorridgeWeb membership feature.