From 10 December 2026, organisations covered by the Privacy Act must explain in their privacy policy when a computer program makes, or substantially helps to make, decisions that could significantly affect people. This is the first Australian legal obligation aimed squarely at automated and AI-assisted decisions, and it catches far more than headline AI: rules engines, scoring tools, recruitment software and pricing logic can all be in scope. This guide explains the test, who it applies to, what to write, and a six-week plan for South Australian businesses, not-for-profits and suppliers to councils and government.
This is general information, not legal advice. It reflects the Office of the Australian Information Commissioner (OAIC) guidance published in September 2026. Confirm your own position with the OAIC resources linked below and your legal adviser.
What changes on 10 December 2026
The Privacy and Other Legislation Amendment Act 2024 added APP 1.7 to 1.9 to Australian Privacy Principle 1. Under APP 1.7, your privacy policy must include extra information if all three of these are true:
- you have arranged for a computer program to make a decision, or to do something substantially and directly related to making a decision;
- the decision could reasonably be expected to significantly affect an individual’s rights or interests; and
- personal information about that individual is used in the program’s operation.
Under APP 1.8, the policy must then describe:
- the kinds of personal information used by those programs;
- the kinds of decisions made solely by a program; and
- the kinds of decisions a program substantially and directly helps make, where a person still takes the final step.
The OAIC published a fact sheet, a flowchart, a supplementary fact sheet for government agencies and updated APP 1 guidelines on 30 September 2026. Its advice where you are unsure is simple: take a cautious approach and disclose.
Does it apply to you?
- Businesses and not-for-profits with annual turnover over $3 million are APP entities and are covered.
- Smaller organisations are generally exempt, but not if they are, for example, a health service provider, trade in personal information, provide services under a Commonwealth contract, or are a reporting entity under anti-money laundering law. The small business exemption still applies as at October 2026; the Privacy Act exposure draft released in August 2026 does not remove it.
- Commonwealth agencies are covered and should also read the OAIC’s supplementary fact sheet for agencies.
- SA Government agencies and councils are generally not APP entities. They work under the SA Information Privacy Principles Instruction and State records and FOI law. Even so, explaining automated decisions to residents is good practice, and SA Government guidance on generative AI already expects agencies to manage AI risk. Their suppliers may be APP entities in their own right.
The three-part test in plain English
1. A computer program informs or makes a decision
The OAIC reads “computer program” broadly: pre-programmed rules, machine learning, generative AI and chatbots, and ordinary software and apps. You have “arranged for” a program whether you built it, bought it, configured off-the-shelf software or simply rely on its advisory output.
2. It is substantially and directly related to the decision
A program counts if it advises the outcome, determines it, or otherwise influences it. Human review does not automatically take you out of scope. The OAIC says machine learning or generative AI outputs used in significant decisions will generally be in scope unless they are subject to extensive human oversight and control.
3. The decision significantly affects someone
“Significantly” means more than trivial, with potential to considerably influence a person’s circumstances or outcomes. Benefits count as well as disadvantages, and decisions can weigh more heavily on people experiencing vulnerability.
Common uses and how they usually land
Use this table as a starting point for your own assessment, not a ruling. Scroll sideways on small screens.
| Use | Likely position | Why |
|---|---|---|
| Recruitment software that screens or ranks applicants | Likely in scope | Named in the OAIC’s examples; affects access to work |
| Credit, payment terms or account approval checks | Likely in scope | Approving or refusing credit is a listed example |
| Insurance eligibility or pricing | Likely in scope | Listed example; affects cost and access |
| Personalised or differential pricing online | Possibly in scope | Listed where significant goods or services are involved |
| AI reports used to rank staff performance, promotions or bonuses | Likely in scope | Listed example; affects pay and career |
| Eligibility checks for grants, scholarships, housing or services | Likely in scope | Listed examples for financial support and eligibility |
| Fraud or risk flags that block an account or payment | Often in scope | Refusing a service can significantly affect someone |
| Website chatbot answering general questions | Usually out of scope | Unless it decides eligibility, priority or outcomes for a person |
| AI meeting notes, drafting and spell check | Usually out of scope | No decision about an individual, but record your reasoning |
Software you buy: the duty stays with you
The OAIC expects the obligation to sit with the organisation using personal information to make the decision, not the software vendor. Vendors are expected to give you clear, high-level information about how their product can be used to make decisions. Ask your HR, finance, CRM, booking and payments vendors three questions:
- Which features score, rank, approve, refuse, price or prioritise people?
- What personal information do those features use, including any sensitive information?
- Are those features switched on in our configuration, and can a person override them?
Our guide to service provider due diligence for cloud, SaaS and AI covers the wider supplier questions.
What to write in your privacy policy
Write for a reasonable reader, not an engineer. The OAIC allows you to group decisions and kinds of information, provided the result is meaningful, and expects sensitive information such as health or biometric data to be called out clearly. Commercially sensitive information and trade secrets are excluded, but the exclusion does not cover information that would merely be embarrassing.
A short section headed “Automated decisions” could follow this outline, adapted to your facts and reviewed by your adviser:
- What we use: “We use software, including [rules-based tools / machine learning / AI], to help make some decisions about you.”
- Decisions made solely by software: for example, “automatic approval of [account type] where [criteria] are met”.
- Decisions software helps us make: for example, “shortlisting job applicants, which a staff member then reviews”.
- Information used: for example, contact details, application answers, payment history, and any sensitive information, named plainly.
- How to ask questions or seek review: a contact route for more information or a human review.
A six-week plan to 10 December
- Week 1: inventory. List every system that scores, ranks, filters, approves, refuses, prices or prioritises people, including features inside software you already license. An AI register is the natural home.
- Week 2: apply the test. Run each item through the three limbs and the OAIC flowchart. Record in or out and why.
- Week 3: ask vendors. Send the three questions above and note the answers against each system.
- Week 4: draft. Write the automated decisions section and check your collection notices and any chatbot or form disclosures say the same thing (our AI disclosure guide has chatbot wording).
- Week 5: review and approve. Legal review, sign-off by the accountable executive, and a short briefing for staff who answer customer questions.
- Week 6: publish and diarise. Publish before 10 December, keep the assessment as evidence, and set a review whenever a system or vendor feature changes.
Beyond the minimum
The privacy policy is a floor. Organisations that also offer a clear way to question an automated outcome, test their tools for unfair results and keep decision logs will find tender questions, insurer questionnaires and complaints far easier to answer. See model risk management for scoring and automated decisioning, the Voluntary AI Safety Standard guardrails, and our AI laws tracker for how this fits with the EU AI Act and other overseas rules. If a decision system ever leaks or mishandles data, the notifiable data breaches guide applies too.
How EITSAA helps
We help SA organisations find the automated decisions hiding in their systems, apply the OAIC test, gather vendor information and prepare plain-English privacy policy wording for your legal review, then keep the evidence in a working AI register. We work alongside your lawyers rather than replacing them. Explore AI Governance & Assurance, book a short automated decisions review or call 0402 401 584.
Sources
- OAIC: new resources on transparency for AI and automated decision-making
- OAIC: APP 1.7–1.9 transparency obligation fact sheet
- OAIC: APP Guidelines, Chapter 1
- OAIC: small business and the Privacy Act
As at October 2026. Last reviewed 25 October 2026. Not legal advice.