Your software already makes decisions the Privacy Act now covers
From 10 December 2026, Australian businesses over AU $3 million turnover must say in their privacy policy where computers make decisions about people. Most have not worked out where that happens.
Manish Kumar, founder ·
On 10 December 2026, a change to the Privacy Act takes effect that almost every Australian business over AU $3 million turnover will be caught by, and almost none have mapped. If a computer program makes, or materially helps make, a decision that significantly affects someone, your privacy policy has to say so.
This is not the AI regulation people have been waiting for. There is no licence to apply for and no register to lodge. It is a disclosure duty, and it is enforceable: the Office of the Australian Information Commissioner can issue compliance notices and infringement notices for a privacy policy that does not meet it.
The hard part is not writing the paragraph. It is knowing which of your systems the paragraph has to describe.
Three tests, and all three have to be true
The obligation triggers only when every one of these holds.
- 1 of 3A computer program makes the decision, or does something substantially and directly related to making itNot just any software in the process. "Substantially" means the thing the program produces is a key factor in the human decision. "Directly" means it connects straight to that decision.
- 2 of 3The decision could reasonably be expected to significantly affect the personThe OAIC has signalled it reads this broadly. Its issues paper points to access to financial assistance, healthcare, financial products, telecommunications, essential banking and credit, and essential utilities.
- 3 of 3Personal information about that person is used to get thereThe program has to be operating on personal information, either to make the decision or to do the thing that feeds it.
The middle test is where most businesses assume they are safe and are not. A human signing off does not take you out of scope. The OAIC's own worked example is an aged-care insurer where staff make the final eligibility call, but do it on AI-generated summaries and recommendations. The people decide; the program shaped the decision; the obligation applies.
The line the OAIC drew with a spreadsheet
The clearest example in the issues paper uses Microsoft Excel, and it is worth repeating because it settles a lot of arguments.
Substantially related, so in scope
- Excel generates a score about a person, and that score is a key factor in the decision.
- A pre-programmed tool scores and triages calls to a domestic violence hotline, materially shaping who is prioritised.
- An assistant drafts a recommendation that the decision-maker relies on.
Directly related only, so out of scope
- Excel adds numbers to produce a sum that someone then interprets.
- A tool formats or stores information without shaping the outcome.
- Software that schedules the meeting where a human decides.
Same spreadsheet. The question is never which product you use. It is whether what the program produced was a key factor in the outcome for that person.
Where it actually hides in an ordinary business
In a firm of 10 to 200 people, automated decisions are rarely in an obvious "AI system". They are in the tools that quietly rank, score, filter or price.
Recruitment shortlisting that orders or screens applicants. Credit and payment-terms checks. Insurance and eligibility triage. Pricing or discount engines that treat customers differently. Support triage that decides who waits and who does not. Rostering that allocates shifts. Anything where a model, a rule set or a score determines who gets what.
If you adopted an AI assistant in the last two years and pointed it at a process that touches customers or staff, the honest answer is that you do not currently know whether it crossed this line. That is the work.
What you actually have to publish
Two things, in the privacy policy itself:
- 01The kinds of personal information usedCategories, not a data dictionary. What sorts of information about a person feed the automated part.
- 02The kinds of decisions madeCategories again. What sorts of decisions are made solely, or substantially and directly, by the program.
Note what is not required. You do not have to publish the model, the logic, the weightings or the vendor. This is a transparency duty about kinds and categories, not an explainability regime. Firms that panic about disclosing commercially sensitive detail have usually misread the scope.
The part everyone gets backwards
The disclosure is the easy half. Keeping it true is the hard half.
A privacy policy written in November and never revisited becomes wrong the first time someone switches on a new feature in a tool you already pay for. Vendors ship automated scoring into existing products constantly, and nobody tells the privacy officer. What keeps the statement accurate is a register: every automated or AI-assisted decision, with the data it uses, the person who owns it, the human review step, and a review date.
That register is also the thing that makes the disclosure cheap to maintain. Write it once, review it quarterly, and the privacy policy update becomes a five-minute job instead of an annual scramble.
What to do between now and December
The OAIC has said it intends to publish its guidance before commencement, and consultation on the issues paper has already signalled a broad reading. Waiting for the final document to start is a mistake, because the inventory work is the same either way and it is the part that takes weeks.
Walk each process where a decision lands on a person: sales, credit, hiring, service, rostering. For each one, ask the three tests in order and write down the answer with your reasoning. Where a test is met, record the data, the owner and the human review step. Then draft the two paragraphs and have your lawyer or privacy officer approve them.
Most firms of this size find between two and six processes in scope and are surprised by at least one of them. The value is not the paragraph. It is finding out what your software has quietly been deciding.
Sources
- OAIC, Consultation on guidance for transparency in automated decision making and the accompanying ADM issues paper
- Gilbert + Tobin, Automated decision-making transparency under the Privacy Act
- Bird & Bird, OAIC signals a broad reading ahead of December 2026
- White & Case, Australian privacy update: automated decision making transparency requirement
- Allens, What APP entities need to know about the APP 1 amendments
This is practical guidance, not legal advice. Have your lawyer or privacy officer approve the wording before you publish it.