Insights

Your privacy policy needs an AI clause by December

On 10 December 2026, a new transparency obligation under the Privacy Act kicks in. If your business uses any computer program to make or inform decisions that affect people, and those decisions use personal information, you need to say so in your privacy policy.

This is not a future reform. The Privacy and Other Legislation Amendment Act 2024 inserted Australian Privacy Principles 1.7 through 1.9 into the Act. The OAIC published final guidance on 30 September 2026. You have about 10 weeks.

What triggers the disclosure

Three conditions must all be met under APP 1.7:

  1. Your business has arranged for a computer program to make a decision, or do something substantially and directly related to making a decision.
  2. That decision could reasonably be expected to significantly affect someone’s rights or interests.
  3. Personal information about that person is used by the program.

If all three apply, your privacy policy must disclose the kinds of personal information involved, the kinds of decisions made solely by the program, and the kinds of decisions where the program does something substantially and directly related to the decision (APP 1.8).

It is broader than you think

The OAIC guidance makes clear that “computer program” covers more than AI. Rule-based tools and spreadsheets with formulas fall within scope, along with scoring models and everyday business software. If a spreadsheet auto-calculates a customer risk score that a human then acts on, that may trigger disclosure.

Human review does not automatically remove a tool from scope. The guidance says if a program’s output is a key factor in a human’s decision, it should be disclosed. The test looks at reliance on the output, likelihood of override, whether the output is advisory or determinative, and how integrated the system is into the workflow.

“Significantly affects rights or interests” covers decisions about employment, housing, finance, and access to services or utilities. The guidance also includes a vulnerability test: if the outcome would be materially different for a vulnerable group compared to the general population, the decision is likely in scope.

What this means for businesses using AI tools

If you have deployed an AI email triage system that routes or prioritises customer complaints, and those complaints involve personal information, that may trigger disclosure. An automated credit assessment tool or a hiring filter almost certainly requires it.

The obligation sits with the entity using the tool, not the vendor. If you bought a SaaS product that includes automated decision features, the disclosure is yours. You may need to ask your vendor how their ADM works to write an accurate disclosure.

The Allens analysis (3 October 2026) notes that Australian rules are broader than the EU GDPR equivalent. GDPR targets decisions “based solely on automated processing.” APP 1.7 also captures semi-automated decisions where a program is substantially and directly involved. Businesses already GDPR-compliant may still need additional disclosures for their Australian privacy policy.

What to do before 10 December

The OAIC recommends three steps.

First, map your tools. Identify every program and AI product involved in decision-making. Include third-party tools and embedded features in SaaS platforms.

Second, assess each against APP 1.7. Does it make or inform decisions using personal information that could significantly affect someone’s rights or interests? If yes to all three conditions, it needs disclosure.

Third, update your privacy policy. Describe the kinds of personal information used, the kinds of decisions made solely by programs, and the kinds where programs do things substantially and directly related to decisions. Categorise where appropriate; you do not need to list every sub-decision.

The gap most businesses will miss

This is a transparency measure only. There is no individual right to contest automated decisions (unlike the EU GDPR). There is no requirement to notify individuals at the point of decision. The obligation is to put the information in your privacy policy.

That narrow scope is also why it will catch businesses off guard. If you adopted AI tools in the past two years, your current privacy policy almost certainly does not mention them. Updating the policy is the minimum. The harder work is knowing what your tools actually do with personal data.

Two months is tight for an organisation that has never audited its AI tooling. If you have not started, the mapping exercise should begin now.

Sources