From 10 December 2026, your privacy policy has to describe the decisions your software makes about people. Not your AI strategy. The actual decisions: who gets approved, who gets shortlisted, who is offered which price. This is a new obligation under the Privacy Act, it applies to most Australian businesses, and the regulator can act on a policy that falls short. This post explains what is required, who it covers, and the first thing to do about it.
The Privacy and Other Legislation Amendment Act 2024 added a transparency obligation to Australian Privacy Principle 1, in new sub-clauses APP 1.7 to 1.9. It commences on 10 December 2026. The Office of the Australian Information Commissioner released its final guidance on 30 September 2026, updating the APP 1 Guidelines and publishing a fact sheet on the obligation.
In plain terms, if your organisation has arranged for a computer program to make a decision, or to do something that substantially and directly helps make a decision, and that decision could reasonably be expected to significantly affect a person's rights or interests, and personal information is involved, then your privacy policy must say so. It must set out the kinds of personal information used, the kinds of decisions made solely by a program, and the kinds of decisions a program substantially and directly contributes to.
Three points from the OAIC guidance change who this reaches.
First, "computer program" is read broadly. It is not limited to artificial intelligence. The guidance covers rule-based systems, and commentary notes it reaches ordinary tools such as a configured spreadsheet or a SaaS feature a vendor switched on. If software shapes the decision, it counts.
Second, a human in the loop does not automatically take you out of scope. If the program substantially and directly informed the decision, it is captured even when a person signs it off.
Third, the obligation is yours, not your vendor's. The duty falls on the entity that arranged for the program to be used, including AI procured from a supplier and AI tools staff use day to day. The same Act gave the OAIC a tiered enforcement regime, including infringement notices for administrative breaches such as a non-compliant privacy policy, and civil penalties for interferences with privacy.
The obligation applies to APP entities, which is most Australian organisations with annual turnover above three million dollars, along with others the Privacy Act already covers. If you make lending, pricing, eligibility, hiring, ranking or similar decisions with the help of software, and those decisions affect individuals, you are likely in scope.
The harder question is not whether the rule applies. It is whether you can list the systems it applies to. When we ask mid-market leaders which of their systems make decisions about people, most cannot answer, not through carelessness, but because nobody has ever written the list.
That list is the practical starting point, and it is the first thing a structured AI governance exercise produces: every AI and automated system, what it decides, whether a person reviews it, what personal information it uses, and who owns it. Once you have it, updating the privacy policy is straightforward, because you are describing systems you can see rather than guessing.
This inventory is also the foundation of ISO/IEC 42001, the international standard for an AI management system. An ISO 42001 readiness or gap exercise begins with exactly this register and adds the governance around it: risk assessment of each system, human-oversight rules, and accountability for who signs off what. The Privacy Act does not require ISO 42001. It requires disclosure. But the work that makes disclosure accurate is the same work ISO 42001 asks for, and it positions you for the AI standards and regulation still to come, including the governance expectations in the ASD Essentials guidance released this month.
Ten weeks is enough if you start now. Identify the systems: build the register of software that makes or substantially informs decisions about people, across AI tools, SaaS features and internal rule-based systems. Decide what is in scope: for each, judge whether the decision could significantly affect a person's rights or interests, using the OAIC guidance. Update the privacy policy: describe the kinds of information used and the kinds of decisions made or informed by a program, in plain language. Then put governance around the high-impact ones: human oversight, review rights and clear ownership, so the disclosure reflects how the system actually runs.
If you would like a plain-English read on what is in scope for your business, our cyber security practice can help. We run the ISO 42001 readiness exercise that produces the register and the governance, and our virtual CISO engagements keep it current. Start with a 30-minute call.
10 December 2026. It was introduced by the Privacy and Other Legislation Amendment Act 2024, and the OAIC released its final guidance on 30 September 2026.
No. The OAIC reads "computer program" broadly, including rule-based systems and tools such as configured spreadsheets and SaaS features, not only AI or machine learning.
Not necessarily. If the program substantially and directly informed the decision, it is in scope even when a person signs it off.
On you. The duty falls on the entity that arranged for the program to be used, including AI procured from a vendor and AI tools your staff use.
No. The Privacy Act requires disclosure in your privacy policy, not certification. ISO 42001 is a voluntary standard, but a readiness exercise produces the system inventory and governance that make compliance accurate and position you for what is coming.
Ben Jones is Cyber Security Practice Lead at Coder Trove. Our cyber security practice runs ISO 42001 readiness, ISO 27001 certification support and virtual CISO engagements for Australian organisations. An overview is on the cyber security practice page.