Automated decisions and your privacy policy: what Australian operators should prepare before 10 December 2026

The short answer

The Office of the Australian Information Commissioner (OAIC) states that "On 10 December 2026, APP entities must include information in their privacy policy where they have arranged for a computer program to make or inform decisions that significantly affect individuals' rights or interests." The OAIC says the obligation was introduced by the Privacy and Other Legislation Amendment Act 2024 within Australian Privacy Principle (APP) 1.

For an operator, the practical job is an inventory problem before it is a wording problem. You cannot describe your automated decisions in a privacy policy until you know where software, rules or AI are influencing decisions about people.

This article summarises what the OAIC has published and offers an operational checklist. It is not legal advice. Amtec builds workflow and operating layers. We are not a law firm, and the wording of your privacy policy is a matter for you and your legal advisers.

What the OAIC says triggers the obligation

According to the OAIC's updated APP 1 Guidelines and its APP 1.7-1.9 Transparency Obligation Fact Sheet (both dated September 2026), an APP entity is in scope where all three of these apply:

1. The entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision.
2. The decision could reasonably be expected to significantly affect the rights or interests of an individual.
3. Personal information about the individual is used in the operation of the computer program to make the decision or do that related thing.

Operators should also confirm whether they are an APP entity at all. The OAIC states that most small businesses with an annual turnover of $3 million or less are not covered by the Privacy Act, but some are, for example health service providers. Check the OAIC small business guidance rather than assuming either way.

What the privacy policy must include

The OAIC says that where those conditions are met, APP 1.8 requires the privacy policy to include:

• the kinds of personal information used in the operation of such computer programs
• the kinds of such decisions made solely by the operation of such computer programs
• the kinds of such decisions for which a thing that is substantially and directly related to making the decision is done by such computer programs.

The fact sheet adds guidance on how much detail to give. It says entities should help individuals understand how their personal information is handled, avoid overwhelming them with granular technical detail, and tailor the information to their own activities. It says entities may group categories of decisions and types of personal information, but the detail must be "meaningful to a reasonable person", and use of more sensitive information such as health information or biometric templates should be clear.

The fact sheet also states that commercially sensitive information and trade secrets about computer programs are excluded from the requirement.

Four points in the guidance operators often miss

"Computer program" is broad. The OAIC fact sheet lists pre-programmed rule-based processes, AI and machine learning, software, apps or word-processing tools, and generative AI including chatbots. A spreadsheet formula that ranks people can count. The fact sheet's first worked example is exactly that.

Human review does not automatically take you out of scope. The OAIC states that "A decision may be within scope of the transparency obligation even where a computer program output does not replace the entire decision-making process or is subject to human review." Its guidelines list factors such as how heavily staff rely on the output, how often they actually override it, whether the output is advisory or determinative, how explainable it is, and how deeply it is built into the workflow. The fact sheet also says the OAIC considers machine learning or generative AI outputs used to make significant decisions "would generally fall within scope of the transparency obligation unless subject to extensive human oversight and control."

Buying software still counts. The OAIC lists procuring a third-party program, configuring off-the-shelf software and relying on advisory outputs as examples of having "arranged for" a computer program. It says it generally expects the obligation to remain with the APP entity using personal information to make the decision, and that entities should actively identify, assess and keep oversight of third-party programs during and after procurement.

When in doubt, OAIC suggests caution. The fact sheet says entities in doubt about whether a use falls in scope "should take a cautious approach" and include the required information in their privacy policy.

Examples the OAIC gives

The OAIC fact sheet lists decisions it would generally consider in scope. Several are directly relevant to commercial operators: recruitment software used to sort candidate profiles and make hiring decisions, differential or personalised pricing by online retailers in the sale of significant goods, programs used to approve or reject loan or credit applications, programs involved in assessing eligibility for insurance, AI-created reports used to rank employee performance or decide promotions or remuneration, and programs used to prioritise health or disability services.

If any of your workflows look like these, treat them as candidates for your inventory.

A practical operator checklist

The checklist below is operational preparation, not a statement of what the law requires. The legal obligation the OAIC describes is about privacy policy content. These steps help you produce accurate content and keep it current. Confirm the final position with current OAIC guidance and your advisers.

1. Build a systems inventory. List every system, vendor tool, spreadsheet, rule and AI feature that touches decisions about customers, applicants, staff or patients. Include features switched on inside tools you already pay for.
2. Map decisions, not just tools. For each system, write down the decisions it makes or informs: approve, decline, rank, price, prioritise, suspend, escalate. Include decisions not to act, since the OAIC guidance notes that refusing or failing to make a decision is included.
3. Record the personal information each decision uses. Group it into kinds that a reasonable person would understand. Flag sensitive categories such as health information or biometrics separately.
4. Classify solely automated vs substantially supported. APP 1.8 distinguishes the two. For each decision, record whether software decides on its own, or whether a person decides with software output as a key factor.
5. Document the human review path honestly. Who reviews, what they see, whether they can override, and how often they actually do. Given the OAIC guidance on reliance and override, a review step that is rarely exercised should be recorded as such, not presented as full human control.
6. Keep decision logs. A practical log records the input, the program output, the human action and the final outcome. This is good operating practice that helps you describe your decisions accurately and answer questions. It is an Amtec recommendation, not an OAIC-stated requirement under APP 1.7.
7. Ask vendors for their description. The OAIC fact sheet says providers of third-party software should give clear, high-level information about how their software can be used to make decisions. Request it and keep it on file.
8. Hand the inventory to whoever owns your privacy policy. Your legal or privacy adviser drafts the wording. The operations team owns keeping the inventory true when workflows change.
9. Set a review trigger. The OAIC APP 1 Guidelines say an APP entity should regularly review and update its privacy policy. Tie a review to any new automation, AI feature or vendor change in a decision workflow.

Where Amtec fits

Amtec is an implementation layer, not a law firm. We build custom operating layers so AI and automation land inside real workflows with clear approvals and logging. For this obligation, that work is useful in three places:

• Workflow mapping. Tracing where each decision actually happens across CRM, finance, email and operational tools, including the spreadsheet beside the official system.
• Approval design. Making human review points explicit in the workflow, with named owners, instead of informal sign-off in an inbox.
• Logging. Recording what the program produced, what the person did and what the outcome was, so your team can describe and evidence its decision flows.

We do not draft privacy policies or advise on whether you are in scope. If you are new to how we approach integrations and approvals, the AI automation build guide and the systems connection guide describe the underlying method. For an example of approval routing across an existing stack, see the Domus Property private operations agent. For engagement details, see AI consulting in Melbourne.

Common questions

When does the automated decision transparency obligation start? The OAIC states 10 December 2026. Confirm against current OAIC guidance before relying on it.

Does it only apply to AI? No, according to the OAIC. Its guidance says "computer program" includes rule-based processes, software and spreadsheets as well as AI, machine learning and generative AI.

If a person always makes the final call, are we out of scope? Not necessarily. The OAIC says a decision may be in scope even where the output is subject to human review, depending on factors such as reliance and override.

We use a vendor's software. Is this the vendor's problem? The OAIC says it generally expects the obligation to remain with the APP entity using personal information to make the decision. Vendors should provide information to help you.

Is this article legal advice? No. It summarises published OAIC material and offers operational steps. Get advice on your own circumstances.

Next step

If you want help building the systems inventory, decision map, approval paths and logging that your privacy team will need, bring one decision workflow to a short intro call. We will map where software touches the decision and what a clean, reviewable flow would look like. Your legal advisers stay responsible for the policy wording.

Book: https://cal.com/team/amtecai/intro-call