10 December 2026 deadline approaching: new privacy policy requirements where AI and automated decision-making are used

New Australian Privacy Principles (APPs) 1.7 to 1.9 require organisations to include additional information in their privacy policies where computer programs, including artificial intelligence (AI), make or materially inform decisions that significantly affect individuals. However, this is not simply a matter of updating privacy policies. Before the deadline, organisations need to identify and assess the AI tools, software and automated processes used across their operations to determine if they arrange for a computer program to use personal information to make or inform a decision that significantly affects an individual’s rights or interests.

When do the new requirements apply?

An organisation must update its privacy policy if each of the three conditions below are satisfied:

• it has arranged for a computer program to make a decision, or to do something substantially and directly related to making a decision;
• the decision could reasonably be expected to significantly affect an individual’s rights or interests; and
• personal information about the individual is used in operating the computer program.1

The concept of a “decision” is broad. It includes making, refusing to make or failing to make a decision, as well as doing, refusing to do or failing to do something. A decision may be covered regardless of whether its effect on an individual is adverse or beneficial.2

The Office of the Australian Information Commissioner (OAIC) has recently published updated APP 1 Guidelines, a fact sheet and a decision-making flowchart to assist organisations in assessing whether they fall within scope.3

A broad concept of “computer program”

The new requirements apply to “computer programs”, not only systems commonly described as AI.

The OAIC considers “computer program” broad enough to include:

• pre-programmed, rules-based processes;
• machine learning systems and AI;
• software, applications and third-party SaaS platforms;
• recruitment platforms;
• automated workflows and fraud detection systems;
• customer profiling and personalisation tools;
• credit risk and assessment tools;
• chatbots; and
• generative AI tools which can be used to generate text, images, video, code or other outputs.4

An organisation may have “arranged for” a computer program where it procures a third-party SaaS system, configures existing software, permits personnel to use an AI tool or relies upon an external provider’s automated output. Responsibility for updating a privacy policy will generally remain with the organisation using personal information to make or inform the relevant decision.

Human involvement in decision making

The new requirements are not limited to decisions made entirely by a computer (ie determinative decisions). They may also apply where a computer program advises or recommends an outcome, scores or ranks an individual, or otherwise guides a human decision-maker.

The question is whether the system’s involvement is both:

• substantial, meaning that it is a key factor in facilitating the human decision-making; and
• direct, meaning that it has a direct connection with the making of the decision.

Relevant factors include the degree of reliance placed on the output, whether human reviewers genuinely interrogate or override it, the nature of the output (ie is the decision determinative or advisory) and how deeply the system is integrated into the decision-making process. Simply requiring a person to approve an automated recommendation will not necessarily take the process outside APP 1.7.

Which decisions are likely to be significant?

A decision must be capable of significantly affecting an individual’s rights or interests and includes decisions made under laws or legislative instruments, decisions affecting an individual’s rights under a contract or which affects their access to a significant service or support. Not only must the effect be more than trivial, it must have the potential to influence considerably the individual’s outcomes or circumstances.5

Examples of decisions which may significantly affect an individual’s rights or interests include (but are not limited to) decisions concerning:

• recruitment, promotion, remuneration or performance assessment;
• access to credit, loans, insurance or banking services;
• access to healthcare, disability or aged-care services;
• access to housing, education, scholarships or government benefits;
• suspension or termination of an account;
• fraud detection and access to transactions or services; and
• personalised or differential pricing for significant goods or services.

An individual’s circumstances are also relevant. A decision may have a particularly significant effect on a child, a person experiencing vulnerability or an individual who depends on the relevant product or service.6

What must the privacy policy say?

If APP 1.7 applies, the organisation’s privacy policy must describe (as set out in APP 1.8):

• the kinds of personal information used by the relevant computer programs;
• the kinds of decisions made solely by those programs; and
• the kinds of decisions for which those programs do something substantially and directly related to making the decision.

Organisations may group similar types of personal information and decisions, but the description in their privacy policy must be transparent and remain sufficiently specific to be understood by a reasonable person. Sensitive information, such as health information and biometric templates, should be identified clearly where it is used.

Organisations are not compelled to disclose trade secrets or genuine commercial-in-confidence information. However, this is a narrow exclusion. Information is not commercial-in-confidence merely because disclosure may be inconvenient, embarrassing or would attract criticism.

What should organisations be doing now?

Organisations should not wait until December to review their privacy policies. The policy update is the final step in a broader compliance process.

1. Identify automated decision-making processes

Undertake an organisation-wide review to identify computer programs that use personal information to make or inform decisions. The review should cover all business areas, including customer service, marketing, pricing, recruitment, human resources, fraud prevention, risk, finance and complaints handling.

Third party systems formally procured by the organisation as well as AI tools adopted or used by individual business units and personnel should be reviewed and assessed.

2. Map personal information and decisions

For each system, document:

• the personal information used;
• the decision or recommendation produced;
• whether the output is determinative or advisory;
• how personnel use and rely on the output;
• whether the decision can be challenged or overridden; and
• the possible effect on affected individuals.

3. Assess the significance of the decisions – are they in scope for APP 1.7?

Consider whether each decision could significantly affect an individual’s legal, financial, employment, health, commercial or other interests.

The assessment should take account of foreseeable effects on vulnerable individuals and whether small effects may become significant through repetition or accumulation.

4. Review third-party systems

Ask the organisation’s software vendors and service providers to explain:

• whether their products use AI, machine learning or automated rules;
• what personal information is processed;
• what outputs, scores, recommendations or decisions are produced; and
• the extent to which the organisation can understand, configure or override those outputs.

Organisations should not assume that a system falls outside the new requirements merely because its automated functionality is embedded within a third-party product.

5. Update the privacy policy

Prepare clear, tailored disclosures for in-scope systems. Avoid generic statements such as “we may use AI” that do not identify the personal information used or the kinds of decisions involved and avoid detailed technical descriptions.
The updated policy must be published and available by 10 December 2026.

6. Put ongoing governance in place

The OAIC’s guidance is very clear that compliance should not be treated as a once-off exercise. Organisations should establish governance processes to ensure future AI deployments and automated decision-making tools are assessed before implementation and reflected in privacy documentation where required. Procurement, privacy impact assessment and technology approval processes should include specific questions about AI, automated decision-making, personal information and whether there are significant effects on individuals.

Key takeaway

APPs 1.7 to 1.9 require organisations to understand how automated decision-making operates across their business – they are not simply a privacy policy drafting exercise. The new APPs require organisations to understand what AI and automated decision-making technologies they are using, how personal information is processed within those systems, and whether those systems influence decisions that significantly affect individuals.

With the compliance deadline of 10 December 2026 fast approaching, organisations should be conducting an inventory of AI and automated decision-making now, assessing which systems fall within scope and prepare an updated privacy policy.

Addisons’ Privacy & Data Protection team can assist organisations to conduct automated decision-making assessments, review AI governance and procurement processes, and prepare compliant privacy policy disclosures.