Topics: Custom software & SaaS, AI automation
Want this done for your business? Get a fixed quote or book a free 30-minute call.
Quick answer: From 10 December 2026, organisations covered by the Privacy Act must explain in their privacy policy when a computer program uses personal information to make, or substantially and directly help make, decisions that could significantly affect someone's rights or interests. It's a transparency duty, not a ban, and businesses with annual turnover of A$3 million or less are generally exempt unless an exception applies, such as providing a health service.
Several of the 2024 Privacy Act amendments took effect within months. One was given a two-year runway, and that runway ends on 10 December 2026. It catches more than AI: a rules-based approval engine built a decade ago is just as much a "computer program" as a new machine-learning model. This explainer covers what's required, who it applies to, how to audit your systems and what to ask vendors. It's general information, not legal advice.
What changes on 10 December 2026?
New Australian Privacy Principles 1.7 to 1.9 start to apply, adding automated decisions to what a privacy policy must cover. They were inserted by the Privacy and Other Legislation Amendment Act 2024.
Per the OAIC's guidance, the obligation is triggered when three things are true:
- You've arranged for a computer program to make a decision, or to do something substantially and directly related to making one.
- The decision could reasonably be expected to significantly affect an individual's rights or interests.
- Personal information about that individual is used in the program's operation.
If all three apply, your privacy policy must describe the kinds of personal information used and the kinds of decisions involved. The OAIC has published guidance and a flowchart for working through the test; read them alongside this article.
Which automated decisions are covered?
Decisions with real consequences for a person, whether made by AI or by fixed rules. The amendments give examples of significant effects, including decisions about benefits under a law, decisions affecting rights under a contract or arrangement, and decisions affecting access to a significant service or support.
| Likely to be covered | Probably not covered |
|---|---|
| Automated credit or trade-account approvals | Spam filtering of your own inbox |
| Tenant or customer screening that rejects applicants | "You might also like" product suggestions |
| CV screening that filters out candidates | AI drafting a marketing email |
| Fraud flags that block an account or order | Route planning for deliveries |
| Pricing or premiums set from an individual's data | A chatbot answering general FAQs |
| Rostering that allocates shifts and hours | Summarising internal meeting notes |
The boundary calls are the hard part. A chatbot answering FAQs is unlikely to be covered; the same chatbot deciding who qualifies for a refund might be. Judge each use on what the output does to the person, not on the technology behind it.
Does this apply to small businesses?
Only if your business is an APP entity under the Privacy Act. Most businesses with annual turnover of A$3 million or less are small business operators and exempt from the Australian Privacy Principles, including this one.
Exceptions bring some small businesses back in, including:
- Health service providers, such as clinics, allied health and pharmacies
- Businesses that trade in personal information
- Contracted service providers to the Australian Government
- Businesses related to a larger company that is covered
- Businesses that have opted in
Even when you're exempt, enterprise clients increasingly write privacy obligations into contracts, so a supplier may be asked for this disclosure anyway. For how the wider Act shapes the systems you build, see our guide to Australia's Privacy Act and software.
What must your privacy policy say?
The kinds of personal information your programs use, and the kinds of decisions they make or substantially help make. You don't have to publish algorithms or code; the obligation is to describe kinds and categories in plain language.
APP 1.8 asks for three things:
- The kinds of personal information used in the operation of those programs
- The kinds of decisions made solely by the operation of those programs
- The kinds of decisions where the program does something substantially and directly related to making the decision
A short, plain example for a wholesaler:
We use automated systems when assessing applications for trade credit accounts. They use the details you give us, such as your business name, ABN, trading history and requested limit, along with credit information from a credit reporting body, to recommend whether to approve an account and at what limit. A member of our accounts team reviews every recommendation before a decision is made.
Notice the last sentence. Human review is worth describing, but it doesn't take the decision outside the rule if the program's recommendation substantially shapes the outcome.
How do you audit the AI and rules-based tools you already use?
List every system that decides or recommends something about a person, then test each against the three conditions. Many relevant features sit inside software you subscribe to rather than build.
Start with these sources:
- Your HR, recruitment and rostering platforms
- Your CRM, quoting and pricing tools
- Payment, fraud and e-commerce platforms
- Credit, collections and debtor tools
- Any custom software, spreadsheets with scoring formulas or AI workflows your team set up
Record each one in a simple register:
| System | What it decides or recommends | Personal information used | Solely automated or assisting? | Human review point | Significant effect? | Disclose? |
|---|---|---|---|---|---|---|
| Example: recruitment platform | Ranks applicants and hides low scores | CV, answers to screening questions | Assisting | Recruiter reviews the top 20 only | Yes | Yes |
That example shows a common trap: a person reviews the shortlist, but the program decided who never reached it. For a sense of where automation usually sits in a smaller business, see our overview of AI automation for small and mid-size businesses.
What should you ask your software or AI vendor?
Enough to describe the decision honestly in your privacy policy, and to know where your data goes.
- Which features make or recommend decisions about individuals?
- What personal information does each feature use, including data from third parties?
- Can we switch features off or require human approval?
- Is our data used to train models shared with other customers?
- Where is data stored and processed, and who can access it?
- Can you explain an individual decision if a customer asks?
- What logs do you keep, and for how long?
Our list of data privacy questions to ask about AI goes further on storage, retention and security.
What might come next in Australian AI regulation?
More privacy reform is likely, while AI-specific rules have so far relied mainly on existing laws and voluntary guidance. In its response to the Privacy Act Review, the Government agreed in principle to further proposals, including a right for individuals to request meaningful information about how substantially automated decisions are made, and it has signalled consultation on the small business exemption.
On AI generally, the National AI Centre's Guidance for AI Adoption, released in October 2025, sets out practices for responsible use. Businesses that already document their automated decisions, human review points and vendor answers will find any next step far easier.
Frequently asked questions
Does the automated decision-making rule apply to my business?
It applies if you're an APP entity under the Privacy Act and use computer programs, with personal information, to make or substantially help make decisions that significantly affect individuals. Most businesses under A$3 million turnover are exempt unless an exception, such as being a health service provider, applies.
Do I need to update my privacy policy by 10 December 2026?
If you're covered and you use automated decisions of this kind, yes; the obligation applies from that date. Complete your audit first, so the policy describes what your systems actually do.
Does staff use of ChatGPT count as automated decision-making?
Using it to draft emails or summarise documents generally doesn't. It could if staff use it to score, rank or assess people, such as filtering job applicants, and that output substantially shapes the decision. Your AI policy should say which uses are allowed.
Is an AI recommendation that a person reviews still covered?
It can be. The rule covers programs that do something substantially and directly related to making a decision, so a recommendation people usually follow is likely to count. Describe the human review in your policy, but don't treat it as an exemption.
What happens if we do not comply?
The OAIC can investigate complaints and take enforcement action. The 2024 amendments also gave it new powers, including infringement notices for some privacy policy failures and a broader civil penalty regime, so treat the disclosure as enforceable from day one.
Not sure what your systems decide?
We build and audit business software and AI workflows, including AI and software for Australian businesses that need to explain their decisions. If you'd like a register of your automated decisions and plain-English wording for your privacy policy, ask us to map your automated decisions. For new systems, our custom software and apps team builds review points and decision logs in from the start.