In Brief
From 10 December 2026, organisations covered by the Privacy Act must describe in their privacy policy the significant decisions about people that their software makes or shapes, and the personal information it uses. Credit scores, pricing rules and recruitment filters can be covered as well as AI, and so can software run by suppliers. The regulator's final guidance arrived on 30 September. Boards should ask management for a complete list of these decisions now.
What changes on 10 December
Take a hypothetical mid-sized lender. A customer applies for a loan, a supplier’s system returns a credit score, and a loan officer approves or declines. The officer has never seen how the score is worked out and follows it almost every time. From 10 December 2026, that lender’s privacy policy must say that software shapes its lending decisions, and what kinds of personal information it uses.
The rule applies to every organisation covered by the Privacy Act, which includes most businesses with annual turnover above $3 million, private health providers and most federal agencies. It reaches decisions that use a person’s information and could significantly affect them: whether they get a loan, a job interview, insurance or a benefit, and what they pay.
Before anyone drafts the disclosure, management needs a list of every decision your software makes or shapes about people, the system behind each one and the personal information it draws on. Building that list takes most of the time, and some of the systems may belong to suppliers, who can be slow to answer.
Which software is covered
The privacy regulator, the Office of the Australian Information Commissioner (OAIC), published its final guidance on 30 September. It reads “computer program” broadly, covering simple rule-based processes as well as machine learning and generative AI. A pricing rule written fifteen years ago and a new AI tool that summarises job applications can both be caught. The test is whether the software shapes a significant decision using personal information.
That breadth matters. About 12 per cent of Australian businesses with employees used AI in 2024-25, according to the Australian Bureau of Statistics. Any business that relies on credit scores, pricing rules or screening filters should test them against the same rule.
A human sign-off can still leave a decision in scope. The OAIC says software shapes a decision when its output is a key factor in it. That includes cases where the person deciding relies on the output or is significantly influenced by it. Our loan officer is relying on the score.
The same applies to suppliers. If your company arranged for a supplier’s software to make or shape the decision, the disclosure is yours, and the OAIC expects you to know what your suppliers’ systems do.
Three steps before 10 December
The new rule requires the policy to describe these decisions accurately from 10 December. These three steps are our recommendation for getting there with evidence, and the dates leave six days to publish. The first date is 6 November, so the list needs to be commissioned now.
By 6 November: build the list. Start from the decisions that matter to people. Common candidates include credit approvals, insurance pricing and claims, eligibility for a benefit or service, recruitment screening, fraud holds and prices that differ by customer. Include recruitment tools: the employee records exemption does not cover job applicants you turn down, so these can be in scope. For each decision, record the system, the personal information it uses, and whether a person can override it. Then check whether anyone actually does. Give each type of decision one executive owner, and write down what you left out and why.
By 20 November: test the draft against the list. Ask general counsel to match every statement about automated decisions in the draft policy to an entry on the list. When a supplier cannot say what personal information its score uses, name an executive to get the answer and tell the board. If the list turns up a decision you would not want to defend in public, the board needs to hear about it while there is still time to change it.
By 4 December: board sign-off. The board risk committee checks the draft against the evidence and the OAIC’s guidance. Every open question should have a named owner and a due date. This step gives directors confidence that what the company publishes is true.
Our recommended timetable before 10 December 2026
| Action | Owner | Timeline | Priority |
|---|---|---|---|
| List the decisions software makes or shapes about people; record the software and personal information behind each; name an owner; record anything left out and why | Chief risk officer | By 6 November 2026 | critical |
| Test each automated-decision statement in the draft policy against the list and supplier evidence; assign an owner to every open question | General counsel | By 20 November 2026 | high |
| Board sign-off on the draft, its evidence and the open questions, checked against the OAIC guidance; publish by 10 December | Board risk committee | By 4 December 2026 | high |
Compliance is the floor
The rule asks for a general description in the privacy policy. Individual notice, an explanation and a human review are left for each company to decide.
Australians expect those things. In the OAIC’s 2026 community attitudes survey, 81 per cent said a right to human review of an AI decision is essential, up from 73 per cent in 2023. One in four found it acceptable for AI to decide eligibility or risk, such as a loan approval. Full compliance can leave customers with no one to appeal to.
The fines run from about $364,000 for a deficient policy to $50 million or more for a serious interference with privacy, as set out below. A missing decision in the policy becomes more serious if the way personal information was handled behind it is itself found to interfere with privacy.
Robodebt shows how costly a harmful decision rule can become. From 2015 to 2019 the Commonwealth spread each person’s annual tax income evenly across the year and used the result to raise welfare debts. According to the Federal Court, it raised about $1.76 billion in debts against roughly 433,000 people. A tribunal had already rejected the method, yet the letters kept going out, and settlements have since reached $587 million. The Court described an automated system built on data matching and income averaging: a formula that kept running after it had been challenged.
Other laws, contracts and complaint schemes may already require some of this. Beyond those, whether to offer customers an explanation or a human review is a choice for the board. Our advice is to make that choice deliberately, decision by decision, at the 4 December meeting with the list on the table.
Before 4 December, ask: which decision on our list would we be uncomfortable explaining to the customer it affected?
The rules. Australian Privacy Principles 1.7 to 1.9, added by the Privacy and Other Legislation Amendment Act 2024, commence on 10 December 2026.
When it applies (APP 1.7). All three conditions must be met. The organisation has arranged for a computer program to make a decision, or to do something substantially and directly related to making one. The program uses the individual’s personal information. The decision could reasonably be expected to significantly affect the individual’s rights or interests.
What the policy must state (APP 1.8). The kinds of personal information used; the kinds of decisions made solely by programs; the kinds of decisions programs substantially and directly help make.
What counts as a decision (APP 1.9). Refusing or failing to decide counts. The effect may be beneficial or adverse.
Guidance. OAIC, Australian Privacy Principles Guidelines, Chapter 1, updated 30 September 2026, with a fact sheet and a decision flowchart.
Penalties (maximums, for a corporation). Section 13K, deficient policy: 1,000 penalty units, about $364,000 at $364 a unit from 1 July 2026. Section 13H, non-serious interference with privacy: 10,000 units, about $3.64 million. Section 13G, serious interference: the greater of $50 million, three times the benefit obtained, or, where the benefit cannot be determined, 30 per cent of adjusted turnover over the breach period (at least 12 months).
Questions for Leadership
Which decisions about customers, applicants or staff does our software make or shape, and who owns each one?
These systems often sit with different teams, so test whether anyone has the complete view.
How do we know the list is complete, and what did we leave out?
A policy becomes inaccurate through what it leaves out, so the exclusions deserve the closest look.
For each supplier system on the list, do we hold evidence of what personal information it uses?
If a supplier cannot document its inputs, the company will struggle to show its own disclosure is accurate.
Where will we offer an explanation or a human review beyond what the law requires?
Four in five Australians call human review essential, and offering it beyond the legal minimum is the board's choice.
If the list shows a decision we cannot justify, who has the authority to pause it?
A harmful decision found in November can be fixed before the policy goes out.
The Bottom Line
Treat the 10 December disclosure as a check on what your software actually does, and write the policy from what that check finds. List the decisions, name an owner for each, test the wording against the evidence, and have the board sign off by 4 December.
Frequently Asked Questions
Does the privacy policy have to name every system or model we use?
No. APP 1.8 asks for the kinds of personal information used and the kinds of decisions involved, so a policy can group them, for example by lending, pricing or recruitment decisions. The OAIC's guidance says the description must still be meaningful to a reasonable person, and it should make clear where more sensitive information, such as health or biometric data, is used. The detailed list of systems stays inside the company as evidence that the shorter public description is accurate.
What does a good disclosure look like?
The OAIC's guidance asks for plain language, grouping that a reader can follow, and enough detail for a person to understand how software is used in decisions about them. Its example is an organisation that says it uses fraud prevention technology which processes identity information, geolocation data, biometric information and IP addresses to permit, flag or deny access to an account. Commercial confidentiality is a narrow exception. It covers information whose release could harm the business or expose trade secrets, and the OAIC reads it tightly.
Is a fraud hold or an account suspension a significant decision?
It can be. The OAIC's test is whether the decision could considerably influence a person's circumstances, which means more than a trivial effect. Its guidance gives the example of a service suspending a customer's account. That may be a minor inconvenience for some customers and significant for one who relies on the service to get to medical appointments. A decision can also be significant where its results are materially different for a vulnerable group of people than for everyone else. Fraud holds and suspensions belong on the list for review.
What if a supplier will not say what its model uses?
Treat it as a problem to fix before the policy goes out. The OAIC expects organisations to identify, assess and keep oversight of third-party software both when they buy it and afterwards, and contracts should be clear about who exercises judgement in the decision. The disclosure obligation generally stays with the organisation using the personal information, even where a contract assigns work to the supplier. Where a supplier will not describe its inputs, management may need to use the contract, or rethink the product, before the policy is approved.
How does this relate to the proposed fair-and-reasonable test?
The exposure draft released on 31 August 2026 proposes that the collection, use and disclosure of personal information must be fair and reasonable in the circumstances, as well as lawful. It is still a proposal, and its final form may differ. If it passes, it would reach the personal information behind an automated decision. The decision list and supplier evidence prepared for December would then help a company assess whether that use of information is fair and reasonable.