> For the complete documentation index, see [llms.txt](https://docs.solcis.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.solcis.ai/references/ai-regulatory-landscape/asia-and-the-pacific/ai-compliance-in-australia.md).
# AI compliance in Australia
AI compliance in Australia: enforce your controls on what your AI systems do, with evidence held onshore, across APRA, the Privacy Act, SOCI and the ISM.
*You bring your adopted compliance controls. Solcis Compliance Studio maps them to whichever Australian regulations apply, and the Solcis Policy Engine enforces them on what your AI systems do, with evidence held onshore.*
AI compliance in Australia means enforcing your adopted controls on what your AI systems do, with each decision traceable to the clause it satisfies, independently verifiable evidence of every decision, and that evidence held onshore where you need it to be. It supports your compliance across the Australian frameworks that apply to you, including APRA's prudential standards, the Privacy Act, the SOCI Act and the ISM. It is the jurisdiction-specific case of [runtime AI compliance](/references/concepts/runtime-ai-compliance.md).
## Key takeaways
* Australia has no AI-specific law yet, but the government announced mandatory Australian AI Standards in July 2026, with legislation planned for early 2027.
* Existing obligations already reach AI systems. APRA's April 2026 letter to industry names autonomous agents as a supervisory concern, the ISM now has dedicated AI and agentic AI controls, and the Privacy Act's automated decision-making transparency rule starts on 10 December 2026.
* The SOCI Act's Enhanced CIRMP Rules add foreign ownership, offshore access and emerging technology as material risks for nine critical infrastructure asset classes.
* Australia has no general data-localisation rule for the private sector. Onshore requirements come from government hosting policy, sector rules and contracts, and the Hosting Certification Framework is the main way to verify a provider's ownership and control.
* Sovereignty answers where your data and infrastructure sit. AI compliance answers what your AI systems are allowed to do. Both are required.
* Onshore infrastructure is where the evidence is hosted. The Solcis Policy Engine enforces your adopted controls, and Solcis Compliance Studio holds and reports the resulting evidence.
## What's shaping AI compliance in Australia?
AI compliance in Australia is shaped by three forces: regulators writing expectations and controls for AI systems specifically, a policy shift towards verified onshore infrastructure, and existing laws that reach AI systems whether or not they were written for them.
### Regulators are addressing AI systems that act
The [Australian Prudential Regulation Authority's (APRA) letter to industry on AI](https://www.apra.gov.au/news-and-publications/apra-letter-industry-artificial-intelligence-ai), issued on 30 April 2026, lists the manipulation or misuse of autonomous AI agents among the attack pathways APRA has observed. It says governance, risk management, assurance and operational resilience are not keeping pace with AI adoption, and expects human involvement for high-risk decisions and controls over agentic and autonomous workflows. The letter describes the prudential framework as technology and vendor agnostic: in our reading, that means existing standards such as CPS 230 and CPS 234 already apply to AI systems.
The Australian Signals Directorate's [Information Security Manual](https://www.cyber.gov.au/resources-business-and-government/essential-cybersecurity/ism) (ISM) moved in the same direction. The March 2026 release added principle GOV-08, making executives accountable for AI being secure, controllable and human-supervised. The June 2026 release added the first dedicated AI controls, including ISM-2112 (AI applications processing classified data have direct access to public data sources disabled), ISM-2113 (flag organisationally defined risky actions for human approval before execution), ISM-2114 (baselines of expected AI behaviour, monitored for deviations) and ISM-2123 (secure deletion of prompts and outputs). The [September 2026 release](https://www.cyber.gov.au/sites/default/files/2026-08/ISM%20September%202026%20changes%20\(September%202026\).pdf) amended ISM-2113 to require human approval before an AI application executes sensitive or high-impact actions, and added controls for agentic AI covering agent identity and registers, least privilege, task-scoped authorisation, handling of untrusted external content, and central logging of tool calls.
Policy is also moving towards mandatory rules. The [National AI Plan](https://www.whitecase.com/insight-alert/australian-ai-update-australia-changes-course) (December 2025) initially relied on existing laws and the voluntary [Guidance for AI Adoption](https://www.industry.gov.au/publications/voluntary-ai-safety-standard) (October 2025). In July 2026 the Prime Minister announced mandatory Australian AI Standards and an Office of AI in the Department of the Prime Minister and Cabinet, and [National Cabinet affirmed the approach on 26 August 2026](https://www.pm.gov.au/media/meeting-national-cabinet-26-august-26), with legislation planned for early 2027. The [Australian AI Safety Institute](https://www.industry.gov.au/science-technology-and-innovation/technology/artificial-intelligence/ai-safety-institute), operating since early 2026, provides testing and advice but has no enforcement powers.
### Infrastructure policy favours verified onshore hosting
The Digital Transformation Agency's [Whole-of-Government Cloud Computing Policy](https://www.dta.gov.au/updates/whole-government-cloud-computing-policy-now-effect) took effect on 1 July 2026, requiring non-corporate Commonwealth entities to prioritise cloud in new digital and ICT investments. Its [Policy for the responsible use of AI in government](https://www.dta.gov.au/media-releases/ai-policy-overhauled-new-impact-assessment-tool-and-procurement-guidance) (version 2.0, effective December 2025) adds mandatory AI impact assessments, accountable officers for each use case, and internal AI registers.
The [Hosting Certification Framework](https://www.hostingcertification.gov.au/framework) (HCF), administered by the Department of Home Affairs, is how government customers verify a provider's ownership, control and supply chain. Certified Strategic providers accept government-specified ownership and control conditions. An [Information Security Registered Assessors Program (IRAP)](https://www.cyber.gov.au/business-government/protecting-devices-systems/assessment-evaluation-programs/irap) assessment separately tests a specific system against ISM controls.
Investment is scaling that capacity. Microsoft has committed [A$25 billion by the end of 2029](https://news.microsoft.com/source/asia/features/investing-in-australias-ai-future/), AWS A$20 billion over 2025–2029 alongside a Top Secret cloud for ASD, and Firmus, CDC and NVIDIA's [Project Southgate](https://www.datacenterdynamics.com/en/news/firmus-secures-10bn-debt-financing-facility-for-project-southgate-ai-factory-roll-out/) plans AI data-centre capacity from 2026.
### Existing laws reach AI systems
From 10 December 2026, the Privacy Act's [automated decision-making transparency requirement](https://www.oaic.gov.au/engage-with-us/consultations/consultation-on-guidance-for-transparency-in-automated-decision-making) requires entities to state in their privacy policy the kinds of personal information used, and the kinds of decisions made, where a computer program makes a decision or does something substantially and directly related to making it, and the decision could reasonably be expected to significantly affect an individual's rights or interests. The [OAIC's issues paper](https://www.oaic.gov.au/__data/assets/pdf_file/0027/263925/ADM-Issues-Paper.pdf) makes clear this is not limited to fully automated decisions.
Under the [Security of Critical Infrastructure (SOCI) Act](https://www.legislation.gov.au/C2018A00029/latest/text), responsible entities for 13 asset classes must run a Critical Infrastructure Risk Management Program (CIRMP) covering cyber, personnel, supply-chain and physical hazards, using a recognised cyber framework such as ISO/IEC 27001, the Essential Eight, the NIST Cybersecurity Framework, C2M2 or the AESCSF. The [Enhanced CIRMP Rules](https://www.legislation.gov.au/F2026L00701/asmade), in force from 10 June 2026, add foreign ownership, control or influence, offshore or remote access, and emerging technology as material risks for nine asset classes, and raise the framework bar, for example to Essential Eight Maturity Level 2. Neither the Privacy Act nor the SOCI Act was written for AI systems, but both apply where AI systems operate.
## Which regulations and regulators bear on AI systems in Australia?
The table sets out what each instrument requires and how it applies to AI systems that take actions, across financial services, privacy, critical infrastructure and government security.
| Regulation / regulator | What it requires | Relevance to AI systems |
| ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **APRA CPS 230 & CPS 234** (APRA-regulated entities) | [CPS 230](https://www.apra.gov.au/standards/cps-230) has been in force since 1 July 2025, with transitional arrangements for existing service provider agreements and for non-significant financial institutions' business-continuity requirements that ended on 1 July 2026. It sets operational-risk tolerances, business-continuity planning and service-provider management, and [targeted amendments](https://www.apra.gov.au/news-and-publications/final-targeted-amendments-cps-230-operational-risk-management) took effect on 1 July 2026. [CPS 234](https://www.apra.gov.au/standards/cps-234) requires an information-security capability matched to the entity's risk, notification to APRA within 72 hours of a material information security incident, and within 10 business days of a material control weakness the entity expects it cannot remediate in time. | APRA's [April 2026 letter](https://www.apra.gov.au/news-and-publications/apra-letter-industry-artificial-intelligence-ai) expects human involvement for high-risk decisions and controls over agentic workflows, under a prudential framework it describes as technology agnostic. AI systems are within the operational and information-security risks these standards cover. |
| **Privacy Act 1988**, automated decision-making transparency (all APP entities) | From [10 December 2026](https://www.oaic.gov.au/engage-with-us/consultations/consultation-on-guidance-for-transparency-in-automated-decision-making), privacy policies must state the kinds of personal information used and the kinds of decisions made where a computer program makes, or does something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests. APP 8 governs cross-border disclosure through accountability, not localisation. | Covers AI systems that make or materially contribute to significant decisions, including where a human reviews the output. It is a privacy-policy disclosure, not a per-decision notice. |
| **SOCI Act** + CIRMP and Enhanced CIRMP Rules (critical infrastructure) | The SOCI Act covers [11 sectors](https://www.cisc.gov.au/legislation-regulation-and-compliance/soci-act-2018), with register and CIRMP obligations applying to specified asset classes. The [Enhanced CIRMP Rules](https://www.cisc.gov.au/resources-subsite/Documents/enhanced-cirmp-implementation-factsheet.pdf) (from 10 June 2026) apply to broadcasting, domain name systems, electricity, energy market operators, freight infrastructure and services, gas, liquid fuel and water, adding foreign-ownership, offshore-access and emerging-technology risks, phishing-resistant MFA, critical-system segregation and supplier assessments. Telecommunications is covered by separate rules. | An AI system operating in a covered asset – whether run by the responsible entity or a supplier – falls within the entity's risk management program, including its emerging-technology and supplier risks. |
| **ASD ISM**, AI and agentic AI controls (government and security) | The June 2026 ISM added [AI-specific controls](https://www.cyber.gov.au/resources-business-and-government/essential-cybersecurity/ism): ISM-2112 (no direct public data access for AI processing classified data), ISM-2113 (human approval for risky actions, strengthened in September 2026 to sensitive or high-impact actions), ISM-2114 (behavioural baselines) and ISM-2123 (prompt and output deletion), plus controls for using AI in detection (ISM-2117), vulnerability assessment (ISM-2119) and software security testing (ISM-2122). The September 2026 release added agentic AI controls for agent identity, least privilege, task-scoped authorisation, untrusted content and tool-call logging. | A concrete, testable AI control set, assessed through existing IRAP processes rather than self-assessment. The agentic controls map closely to runtime enforcement at the action boundary. |
*Australia's AI compliance landscape across financial services, privacy, critical infrastructure and government security.*
Other reference points include ASIC's [REP 798](https://www.asic.gov.au/regulatory-resources/find-a-document/reports/rep-798-beware-the-gap-governance-arrangements-in-the-face-of-ai-innovation) on AI governance in financial services, the OAIC's [October 2024 guidance on privacy and AI](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products), and, for clinical AI, the TGA's [regulation of software as a medical device](https://www.tga.gov.au/resources/guidance/understanding-clinical-decision-support-system-software-regulation).
## Why does data sovereignty matter for AI systems in Australia?
Data sovereignty keeps AI system activity, and the evidence of it, under Australian jurisdiction. Evidence held onshore stays within reach of an Australian court or regulator.
The ISM's [procurement and outsourcing guidelines](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-procurement-and-outsourcing) have long warned that offshore services may be subject to lawful and covert data collection under foreign laws, and foreign-owned suppliers operating in Australia may still be subject to their home government's disclosure laws. The Enhanced CIRMP Rules now treat foreign ownership, control or influence and offshore access as material risks for covered critical infrastructure. Hosting compliance evidence with a provider whose ownership and control have been verified reduces that exposure.
The ISM's supplier assurance principle, GOV-11, expects suppliers' security practices to be independently verified, or otherwise risk-assessed, on a regular basis. HCF certification and IRAP assessment are the established ways to do that for hosting providers.
For classified data, the ISM also sets physical requirements. ISM-1530 requires classified servers, network devices and cryptographic equipment to be secured in security containers suitable for their classification, and ISM-1569 requires a documented shared-responsibility model between supplier and customer, so it is clear who answers for which controls.
Australia has no general data-localisation rule for the private sector: APP 8 allows cross-border disclosure if the entity remains accountable. Onshore requirements come from government hosting policy, sector rules such as those for My Health Record data, and contracts. Where onshore hosting is required, it provides the physical boundary, and AI compliance enforces what happens inside it. Neither substitutes for the other.
## Applying AI compliance in Australia
Applying AI compliance in Australia means applying the [properties of runtime AI compliance](/references/concepts/runtime-ai-compliance.md) to Australian regulatory inputs: APRA's prudential standards, the Privacy Act, the SOCI Act and the ISM.
* **Preventive enforcement at the action boundary.** The Solcis Policy Engine evaluates the intended action against the applicable controls before it executes wherever possible, returning `Allow`, `Deny` or `Escalate` with a severity rating.
* **Control-to-clause traceability.** In Solcis Compliance Studio, each adopted control is tied back to the exact clause it satisfies. That might be a CPS 230 operational-risk control, the ISM's human-approval control, or the Privacy Act's disclosure requirement.
* **Runtime enforcement, inline.** Where the Solcis Policy Engine enforces inline, the control fires at the moment the AI system tries to act, and the decision is reached before the action proceeds.
* **Tamper-evident and independently verifiable evidence.** Each decision is recorded cryptographically at the moment it is made, in the Solcis Compliance Studio evidence ledger. An auditor or APRA can verify that the record is complete and unaltered using standard tooling, without trusting the organisation or Solcis. Verification establishes what the record says and that it has not changed, not that the underlying decision was correct.
To see these in action, consider an APRA-regulated general insurer that deploys an AI agent to assess and settle home insurance claims. The insurer's delegations framework, part of its CPS 230 operational risk controls and consistent with APRA's expectation of human involvement in high-risk decisions, requires a claims officer to approve any settlement above a set amount or any decision to decline a claim.
When the agent attempts to decline a claim on its own, the Solcis Policy Engine escalates rather than letting the action complete, and a claims officer reviews the file and confirms or overturns the recommendation. Solcis Compliance Studio then records a tamper-evident record of the escalation and the officer's decision – auditable evidence that the control was enforced and how the decision was reached. Because declining a claim significantly affects the customer, the same workflow is also one the insurer's privacy policy must describe under the Privacy Act's automated decision-making rule. A government agency bound by the ISM would trace an equivalent control to ISM-2113.
That record is trustworthy because it is cryptographically verifiable, not because of where it is hosted. Where the evidence physically sits is a separate question, covered next.
## Where can AI compliance be deployed onshore?
The providers below offer onshore infrastructure that can keep Solcis Policy Engine enforcement, and its evidence in Solcis Compliance Studio, under Australian jurisdiction. Certification status should be checked against the [official HCF list of certified providers](https://www.hostingcertification.gov.au/certified-service-providers). Home Affairs paused new HCF registrations and supplementary assessments from November 2025 while the framework is reformed; existing certifications are unaffected.
| Cloud providers / data-centre operators | Certification (HCF, IRAP) and ownership | Relevance |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
| [**Vault Cloud**](https://vaultcloud.com.au/) | HCF Certified Strategic since October 2021, [one of the first four cloud providers certified](https://www.datacenterdynamics.com/en/news/four-cloud-companies-added-to-aus-governments-hosting-certification-framework-green-list/). Privately held and Australian-owned. | A certified onshore sovereign cloud for government workloads. |
| [**AUCloud**](https://aucyber.com.au/) (AUCyber) | HCF Certified Strategic for its Government Cloud Service, with an IRAP assessment at PROTECTED and ISO 27001. AUCyber has been controlled by 5G Networks since 2025 and the two [announced their merger](https://www.cyberdaily.au/security/12797-aucyber-announces-merger-with-5g-networks) in October 2025. | A certified government cloud for sensitive federal, state and local government workloads. |
| **Sliced Tech** ([Deloitte](https://www.deloitte.com/au/en/about/recognition/news/cloud-managed-service-provider-sliced-tech-team-join-deloitte-071021.html)) | HCF Certified Strategic since October 2021; acquired by Deloitte Australia the same month. | A certified government cloud service within Deloitte's Australian practice. |
| [**Macquarie Government**](https://www.macquariegovernment.com/) | HCF Certified Strategic: its Canberra IC4 and IC5 data centres since June 2021, and its Sydney sites and cloud services since August 2021. Macquarie describes IC5 as able to support data up to Top Secret. Owned by Macquarie Technology Group (ASX: MAQ). | Sovereign cloud and data-centre hosting for public and private sector workloads. |
| **CDC Data Centres** (formerly Canberra Data Centres) | [HCF Certified Strategic facilities](https://www.hostingcertification.gov.au/certified-service-providers) at its Hume, Fyshwick, Eastern Creek and Brooklyn campuses; some newer sites are not yet listed. [Owned](https://cdc.com/resources/news/sovereign-cdc-progress-secured-as-shareholders-double-down-on-growth/) by Infratil (49.75%), the Future Fund, CSC and management. | Certified physical facilities for sovereign workloads, including the Project Southgate AI capacity. |
| [**NEXTDC**](https://www.nextdc.com/) | HCF Certified Strategic enclaves in Sydney, Melbourne, Brisbane, Perth and Canberra. NEXTDC [reports](https://www.nextdc.com/news/expanding-australias-sovereign-digital-foundations-a1-adelaide-and-d1-darwin-achieve-certified-strategic-status) that its Adelaide and Darwin sites achieved Certified Strategic status in December 2025; these are not yet on the official list. ASX-listed (NXT). | Physical hosting across seven capital cities. |
| [**AirTrunk**](https://airtrunk.com/) | HCF Certified Strategic facility and service provider for SYD1, SYD2 and MEL1; [ISO 27001 certified](https://airtrunk.com/solutions/certifications/), aligns to SOC 2 criteria, PCI DSS compliant. Owned since 2024 by a [Blackstone-led consortium](https://www.blackstone.com/news/press/blackstone-announces-agreement-to-acquire-airtrunk-in-a-a24b-transaction/) including CPP Investments. | High-capacity physical infrastructure for large AI workloads onshore, under foreign ownership. |
| **Hyperscaler onshore regions** (AWS, Azure, Google Cloud, Oracle) *Onshore hosting, offshore ownership* | AWS ([Sydney and Melbourne](https://aws.amazon.com/blogs/security/aws-melbourne-region-has-achieved-hcf-strategic-certification/)), [Google Cloud](https://itbrief.com.au/story/google-cloud-achieves-certified-strategic-status-in-australia), [Microsoft Azure](https://www.itnews.com.au/news/microsoft-becomes-certified-strategic-cloud-provider-573281) and [Oracle](https://www.oracle.com/news/announcement/oracle-cloud-for-australian-government-and-defence-achieves-australian-hosting-certification-framework-2024-12-11/) all hold HCF Certified Strategic and IRAP assessments at PROTECTED. | Data is hosted locally, but parent companies remain subject to foreign disclosure laws. |
*Certified onshore hosting options alongside the global hyperscalers. Other certified providers appear on the official HCF list.*
## Frequently asked questions
Is there an AI law in Australia?
Not yet. In July 2026 the government announced mandatory Australian AI Standards, affirmed by National Cabinet in August 2026, with legislation planned for early 2027. Until then, AI systems are governed through existing laws such as the Privacy Act, APRA's prudential standards and the SOCI Act, and through guidance such as the Guidance for AI Adoption and, for Commonwealth agencies, the DTA's AI policy.
Does APRA CPS 230 apply to AI systems?
In our view, yes. CPS 230 requires APRA-regulated banks, insurers and superannuation trustees to manage operational risk and material service providers, and APRA describes its prudential framework as technology agnostic. APRA's April 2026 letter to industry expects human involvement in high-risk decisions and controls over agentic workflows. Both are linked in the regulators table above.
How do the Privacy Act ADM rules affect AI systems?
From 10 December 2026, an entity's privacy policy must describe the kinds of personal information used and the kinds of decisions made where a computer program makes, or does something substantially and directly related to making, a decision that could significantly affect someone's rights or interests. This can apply where a human remains in the loop, depending on how much the human relies on the system's output. It is a disclosure requirement: it does not ban automated decisions or require human review.
Is SOCI relevant if we're not a critical infrastructure operator ourselves?
It depends. SOCI regulates responsible entities for critical infrastructure assets, not their suppliers directly. But those entities must manage supply-chain risk in their CIRMP, and under the Enhanced CIRMP Rules must assess suppliers for foreign ownership, control or influence. That usually flows through to suppliers in contract terms. If you have no relationship with a critical infrastructure entity, SOCI does not apply to you.
What do the ISM's AI controls require in practice?
The June 2026 ISM added controls that treat AI as a risk to contain, including human approval for risky actions (ISM-2113, strengthened in September 2026 to cover sensitive or high-impact actions) and behavioural baselining (ISM-2114), and controls for using AI in threat detection, vulnerability assessment and software security testing. The September 2026 release added controls for agentic AI, including agent registers, least privilege, task-scoped authorisation and central logging of tool calls. These sit inside existing IRAP assessment processes, not a separate AI audit.
Can AI compliance run onshore in Australia?
Yes. HCF Certified Strategic data-centre operators, sovereign cloud providers and the hyperscalers' certified Australian regions all support onshore deployments. Physical hosting alone does not control an AI system's behaviour; that needs a runtime enforcement layer, such as the Solcis Policy Engine, that evaluates each action, with each decision recorded in Solcis Compliance Studio.
What's the difference between HCF certification and an IRAP assessment?
HCF certification, administered by Home Affairs, certifies hosting facilities, enclaves or cloud services on ownership, control and supply-chain grounds. IRAP is an ASD-endorsed assessment in which a registered assessor evaluates a specific system and its shared-responsibility boundaries against ISM controls. A provider can hold both, as several in the table above do.
***
This page is general information about how Solcis supports work against Australian instruments. It is not legal or regulatory advice. Confirm your obligations with a qualified professional and the primary source. Last reviewed: 23 September 2026.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.solcis.ai/references/ai-regulatory-landscape/asia-and-the-pacific/ai-compliance-in-australia.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.