The short version. From 10 December 2026, any organisation covered by the Australian Privacy Act that uses a computer program to make, or substantially and directly help make, decisions that could significantly affect people must say so in its privacy policy. The policy has to list the kinds of personal information used and the kinds of decisions involved. Human review doesn’t take a tool out of scope, and neither does buying it from a vendor.
Most mid-sized companies I talk to think this one is about AI, and that they don’t really “do” AI yet. Both halves of that are wrong. The rule covers any computer program, from a machine learning model down to a rules engine or a spreadsheet macro. And almost every business of a few hundred people already has a handful of these making decisions about customers or staff. Nobody wrote them down because nobody had to. Now you do.
The test: three conditions
The new APP 1.7 applies when all three of these are true:
- You arranged for a computer program to make a decision, or to do something substantially and directly related to making it.
- The decision could reasonably be expected to significantly affect an individual’s rights or interests. The effect can be good or bad, and refusing or failing to decide counts too.
- Personal information about that person is used in running the program for that decision.
When all three hold, APP 1.8 says your privacy policy must describe the kinds of personal information used, the kinds of decisions made solely by a program, and the kinds of decisions where a program does something substantially and directly related to the decision.
Three things that will catch people out
“Computer program” is broad. The OAIC’s guidance covers rules-based tools, machine learning, generative AI and chatbots, and simple long-standing tools. If a spreadsheet works out who gets credit terms, it’s in.
A human in the loop isn’t a get-out. If the program’s output is a key factor with a direct connection to the person’s decision, it’s in scope. The OAIC looks at how much people rely on the output, how often they override it, and whether it’s advisory or effectively decides the outcome. A manager who rubber-stamps a score 98% of the time isn’t making the decision. The score is.
Your vendor’s feature is your obligation. The duty sits with whoever arranged for the program to be used. The fraud score built into your payment gateway, the candidate ranking in your applicant tracking system, the “smart” triage in your helpdesk: they’re yours to disclose.
Where mid-sized companies find automated decisions they didn’t know they had
| Where it hides | The decision | Likely in scope? |
|---|---|---|
| ERP or finance system | Credit limits, payment terms, account holds | Yes, if it affects a person (sole traders, consumers) |
| Payment gateway, e-commerce platform | Fraud scoring, order cancellation, refund eligibility | Usually |
| Applicant tracking system | CV screening, candidate ranking, targeted job ads | Yes. Employment is named in the guidance |
| HR, rostering and performance tools | Shift allocation, performance flags | Often |
| Pricing engine | Personalised or dynamic pricing | Yes, where pricing differs by person |
| Customer service chatbot | Refunds, complaint outcomes, escalation | Yes, if it decides rather than routes |
| Marketing automation | Generic product recommendations | Usually not, unless it affects access to significant goods, services or jobs |
An eight-week plan to 10 December
- Weeks 1–2: inventory. List every system that scores, ranks, filters, approves or rejects people. Ask finance, HR, sales and customer service, not just IT. Check the feature lists of your SaaS tools, because that’s where most of it hides. If you’re starting an AI register for ISO/IEC 42001 or Australia’s AI6 guidance, this is its first version.
- Weeks 3–4: test each one against the three conditions. Record why things are in or out. The OAIC’s guidance leans towards treating borderline cases as in scope, so if you’re arguing with yourself, it’s in.
- Weeks 5–6: write the disclosure by kind of decision, not by system. Keep processes with different data or outcomes separate, and call out sensitive information like health or biometrics. Get it reviewed by your lawyer.
- Weeks 7–8: make it stay true. Add a question to procurement and change management: “Does this make or materially inform decisions about people?” Otherwise the policy is accurate on 10 December and wrong by February.
What the wording can look like
This is an illustration of the level of detail, not legal advice. Your lawyer should settle the final wording.
Automated decisions. We use computer programs to help make some decisions that may significantly affect you. Our payment system uses your order details, payment information and device information to assess the risk of fraud. Orders it rates as high risk may be cancelled automatically. When you apply for a job with us, our recruitment software uses the information in your application to rank candidates, and our recruiters use that ranking to decide who to interview.
New Zealand
The NZ Privacy Act 2020 has no equivalent automated-decision disclosure rule. But IPP 3A has been in force since 1 May 2026. If you collect personal information about someone from a third party, you now have to take reasonable steps to tell them. That catches a lot of AI data enrichment, lead scoring and background-check tooling, so trans-Tasman businesses should do one inventory and cover both laws.
Why this is really a governance problem
The privacy policy is the easy part. The hard part is that most companies can’t list the automated decisions they make about people, and you can’t govern what you can’t list. Australia’s AI6 guidance asks you to share essential information about your AI use. ISO/IEC 42001 asks for an AI inventory and impact assessments. This deadline is the cheapest excuse you’ll get to build that inventory once and use it three times.
Ten weeks is plenty if you start with the inventory this week. It’s nowhere near enough if you start with the privacy policy.
Questions people ask
When do the automated decision-making rules start?
10 December 2026. They were added to Australian Privacy Principle 1 (APP 1.7 to 1.9) by the Privacy and Other Legislation Amendment Act 2024, and the OAIC published its final guidance on 30 September 2026.
Does having a human review the decision take it out of scope?
No. The OAIC’s position is that if a program’s output is a key factor with a direct connection to the human’s decision, it is substantially and directly related to that decision and must be disclosed, even with a person in the loop.
Do we have to explain how the algorithm works?
No. The policy must describe the kinds of personal information used and the kinds of decisions, either made solely by a program or where a program does something substantially and directly related to the decision. Technical detail isn’t required, but separate processes with different data or outcomes should be described separately.
Our vendor’s software makes the decision. Is that their problem?
No. The obligation sits with the entity that arranged for the program to be used, which is you. Embedded scoring and screening features inside SaaS products count.
Do individuals get a right to challenge automated decisions?
Not under these amendments. They are a transparency obligation only. There is no new right to contest a decision and no duty to notify individuals directly, unlike Article 22 of the GDPR.
Is there an equivalent rule in New Zealand?
There is no specific automated decision-making disclosure rule in the NZ Privacy Act 2020. But IPP 3A, in force since 1 May 2026, requires agencies to tell people when they collect personal information about them from a third party, which catches a lot of AI data enrichment.
Sources: OAIC, APP 1.7–1.9 Transparency Obligation Fact Sheet and APP 1 Guidelines (September 2026). This article is general information, not legal advice.