From 10 December 2026, organisations covered by Australia's Privacy Act must explain in their privacy policy when they use personal information in automated decisions that could significantly affect someone's rights or interests. The rules apply to decisions made after that date, even if the system or data existed before, so you need to know where AI and automation make or shape decisions.
- New APPs 1.7, 1.8 and 1.9 commence on 10 December 2026, introduced by the Privacy and Other Legislation Amendment Act 2024.Gilbert + Tobin, Automated decision-making transparency under the Privacy Act
- The obligation applies to decisions made after commencement, even if the personal information was collected earlier.Gilbert + Tobin, Automated decision-making transparency under the Privacy Act
- Privacy policies must include information about how personal information is used in automated decision-making tools or processes.Lander & Rogers, Australian privacy law update: what APP entities need to know in 2026
- About one in three Australian workers use AI without their employer's knowledge, so not every automated decision is on IT's map.HRD Australia, Australian workers still hiding AI use from employers (Employment Hero research)
What is changing?
The Privacy and Other Legislation Amendment Act 2024 added three new Australian Privacy Principles: APP 1.7, 1.8 and 1.9. From 10 December 2026, if your organisation uses a computer program to make, or substantially help make, decisions that could significantly affect individuals, and those decisions use personal information, your privacy policy must describe that use.
Who does it affect?
Any organisation covered by the Privacy Act, which includes most businesses with annual turnover above A$3 million and Australian Government agencies. In practice that is every large Australian enterprise using AI in lending, insurance, hiring, customer service, eligibility or pricing.
Why AI makes this harder
AI agents and automations spread fast, often without central approval. You can only disclose what you know about. The first job is an inventory: every system, agent and workflow where software makes or shapes a decision about a person, including tools staff adopted on their own.
How to prepare in the next month
Map decision flows across your systems. Classify which involve personal information and could significantly affect people. Update the privacy policy. Then put the governance in place so new agents are registered, approved and logged before they go live. On BLDR, every agent action is logged with who approved it, which makes the disclosure and any later review straightforward.
Questions people also ask
Does this apply to a chatbot that answers questions?
What happens if we get it wrong?
Can Inova help?
One governed layer across every system you own.
Deploy where you decide, connect to SAP and your local systems, and make every agent action approved and logged. See how the pieces fit.
