Privacy Act 2026
Using AI in Your Business? You May Be Making 'Automated Decisions' Under the Australian Privacy Act
If you use AI or software to make decisions about people, you may be caught by Australia's new automated decision-making disclosure rule under the Privacy Act 1988, mandatory from 10 December 2026. What counts as ADM, and what to do. Source-checked.
AI tools have spread quickly through Australian businesses — for scoring, screening, pricing and eligibility. What many owners do not realise is that using them may make you subject to a new privacy obligation. From 10 December 2026, certain automated decision-making (ADM) must be disclosed in your privacy policy. Here is how to tell if it applies to you.
What "automated decision-making" means here
The obligation focuses on the effect of the decision, not the brand of technology. It is triggered where a computer program makes — or does something substantially and directly related to making — a decision that could reasonably be expected to significantly affect an individual's rights or interests. A spreadsheet rules engine can count just as much as a large AI model. (Source: OAIC.)
Examples that may be caught
- Credit or eligibility scoring (approve/decline, limits)
- Dynamic pricing that materially changes what a person pays
- Tenant or rental application scoring
- Hiring filters that reject candidates automatically
- Risk scoring, including AML/CTF customer risk scoring (relevant to Tranche 2
firms — see AML Tranche 2 and the Privacy Act)
- Fraud or anomaly detection that leads to adverse action against an individual
Examples that may not be caught
A tool that merely provides information to a human who makes the real decision, or one whose output does not significantly affect a person's rights or interests, is less likely to trigger the disclosure. But "human in the loop" is not a magic shield — look at whether the program substantially drives the outcome.
What you have to do (from 10 December 2026)
Your privacy policy must disclose the kinds of personal information used and the kinds of decisions made by the program. The practical how-to — including an internal ADM inventory — is in automated decision-making disclosure.
Start with an inventory
The simplest first move is to list every tool that touches a decision about a person: what it does, the decision it affects, and the personal information it uses. That inventory both tells you whether you are caught and feeds your disclosure.
Run the free checker to flag whether ADM applies to you, then use the free checklist to draft the disclosure.
General information only, not legal or compliance advice. Current to June 2026; OAIC ADM guidance was still in consultation as at June 2026. Confirm your obligations at oaic.gov.au or with a qualified adviser. Last verified: 8 June 2026.
Run the free ML/TF risk assessment →