AMLCompliant, home

Privacy Act guide · general information, not legal advice

Using AI? You may be making automated decisions

From 10 December 2026 a privacy policy must describe certain decisions that a computer program makes, or helps make, about people. The rule does not mention AI. It turns on what the software does to a decision about a person. This guide works through examples on both sides of the line.

Last checked 25 September 2026 against the Privacy and Other Legislation Amendment Act 2024 (C2024A00128) and the Privacy Act 1988 compilation C2026C00227 (compilation date 4 June 2026)

POLA Act s 2 the law, read in the authorised textOAIC guidance the regulator's published guidance, which is not law

The rule in one paragraph

The Privacy and Other Legislation Amendment Act 2024 (the POLA Act) adds APP 1.7 to 1.9 to the Australian Privacy Principles. They commence on 10 December 2026.1 POLA Act s 2 If an APP entity has arranged for a computer program to make a decision, or to do a thing that is substantially and directly related to making a decision, and the decision could reasonably be expected to significantly affect the rights or interests of an individual, and personal information about that individual is used in the program, then the entity's privacy policy must describe those decisions.2 POLA Act Sch 1 item 88

The new text is not yet in the Privacy Act compilation, because it has not commenced. We quote it from the POLA Act.

AI is not the test

The Act says "computer program". It does not say artificial intelligence. The OAIC reads "computer program" broadly: its issues paper quotes the Explanatory Memorandum as covering "pre-programmed rule-based processes, artificial intelligence and machine learning processes", and says generative AI tools, including chatbots, fall within it.3 OAIC A spreadsheet formula can be caught. A large language model can be outside the rule.

What narrows the rule is the rest of the test. Each part has to be met:

The three parts of APP 1.7
Element The question to ask Source
Program and decision Does software make the decision, or do something substantially and directly related to making it? Refusing or failing to decide counts as deciding. POLA Act Sch 1 item 88
Significant effect Could the decision reasonably be expected to significantly affect an individual's rights or interests, for better or worse? POLA Act Sch 1 item 88
Personal information Is personal information about that individual used in the program? POLA Act Sch 1 item 88

APP 1.9 gives three examples of decisions that may affect rights or interests: a decision under an Act or legislative instrument to grant or refuse a benefit; a decision that affects rights under a contract, agreement or arrangement; and a decision that affects access to a significant service or support.2

When is software "substantially and directly" involved?

A person often makes the final call. That does not end the question. The OAIC's issues paper quotes the Explanatory Memorandum: "substantially" means the program's output is a key factor in the human's decision, and "directly" means it has a direct connection with making the decision.4 OAIC

The issues paper gives a spreadsheet example. A formula that scores and ranks callers to a crisis line, where the score is a key factor in who is called back first, is substantially and directly related to the decision. A formula that only works out a person's age from a date of birth may be directly related to a decision, but is not substantially related to it.4

Examples on both sides

These are illustrations for small practices, not rulings. The answer for your tool depends on how you use it.

Likely to be caught

  • Rental application scoring that ranks or screens out applicants before an agent reviews the shortlist. It can affect access to housing.
  • Client risk scoring that rates an individual client's money laundering risk, where the rating feeds the decision to take the client on or turn them away.
  • Recruitment filters that reject job applicants automatically on the answers they give.
  • Payment plan or credit eligibility checks that approve or decline an individual client.

Less likely to be caught

  • A spelling or grammar tool in your word processor.
  • A spreadsheet that adds up a client's invoices, or works out a person's age.
  • A chatbot that answers general questions about fees and office hours, and decides nothing about the person asking.
  • A calendar tool that offers open appointment times to anyone who asks.

Some uses sit in the middle. The OAIC's issues paper asked for views on an edge case in which staff use a generative AI chatbot to summarise applicants' profiles and recommend who is eligible, while a person always makes the final decision.5 OAIC If an AI summary or recommendation is a key factor in what your staff decide about a person, treat the tool as in scope until the OAIC's guidance says otherwise.

Decisions that only affect a company are outside the rule, because it protects individuals. For your current or former employees, the employee records exemption in s 7B(3) may apply to acts directly related to the employment relationship and an employee record. Job applicants are not your employees.6

Does it apply to your practice?

The rule binds APP entities: agencies, and organisations that are not small business operators. A business with an annual turnover of $3 million or less is usually a small business operator, unless one of the cases in s 6D(4) applies.7 s 6D(1) s 6D(4)

There is an important exception for this site's readers. If a small business is an AML/CTF reporting entity, the Privacy Act applies to its activities connected with the AML/CTF Act, Regulations or Rules as if it were an organisation.8 s 6E(1A) A client risk-scoring tool used for customer due diligence sits squarely in that territory. See AML tranche 2 and the Privacy Act.

What to do before 10 December 2026

  1. List the tools

    Every system that uses personal information to decide, score, rank, filter or recommend something about a person. Include tools a supplier runs for you: the test is whether you have arranged for a computer program to make, or do something substantially and directly related to making, the decision.

  2. Apply the three-part test

    Record, for each tool, whether it decides or substantially and directly supports a decision, whether the decision could significantly affect the person, and what personal information it uses.

  3. Separate the two kinds of decision

    Your policy must describe, separately, the kinds of decisions made solely by a program and the kinds where a program does something substantially and directly related to a person's decision. POLA Act Sch 1 item 88

  4. Draft the wording

    Use the outline in our automated decision-making disclosure guide, then check it against the OAIC's current guidance.

  5. Keep the list current

    Re-check the list when you add or change a tool, so the privacy policy stays accurate.

The rule applies to decisions made after it commences on 10 December 2026, even if you set the tool up, collected the information or used it in the program before that day.9 POLA Act Sch 1 item 89

The OAIC consulted on an issues paper from 18 May 2026 to 15 June 2026 to inform its guidance on automated decision-making, and said it intended to release that guidance by September 2026.10 OAIC Check the OAIC's website for the current version before you finalise your wording.

Where to go next

Run the free Privacy Act checkerUse the free checklist

AMLCompliant is published by Wani Meridian Pty Ltd, an independent private business. We are not affiliated with, or endorsed by, the Office of the Australian Information Commissioner, the Attorney-General's Department or any other government body. This guide is general information, not legal advice.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.

Sources

Law is quoted from the authorised text on the Federal Register of Legislation, opened 25 September 2026. OAIC pages are guidance, not law. They open in a new window, and linking to them does not mean the OAIC endorses this page.

  1. Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024; C2024A00128), front page ("Assented to 10 December 2024") and s 2(1), table item 7: Schedule 1, Part 15 commences on "the day after the end of the period of 24 months beginning on the day this Act receives the Royal Assent", which is 10 December 2026. legislation.gov.au/C2024A00128/latest/text

  2. Privacy and Other Legislation Amendment Act 2024, Schedule 1, item 88, inserting APP 1.7, 1.8 and 1.9 at the end of clause 1 of Schedule 1 to the Privacy Act 1988.

  3. OAIC, "Automated Decision-Making Issues Paper" (May 2026), "Meaning of computer program", quoting the Explanatory Memorandum to the Bill. Guidance, not law. oaic.gov.au (PDF)

  4. OAIC, "Automated Decision-Making Issues Paper" (May 2026), "Substantially and directly related to making a decision", quoting the Explanatory Memorandum to the Bill, with the spreadsheet examples. Guidance, not law.

  5. OAIC, "Automated Decision-Making Issues Paper" (May 2026), "Fictional Edge Case: Generative AI with human oversight". The OAIC asked the question; it did not answer it in the paper. Guidance, not law.

  6. Privacy Act 1988, s 7B(3) (employee records) and s 6(1) ("individual means a natural person"). Privacy and Other Legislation Amendment Act 2024, Schedule 1, item 88 (APP 1.7(b) refers to "the rights or interests of an individual"). legislation.gov.au/C2004A03712/latest/text

  7. Privacy Act 1988, s 6(1) (definitions of "APP entity" and "organisation"), s 6D(1) and s 6D(4).

  8. Privacy Act 1988, s 6E(1A). The Act applies "with the prescribed modifications (if any)".

  9. Privacy and Other Legislation Amendment Act 2024, Schedule 1, item 89 (application of amendment).

  10. OAIC, "Consultation on Guidance for Transparency in Automated Decision Making", published 18 May 2026; submissions closed 15 June 2026. Guidance, not law. oaic.gov.au

Questions

Is a chatbot an automated decision?

Not just because it is a chatbot. The OAIC treats generative AI tools, including chatbots, as computer programs for this rule. The rule applies only if the program makes a decision, or does something substantially and directly related to making one, that could reasonably be expected to significantly affect an individual's rights or interests, using personal information about that individual (APP 1.7, inserted by Schedule 1, item 88 of the Privacy and Other Legislation Amendment Act 2024). A chatbot that answers general questions about your opening hours makes no such decision. A chatbot that screens out applicants may. The examples on this page are illustrations, not rulings.

What do I do now?

List every tool that uses personal information to decide something about a person, or to score, rank or recommend. For each one, decide whether it meets the three-part test and record why. Then draft the privacy policy wording before 10 December 2026, because the rule applies to decisions made after it commences on that day.

Where is the OAIC's guidance?

The OAIC consulted on an issues paper from 18 May 2026 to 15 June 2026 to inform its guidance on automated decision-making, and said it intended to release the guidance by September 2026. Check the OAIC's website for the current version before you finalise your wording. We link to the OAIC rather than paraphrase guidance we have not read in final form.