Key takeaways
- From 10 December 2026, APP entities must describe certain automated decisions in their privacy policy.
- "Computer program" is read broadly: rule engines, spreadsheets, AI tools and chatbots can all count.
- A person checking the output does not automatically take you out of scope.
- The obligation sits with the business using the tool, not the software vendor.
Australian businesses using AI to help with decisions about people have a hard date coming. From 10 December 2026, new transparency requirements in Australian Privacy Principle 1, introduced by the Privacy and Other Legislation Amendment Act 2024, require privacy policies to explain where computer programs make or substantially inform decisions that could significantly affect individuals. The OAIC released final guidance on 30 September 2026. This is a plain-language summary for businesses, not legal advice.
The test: three conditions
The obligation applies where all three of these are true:
- You have arranged for a computer program to make a decision, or to do something substantially and directly related to making it.
- The decision could reasonably be expected to significantly affect an individual's rights or interests.
- Personal information about the individual is used in operating the program.
What the OAIC says each part means
"Computer program" is broad
The guidance covers rule-based tools, machine learning, everyday software including spreadsheets, and generative AI and chatbots. A long-standing scoring spreadsheet can be caught just as much as a new AI tool.
Human review does not automatically take you out
This is the point most likely to catch businesses using AI assistants. A program counts as substantially and directly related to a decision if its output is a key factor with a direct connection to the decision, whether it advises or decides. Factors include how much people rely on the output, how likely they are to override it, and whether it is advisory or determinative. If an AI tool ranks job applicants and a manager usually shortlists the top five, that is likely to be in scope.
"Significantly affect" covers a lot
The guidance points to rights and interests including those relating to health, housing, finance, employment and access to utilities and significant services. Decisions affecting contractual rights are included. Effects can be beneficial as well as adverse. Personalised pricing and targeted employment advertising can be in scope.
The responsibility is yours, not the vendor's
The obligation sits with the business that arranged for the program to be used. If you use a third-party tool that scores, ranks or recommends, you need enough information from the supplier to describe what it does.
What your privacy policy must say
- The kinds of personal information used in the operation of the relevant programs.
- The kinds of decisions made solely by those programs.
- The kinds of decisions where the programs do something substantially and directly related to making the decision.
The guidance does not demand technical detail, and you can describe categories rather than every sub-step. Separate processes with different purposes should preferably be described separately, and sensitive information such as health or biometric data should be called out clearly.
Where AI use in a typical business might be caught
| Use | Likely in scope? |
|---|---|
| AI drafting emails or documents for staff | Usually not, as no decision about an individual is being made |
| AI screening or ranking job applicants | Likely |
| AI assessing claims, applications or eligibility | Likely |
| AI setting individual prices or credit terms | Likely |
| AI prioritising which customers get service first | Possibly, depending on the effect |
| AI summarising a client file for an adviser who then decides | Possibly, depending on reliance |
Are you an APP entity?
The rules apply to APP entities. Under the current law, most businesses with annual turnover of 3 million AUD or less are exempt, but the exemption has important exceptions, including health service providers, businesses that trade in personal information, and contracted service providers to the Commonwealth. Reform of the small business exemption has been under discussion for some time, so check your status rather than assuming.
A five step plan before 10 December
- List every program that touches decisions about people. Include spreadsheets, CRM scoring, recruitment tools, pricing tools and AI assistants used in assessments.
- Test each against the three conditions. Record your reasoning, especially for borderline cases.
- Ask suppliers what their tools do. What personal information they use and what output they produce.
- Update your privacy policy. Describe the kinds of information and decisions in plain language.
- Add a rule to your AI policy. No new use of AI in decisions about people without checking it against this test first. Our AI agent policy template includes this.
Get advice on borderline cases. This summary is based on the OAIC's guidance and published legal commentary as of October 2026. If you rely on AI in decisions about employment, credit, insurance, health or housing, take legal advice specific to your business.
For the wider question of data in AI tools, see AI and your business data and handling client data in AI tools.
Frequently asked questions
What changes on 10 December 2026?
Australian Privacy Principle 1 gains new transparency requirements. If an APP entity uses a computer program to make, or do something substantially and directly related to making, a decision that could significantly affect an individual's rights or interests, using their personal information, its privacy policy must describe the kinds of personal information used and the kinds of decisions involved.
Does the automated decision rule apply to small businesses?
It applies to APP entities. Most businesses with annual turnover of 3 million AUD or less are not APP entities under the current small business exemption, but there are important exceptions, including health service providers and businesses that trade in personal information. Check your status before assuming you are exempt.
If a person reviews the AI output, are we still covered?
Probably. The OAIC's guidance says a program is substantially and directly related to a decision when its output is a key factor with a direct connection to the decision, whether it is advisory or determinative. In most cases where the output is a material input, disclosure is likely to be required even with human oversight.
Do we have to notify each individual?
No. The obligation is about what your privacy policy says. It does not require direct notification to each person, and it does not by itself create a right to contest the decision. Other laws and industry codes may still apply.
Get a straight answer for your business
The Clarity Package gives you a written business case and a detailed implementation plan for 500 USD. The Implementation Package does the whole build, live in 30 days, for a fixed 5,000 USD.