AI and Automated Decisions: Prepare for December’s Privacy Changes

Can your business explain where software influences decisions about customers, applicants or staff? New guidance from the Office of the Australian Information Commissioner (OAIC) makes that a practical question to work through now, before updating your privacy policy.

On 30 September 2026, the OAIC published new resources on transparency in automated decision-making. From 10 December 2026, covered entities must include additional information in their privacy policies when the conditions in APP 1.7 are met. The useful starting point is understanding the decisions your systems support, so the policy can describe what actually happens.

What changes in December?

The obligation applies to APP entities where they have arranged for a computer program to use personal information to make a decision, or perform something substantially and directly related to making it, and that decision could reasonably be expected to significantly affect an individual’s rights or interests.

Where those conditions apply, the policy must describe the kinds of personal information used and the kinds of decisions made solely by the program or substantially and directly supported by it. This is a specific transparency requirement, rather than a requirement for every business to disclose every use of software.

First establish whether your organisation is covered. The OAIC explains that most small businesses are not covered by the Privacy Act, but some are, including certain businesses regardless of turnover. Have your privacy lead or legal adviser confirm applicability and any relevant exceptions. This article focuses on the operational preparation that supports that assessment.

Look beyond tools labelled “AI”

The updated APP 1 Guidelines cover a broad meaning of computer program, including rules-based processes and AI. A human making the final decision does not automatically put the workflow outside scope. The role and influence of the program matter, as does the significance of the outcome for the individual.

The OAIC’s fact sheet includes examples involving recruitment screening, access to services and software-generated recommendations used in remuneration decisions. These are prompts to examine your own workflows, not a substitute for assessing the circumstances.

For a business leader, the implication is straightforward: an inventory of purchased AI licences will not tell the whole story. Ask teams what they use to score, rank, recommend, prioritise or decide. Include functions embedded in existing business applications and spreadsheets, then identify which deserve closer review.

Start with one real decision

Choose a workflow with a clear owner and a meaningful outcome for a person. Walk through it with the process owner, IT and your privacy lead. As an internal working record, capture:

• The outcome: what is decided, who is affected and what happens next.
• The inputs: the categories of personal information used and where they come from.
• The software’s role: whether it summarises, scores, ranks, recommends or determines the outcome.
• The human role: what the reviewer checks, what other evidence they consider and how they can challenge the output.
• The evidence: relevant settings, supplier documentation and a safe demonstration of the workflow.
• The owner: who confirms the record and updates it when the process changes.

Use a synthetic example where possible. There is no need to copy a live customer file into a broadly shared planning document. The aim is to make the process understandable while keeping personal information within its approved controls.

Ask suppliers about your configuration

A product brochure describes possibilities; your assessment needs to reflect the features you have enabled. Ask the supplier which inputs feed a recommendation, whether optional data sources are involved, what the output means and how configuration changes are communicated. Request a response that the process owner can understand and retain with the working record.

Where an answer is unclear, record the gap, a responsible person and a due date. Avoid filling gaps with assumptions such as “the vendor handles privacy” or “a manager clicks approve”. Those statements leave the business without an explanation of its own process.

Turn the findings into an achievable plan

Our suggested sequence is to complete the initial workflow inventory in October, resolve supplier questions and obtain privacy review in November, then allow time for approved policy changes before 10 December. This is a planning approach, not an additional regulatory timetable. Give unresolved items a named owner rather than leaving them in meeting notes.

Keep the technical record and public policy aligned, but they serve different purposes. Internal records can hold configuration details and review evidence. Your privacy adviser should guide what belongs in the public wording. Add a review step when a new feature or data source changes how a decision is supported.

Bring the technology and business owners together

Zarbtech’s perspective is that useful governance starts with a process people can explain and operate. Our IT Consulting services provide technology evaluation and planning aligned with business needs. If you need help understanding the systems behind a decision-making workflow, bring one example to a consultation. We can discuss the technical discovery and planning support you need alongside your privacy or legal adviser’s assessment.