Automated Decision-Making Transparency from 10 December 2026

When does the new rule apply?

The new obligation applies when all three elements are present:

• an APP entity has arranged for a computer program to make a decision, or do something substantially and directly related to making a decision
• the decision could reasonably be expected to significantly affect an individual's rights or interests
• personal information about that individual is used in the program's operation for that decision or related step
  
  

The wording reaches beyond decisions made entirely by software. A program may be covered when it performs something substantially and directly related to the decision, even if a person formally makes the final call.

The amendments apply to relevant decisions made from 10 December 2026. They can apply even if the arrangement, information or system existed before that date.

It is not only about artificial intelligence

The legislation uses the term “computer program”, not “artificial intelligence”. A rules engine, scoring model, matching tool or automated workflow may be relevant even if it does not use machine learning or generative AI.

That is why an inventory should start with decisions, not product labels. Searching only for tools marketed as AI can miss older automated systems that perform more consequential work.

What counts as a significant decision?

The decision must be one that could reasonably be expected to significantly affect rights or interests. The legislation gives examples including decisions about a benefit under law, rights under a contract or arrangement, and access to a significant service or support.

Making a decision includes refusing or failing to make one. The effect can be adverse or beneficial. The question is the significance of the potential effect, not whether the organisation believes the outcome helps the person.

In a business setting, potentially relevant uses may include eligibility, credit, insurance, access to essential services or decisions that materially affect a contractual position. Workplace systems may also need careful assessment where they influence employment opportunities or significant worker interests.

What must the privacy policy say?

Where the test is met, the APP Privacy Policy must contain information about:

• the kinds of personal information used in the operation of the computer programs
• the kinds of decisions made solely by the operation of those programs
• the kinds of decisions for which a program does something substantially and directly related to making the decision
  
  

This is meaningful disclosure, but it is not the same as publishing source code, model weights or every technical detail. APP entities still need a clearly expressed and up-to-date policy that ordinary readers can understand.

Other privacy duties continue to apply. Updating the policy does not by itself resolve whether personal information was collected lawfully, used for a permitted purpose, kept accurate, secured appropriately or disclosed overseas in compliance with the Privacy Act.

Does every business have to comply?

No. The new requirement applies to APP entities. Many private-sector organisations are covered by the Privacy Act, but some small businesses may be exempt unless an exception applies. Australian Government agencies are also APP entities.

Businesses should not assume they are outside the Act based only on size. Health service providers, businesses trading in personal information, contracted service providers and other categories can be covered. Organisations should check their own position and seek advice where necessary.

A practical workplace example

A large employer uses a computer program to analyse application data and generate a shortlist score. A recruiter reviews the score before choosing candidates for interview.

The employer would need to assess whether the scoring step is substantially and directly related to a decision, whether the decision could significantly affect an applicant's rights or interests, and whether personal information is used. Calling the recruiter the final decision-maker does not automatically place the system outside the test.

What businesses should do now

1. Inventory decisions: list computer programs that approve, decline, rank, score, recommend, match or prioritise people.
   
   
2. Map personal information: record the information used, inferred or created during each workflow.
   
   
3. Assess significance: identify potential effects on rights, contracts, benefits, services, support and other important interests.
   
   
4. Check the human role: document whether the program decides, recommends or performs a step substantially and directly related to the decision.
   
   
5. Review suppliers: obtain enough information from vendors to describe the use accurately and manage privacy risks.
   
   
6. Update the policy: draft clear descriptions of information types and decision types before commencement.
   
   
7. Build review pathways: tell staff how people can ask questions, correct information and seek meaningful human review.

As at 5 August 2026, organisations should monitor the OAIC's developing detailed guidance and test their draft disclosures against the final material when it is published.

For related guidance, see privacy information, AI, privacy and worker data, human oversight of AI, AI use registers and the AI governance checklist.