From 10 December 2026, if you have arranged for a computer program to make a decision about someone, or to do something substantially and directly related to making that decision, and that decision could reasonably be expected to significantly affect their rights or interests, you have to describe it in your privacy policy. It lands in Australian Privacy Principle 1. It applies to any organisation turning over more than $3 million. And "computer program" is deliberately broad enough to include a spreadsheet formula, so this is not only an AI rule.

Where this came from

The Privacy and Other Legislation Amendment Act 2024 received assent on 10 December 2024 and added a transparency obligation inside APP 1, the principle that already governs what your privacy policy has to say. The OAIC published its Issues Paper on 18 May 2026, consultation closed on 15 June, and the regulator said it intends to release guidance by September 2026, before the obligation starts. As at the start of September 2026 that guidance has not appeared, so the Issues Paper remains the clearest statement of how the OAIC is thinking.

So the law is settled. The interpretation is not, quite, and that gap is the interesting part.

Worth knowing why the government bothered. The OAIC's own research found 89% of Australians think they should have the right to know when their personal information is used in automated decision-making that could affect them. This is not a fringe concern being legislated at people.

The three part test

All three limbs have to be met. Straight from the Issues Paper:

  1. The entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision.
  2. The decision could reasonably be expected to significantly affect the rights or interests of an individual.
  3. Personal information about the individual is used in the operation of the computer program.

Two details in the fine print that catch people out. Making a decision "includes refusing or failing to make a decision", so an automated rejection counts. And a decision can affect someone's rights or interests "whether the individual is adversely or beneficially affected", so approving a discount is as much in scope as declining one.

"Computer program" is much broader than AI

This is where most people misread it. Paragraph 336 of the Explanatory Memorandum says the term takes its ordinary meaning and covers "pre-programmed rule-based processes, artificial intelligence and machine learning processes". The OAIC spells out that commonly used software, apps and word-processing tools are all in, and that generative AI tools used to produce text, images, video or code, chatbots included, all fall inside the definition.

The regulator's worked example is a spreadsheet. A formula in Excel that scores and triages people calling a domestic violence crisis hotline, where that score is a key factor in a human deciding whose call to take first, is caught. The same spreadsheet used only to work out someone's age from their date of birth is not.

That is the actual line. Not "is it AI", but "is it a key factor in a decision about a person".

Why your lead scoring is the awkward one

Paragraph 337 defines the halfway case. A program that recommends or guides a human decision is captured where the thing it does is:

  • substantially related, meaning "a key factor in facilitating the human's decision making", and
  • directly related, meaning it "has a direct connection with making the decision".

Now think about a lead score in your CRM. It is built from personal information. A human looks at it and decides who to call, who gets the discount, who gets escalated. On limbs one and three, a lead score sits inside the definition comfortably.

Which leaves limb two doing all the work: does the decision significantly affect rights or interests? For deciding call order on an outbound list, almost certainly not. For pricing, hiring, credit, insurance, tenancy or eligibility for a service, quite possibly yes, and you should not assume otherwise. The OAIC clearly knows this is the pressure point, because two of the three edge cases it put in its own Issues Paper are differential pricing and a discriminatory targeted job ad.

If you run automated scoring anywhere near a pricing or recruitment decision, this obligation is pointed at you.

What you run In scope?
Excel formula turning a date of birth into an age No. Directly related, not substantially
Lead score deciding who your reps ring first Almost certainly not. The decision is unlikely to significantly affect rights
Model or rule set that sets the price a customer is offered Likely yes. The OAIC's own pricing edge case
Automated screen or rank of job applicants Likely yes. The OAIC's own job ad edge case
Rules engine that auto-declines an application Yes. Refusing to decide counts, and it is made solely by the program
Chatbot that answers questions and decides nothing No, on its own

What actually has to go in the policy

APP 1.8 asks for three things, and none of them is your source code:

  1. The kinds of personal information used in the operation of those programs.
  2. The kinds of decisions made solely by the operation of those programs.
  3. The kinds of decisions where the program does something substantially and directly related to making the decision.

Kinds, not instances. You are describing categories, not publishing a model card. That makes this a genuinely small writing job sitting on top of a much larger job, which is knowing what you actually run.

What this obligation does not give people

Worth being straight about the limits, because plenty of commentary is overselling it. The federal obligation is a privacy policy disclosure. It does not give anyone a right to contest an automated decision, a right to an explanation on request, or a right to demand a human review it.

Western Australia went further. Principle 10 of the Privacy and Responsible Information Sharing Act 2024 (WA), which commenced on 1 July 2026, requires WA public sector entities to notify individuals, provide information about how the automated decision-making works if asked, and enable requests for human intervention. If you work with WA government, you are dealing with the stricter version already.

What we do on client builds

We stopped treating this as a legal review task and made it part of the build, because the legal review always arrives after the thing is live.

  • Keep a register of every automated decision, not every AI feature. Naming the decision is what tells you whether the obligation bites. Naming the tool tells you nothing.
  • Record where a human sits. Advisory, or determinative. Overridden often, or never in practice. "There is a human in the loop" is not an answer if that human approves everything in four seconds. We have a short video on where AI needs a human and where it does not if that is a conversation you are having internally.
  • Write the privacy policy wording when the scoring ships, in the same pull request. Retrofitting disclosure across a portal nobody has documented is the expensive version.
  • Draw the line at pricing and hiring. Any scoring that touches what someone pays or whether they get a job gets treated as in scope by default, and we argue our way out with evidence rather than assuming our way out.

What the regulator has not settled yet

The OAIC is still consulting on the meaning of "computer program", "substantially and directly related", "significantly affect the rights or interests", "making a decision", and how much detail disclosure needs. On that last one it has already signalled it thinks generic wording will not do. Its October 2025 review of 23 Commonwealth agencies with statutory authorisation to use automated decision-making found only 17% disclosed that use, while 74% could not be identified as using it at all from public information.

A regulator that has just published a survey of how badly disclosure is being done is not about to accept one vague sentence in your privacy policy.

The short version for whoever owns your privacy policy

You have until 10 December 2026, exactly two years after the amending Act got assent. The work is not writing the paragraph, it is finding out what you run. Start with a list of decisions your systems make or shape about people, mark the ones touching price, employment, credit or eligibility, and note where a human genuinely changes the outcome. If you have automated scoring anywhere near pricing or recruitment, treat yourself as in scope and get the wording drafted before the OAIC guidance lands, not after.

If you do not have an AI policy at all yet, the one page version is the place to start, and this disclosure sits inside it.

Then check who else needs to know. In most companies the person who owns the privacy policy has never seen the lead scoring rules, and the person who built the lead scoring has never read the privacy policy.

Frequently asked questions

Does this apply to us if we only use AI internally? It depends on whether the decision is about a person and whether it significantly affects their rights or interests. Internal use aimed at your own staff can still qualify, since employees are individuals too. A tool that summarises meeting notes and decides nothing is not caught.

Is a human in the loop enough to avoid the obligation? No. The obligation was drafted specifically to cover programs that recommend or guide a human decision, where the program is a key factor in that decision. A rubber stamp human does not take you out of scope.

We turn over less than $3 million. Are we exempt? Most small businesses under that threshold sit outside the Australian Privacy Principles, so the obligation generally will not apply. Check the exceptions first, because some small businesses are covered regardless, including health service providers and businesses that trade in personal information.

What happens if we do nothing by 10 December 2026? It becomes an APP 1 compliance failure, which the OAIC can investigate and enforce like any other privacy breach. The regulator has said it is actively looking at privacy policies in higher risk sectors.

Sources

  • OAIC, Automated Decision-Making Transparency Obligation (APP 1) Issues Paper, 18 May 2026. The three part test, the disclosure requirements and the OAIC's open questions.
  • Privacy and Other Legislation Amendment Act 2024 (Cth), assented 10 December 2024. The amending Act that inserted the obligation into APP 1.
  • Explanatory Memorandum, Privacy and Other Legislation Amendment Bill 2024 (Cth), paragraphs 336 and 337. The meaning of "computer program" and of "substantially and directly related".
  • Privacy and Responsible Information Sharing Act 2024 (WA), Principle 10, commenced 1 July 2026. The stricter Western Australian position.

 

Australia's new automated decision-making rule is a good example of a compliance change that looks like a legal job and is actually a systems job. If you are not sure what your CRM is deciding about people, give us a shout and tell us what's broken.