Ninety-one per cent.
That's the share of Australians who told the privacy regulator this year they should have the right to be told when their personal information is used in automated decision-making. It comes from the OAIC's 2026 Australian Community Attitudes to Privacy Survey, and it's about as close to unanimous as Australians get on anything.
From 10 December 2026, when the automated decision-making rules in the Privacy Act commence, that expectation stops being a survey result for a lot of firms. It becomes a paragraph your privacy policy has to contain.
Most firms I talk to have put this one on the back burner, because they heard the word AI and decided it was a big-bank problem. The law is written about something much broader than that word suggests.
Automated decision making and the Privacy Act, in plain words
The Privacy and Other Legislation Amendment Act 2024 adds three new pieces to Australian Privacy Principle 1, the one that governs your privacy policy.
APP 1.7 sets the trigger. If you have arranged for a computer program to make a decision, or to do something substantially and directly related to making one, and that decision could reasonably be expected to significantly affect someone's rights or interests, and personal information is used to do it, you are in.
APP 1.8 says what you then have to disclose. Three things: the kinds of personal information the program uses, the kinds of decisions made solely by the program, and the kinds of decisions where the program plays a substantial and direct role.
APP 1.9 fills in the definitions. Two are worth reading twice. Making a decision includes refusing or failing to make one. And the effect on the person can be good as well as bad.
That's the whole obligation. It's a disclosure rule, not a ban. Nobody has to switch anything off. They have to say, in writing, that they use it.
Why this is not really about AI
Here is the part that catches people.
On 30 September 2026 the OAIC released its guidance on the new disclosure rules: a fact sheet, a flowchart and an updated chapter of the APP guidelines. As Maddocks summarised it, the regulator reads "computer program" deliberately wide. Pre-programmed rules. Machine learning. Generative AI and chatbots. Ordinary software applications. Even word-processing tools.
So the spreadsheet with a scoring formula that decides which clients get a priority review is a computer program. The rules engine in your platform that declines an application under a certain threshold is a computer program. The CRM workflow that quietly moves a lapsed client to a cheaper service tier is a computer program.
None of those would show up on an AI register, if you have one. This is the fine print on an insurance policy, except you are the one who wrote it and the regulator is the one reading it.
So my first recommendation goes against the obvious one. Don't start with your AI tools. Start with every piece of software that produces a score, a ranking, a yes, a no, a price or a priority about a person. The AI ones will be on that list anyway, and they're rarely the ones that catch firms out.
A person clicking approve doesn't take it out
This is the second surprise, and the one I'd want a board to understand.
Plenty of firms will assume that because a human signs off every decision, the software isn't really deciding anything. The OAIC's guidance doesn't accept that on its own. Its worked examples include a generative AI tool suggesting staff bonuses that stays in scope even though HR reviews the suggestions and a director approves them.
What takes it out, in the OAIC's telling, is the people doing real work on the output. Interrogating it. Checking the underlying numbers. Narrowing the parameters. Looking for more evidence, and writing down why they disagreed when they did.
Picture the approval queue at 4:30 on a Thursday. The software's answer is usually right, there are forty more waiting, and the button is there to be pressed. The law was written to make that visible.
Beware: The obligation applies to decisions made from 10 December 2026, not to systems installed after that date. Pinsent Masons makes the point plainly: it applies regardless of when the underlying system was deployed. The scoring sheet you built in 2019 counts.
Who it applies to, and who it doesn't
The obligation sits on APP entities, which for most private businesses means organisations with annual turnover above $3 million. The small business exemption hasn't gone anywhere. If you're under that line and nothing else brings you into the Privacy Act, this doesn't apply to you today, and anyone telling you otherwise is selling something.
There is one big exception worth knowing about. Since 1 July 2026, accountants, lawyers, conveyancers, real estate professionals and trust and company service providers who provide designated services under the AML/CTF reforms are covered by the Privacy Act for that work, whatever their turnover.
If your firm is above the threshold and you have ever looked at what a compliance audit actually examines, you'll recognise the shape of this. The privacy policy is the document everything else gets measured against. If it's wrong, the rest of your privacy position gets harder to defend.
Where firms actually get stuck
Not on the wording. Wording is a solvable problem and it's your lawyer's problem, not mine. We're not lawyers and we don't write privacy policies.
Firms get stuck on the inventory. You can't describe the kinds of decisions your software makes until somebody has gone through the systems and found them, and that is a question about what your systems actually do.
Maddocks made the same observation from the legal side. The affected systems often aren't labelled as AI and aren't centrally governed. They sit inside HR platforms, finance tools, marketing automation, and the thing your operations team configured three years ago and hasn't thought about since.
I don't enjoy reading Explanatory Memoranda any more than you do. This one is unusually clear about what it wants, and what it wants is for you to know your own systems. That's a fair ask, and from the firms I have asked it of, it's a difficult nut to crack in a week.
If you have read our older piece on Australian privacy law, note that it was written in 2023, before these reforms. The fundamentals in it still hold. This obligation is new on top of them.
Tip: Ask whoever runs your systems for one list. Every place where software produces a score, a ranking, a yes or no, a price or a priority about a person. Not only the AI tools. All of them. The length of that list, and how long it takes to arrive, will tell you plenty.
What a good answer looks like
A firm that is ready for 10 December can do three things without a scramble.
It can name the systems. Not "we use some automation". The platform, the module, the spreadsheet, and which decisions each one touches.
It can say, for each one, whether the software decides alone or whether a person genuinely weighs it up, and show the evidence. "Our people always check" won't survive the first follow-up question.
And it has a privacy policy saying all of that in language a client could understand, reviewed by someone qualified to review it.
That's the whole job. It's the same discipline you would expect from your own advisers when they document why a recommendation suits a client. Here you're the one documenting.
At the time of writing, the OAIC guidance is ten weeks old and nobody has been tested on it yet. I don't know how hard the first year will be policed. I do know that the list takes longer to build than anyone expects.
If you want a quicker first read, the ADM checker on this site asks a few questions about what your business does and checks what your published privacy policy says today. If it turns out you need the full inventory, that is the first thing we build in an AI Discovery Workshop, and you get it in writing to hand to your lawyer.
Where these numbers come from
- Australian Community Attitudes to Privacy Survey 2026, privacy legislation findings, Office of the Australian Information Commissioner
- New resources on transparency for use of AI and automated decision-making, OAIC, 30 September 2026
- Ten weeks to go: OAIC releases guidance on new automated decision-making transparency obligations, Maddocks, 7 October 2026
- Australian community privacy survey shows businesses where opportunities lie, Pinsent Masons
Yener
