From 10 December 2026, organisations covered by the Privacy Act must describe in their privacy policy the kinds of decisions made, or substantially assisted, by computer programs, including AI, where those decisions could reasonably be expected to significantly affect people. If your business is covered, you have under two months to be ready. The rule binds APP entities, and most businesses with annual turnover of $3m or less are not APP entities, but there are exceptions, so check your own status. This post is general information, not legal advice.
What the new rule requires
The obligation sits in Australian Privacy Principles (APPs) 1.7 to 1.9, introduced by the Privacy and Other Legislation Amendment Act 2024. The OAIC’s APP 1 Guidelines and fact sheet confirm it commences on 10 December 2026.
It applies where you have arranged for a computer program to make a decision, or do something substantially and directly related to making a decision, using personal information, and the decision could reasonably be expected to significantly affect a person’s rights or interests. In that case your privacy policy must describe:
- The kinds of personal information used in the operation of those computer programs, including AI.
- The kinds of such decisions made solely by the operation of those programs.
- The kinds of such decisions where something substantially and directly related to making the decision is done by those programs.
The OAIC fact sheet says “significantly” means the impact must be more than trivial.
This is a disclosure rule. It does not require you to stop using automated tools, and it does not set a standard for how accurate or fair they must be.
Transparency, not a right to contest
The new obligation is about telling people. Allens reports that it does not create a right to contest decisions or request information. The December 2026 change is a transparency duty only.
Which decisions count
The rule applies to decisions made after commencement, even where the personal information was collected earlier. So data you hold today will be caught if it is used in a covered decision after 10 December 2026.
Think about decisions that could significantly affect someone’s rights or interests. Examples a business might consider include whether to accept an application, how to price or approve a service, or whether to shortlist a job candidate. The OAIC fact sheet includes worked examples on recruitment software and differential pricing. These are illustrations, not a complete list, so check the OAIC guidance for what counts.
Who it covers
The obligation sits in the APPs, which bind APP entities. The OAIC says most small businesses with annual turnover of $3m or less are not covered by the Privacy Act. The OAIC’s APP 1.7 to 1.9 materials do not mention a separate small business rule, and we found no OAIC statement that the new obligation reaches small businesses outside the Act.
The exemption has exceptions. The OAIC lists small businesses that are still covered, including health service providers, businesses that trade in personal information, Commonwealth contractors, credit reporting bodies, businesses related to a covered larger business and businesses that have opted in. If you are in one of those groups, or are unsure, the rule may apply to you. Check the OAIC small business guidance or ask a privacy lawyer.
The OAIC guidance
On 30 September 2026 the Office of the Australian Information Commissioner (OAIC) released updated APP 1 Guidelines, a fact sheet and a flowchart on APPs 1.7 to 1.9. Allens published its key takeaways from that guidance on 2 October 2026. Use the OAIC documents as your first reference and treat law firm summaries as secondary.
Why start before December
The inventory is the slow part. Most businesses do not have a single list of the tools that touch customer or applicant data. Software suppliers also add AI features to existing products, so a tool you bought years ago may now assist decisions without anyone deciding that it should.
Starting early gives you time to ask suppliers questions, fix gaps and get your wording reviewed. It also means your policy matches what you actually do, not what you hope you do.
A practical checklist
1. Inventory your decisions
List every place where software or AI makes, or substantially assists, a decision about a person. Check your CRM, applicant screening, credit or payment checks, scoring tools and any AI features switched on inside your existing software.
2. Map the personal information
For each item, record what personal information goes in. Note the type of information, not just the system. This gives you the “kinds of personal information” the policy must describe.
3. Decide which decisions are covered
Mark which could significantly affect a person’s rights or interests, and whether the program decides alone or assists a human. Use the OAIC fact sheet and flowchart as your guide. Where unsure, note it and ask an adviser.
4. Update your privacy policy
Add plain-English wording that describes the kinds of information used and the kinds of decisions involved. Keep it specific. Vague wording will not help your customers or you.
5. Train your staff
Make sure the people who handle enquiries can explain, in simple terms, what the policy says and where software is involved. Staff should also know not to paste personal information into tools you have not reviewed.
6. Review your vendors
Ask each software supplier whether their product makes or assists decisions about people, and what personal information it uses. Keep their answers on file and update them when a product changes.
7. Set a review date
Diarise a check before 10 December 2026, and again each time you add a new tool.
Key takeaways
- The automated decision transparency obligation (APPs 1.7 to 1.9) commences on 10 December 2026.
- Your privacy policy must describe the kinds of personal information used and the kinds of decisions made by, or substantially and directly involving, computer programs.
- It is a transparency duty, with no right to contest.
- It applies to decisions made after commencement, even for data collected earlier.
- The obligation binds APP entities. Most businesses with turnover of $3m or less are not APP entities, but exceptions apply, so check your status.
- Start with an inventory. It is the step that takes the longest.
If you want help auditing where software and AI sit in your decisions and drafting plain-English policy wording, talk to us. This post is general information only. It is not legal advice and does not take your circumstances into account. Speak to a privacy lawyer or your adviser about your own situation.
Sources
- New resources on transparency for use of AI and automated decision-making, Office of the Australian Information Commissioner, 30 September 2026
- APP 1.7-1.9 Transparency Obligation Fact Sheet, Office of the Australian Information Commissioner, 2026
- APP Guidelines, Chapter 1: APP 1 Open and transparent management of personal information, Office of the Australian Information Commissioner, updated 2026
- Small business, Office of the Australian Information Commissioner, undated
- Automated decision-making transparency under the Privacy Act, Gilbert + Tobin, 19 August 2026
- Mandatory automated decision-making disclosure requirements are coming: key takeaways from the OAIC guidance, Allens, 2 October 2026