What changes on 10 December 2026?
The Privacy and Other Legislation Amendment Act 2024 inserted new APPs 1.7 to 1.9 into the Privacy Act. From 10 December 2026, your privacy policymust outline the decisions your software (automation, data platform, AI orotherwise) makes or substantially shapes about people, and the kinds ofpersonal information those programs use.
The Office of the Australian InformationCommissioner (OAIC) published its final guidance, fact sheet and flowchart on30 September 2026.
Who does the ADM disclosure obligation apply to?
The obligation applies to every APP entity,which includes:
- Australian Government agencies
- Organisations with annualturnover above $3 million
- Smaller organisations inregulated categories, such as health service providers
What counts as automated decision-making under the PrivacyAct?
Systems are considered in scope when all three of these tests are met:
- You have arranged for a computer program to make a decision, or to do something substantially and directly related to making one.
- The decision could reasonably be expected to significantly affect a person's rights or interests.
- Personal information about that person is used by the program to get there.
This is a transparency obligation, with no new right for individual recourse, with no duty of direct notification.
The part that organisations have an immediate and time critical obligation to land is the scope. The OAIC’s reading of “computer program” covers everything from rule-based logic to AI. If you run bots, scoring models or rules engines that change what happens to a customer, an applicant or an employee, this applies to you.
Three questions to answer this week
- Can you list the outcomes your organisation decides for people, and which system shapes each one?
- For each decision, can you name how often a person overrides the system?
- Do you know which personal information fields feed each decision, including derived scores and bought data?
If there is not a clear answer, the inventory does not yet exist, and the inventory is what the disclosure is written from. There is no ADM-specific fine schedule. A policy that falls short is handled under the Privacy Act’s general enforcement regime, and the OAIC can act without a complaint, through a compliance notice, an infringement notice or a civil penalty. Which tier applies hasn’t been tested yet, so confirm your exposure with your legal advisers.
Why this is already your problem
Start with the second test, because it tells you where the risk is. “Significantly affects” covers a person’s legal and contractual rights, their benefits and entitlements, and their access to services that matter: credit and insurance, housing, health care, employment and utilities. It applies whether the outcome helps or harms them. The OAIC also expects you to ask whether a vulnerable group would get a materially different result from everyone else.
The largest exposure comes from the systems that have run for years. Whether it is a claims process that triages a claim and routes it to decline or investigation, a credit rule that sets a loan limit or prices a risk profile, or a score pushed from the data platform into the CRM that triggers a retention offer, a human approving the system’s recommendation does not take it out of scope. The obligation sits with the organisation using the program, not the vendor who built it.
Embedded scoring in a SaaS product is still yours to disclose. This applies to anyone under the Commonwealth Privacy Act. State and territory public sectors are not caught by the December date, with the exception of Western Australia, which has had a stricter automated decision regime in force since July. Either way, the right first move is a decision inventory: a single list of the outcomes your organisation decides for people, the decision and system behind each one, and the personal information it uses.
What must your privacy policy include?
The policy has to describe three things:
- The kinds of personal information your program use
- The kinds of decisions made solely by a program
- The kinds of decisions a program substantially and directly shapes
It is written by category rather than system by system, and the OAIC does not expect technical detail, model logic or scoring weights. Processes with different purposes, outcomes or data should be described separately, and sensitive information such as health or biometric data should be called out.
The commercial-inconfidence exclusion is narrow. It covers genuine trade secrets, not information that is only valuable or would be embarrassing to publish.
How the ADM obligation affects your tech stack
How to build a decision inventory: Where to start
Start with the decision inventory, not thepolicy wording, and start where the stakes are highest. List the outcomes acustomer, patient, applicant or employee can experience from your organisation,then work through them in this order:
- Access decisions. Decisions that give or refuse access to something essential, suchas treatment, credit, insurance cover, a utility, a job or a benefit.Prioritise those where the system decides alone or the human check is aformality.
- Terms decisions. Decisions that change the terms someone gets, such as pricing,limits, priority or referral to investigation.
- Harder-to-pin-downdecisions. Personalised offers and segmentation.
For each one, work back to the decision,the system that makes or shapes it, and the personal information it uses. Thencheck the list against what your bots, data platform and vendor productsactually do. Some of the decisions that matter will be ones nobody thought ofas automated.
The obligation applies in full from 10December 2026. This order sets the sequence of the work, not what you can leaveout.
How Blackbook AI can help
We build and support the bots, data platforms, applications and AI models where most of these decisions sit,so we know where to look for them. Our Automated Decision Assessment starts with the decisions that affectaccess to essential services and works down from there, testing each one against the OAIC’s three tests. Ittraces the personal information each one uses and gives your privacy and legal advisers what they need toupdate the policy.
With 10 December close, the time to start is now. Get in touch this week and we’ll run a short scoping sessionto show you where your estate sits and what it will take to be ready.
This article is general information, not legal advice. The obligation is new and its boundaries will be tested overthe coming year. Take advice on your own position.
About the author: Cooper Wakefield is Head of Applied AI and Generative AI at Blackbook AI. He leads a practice building and shipping production AI systems for large Australian enterprise and government organisations.
