Leadership1 publisherNot yet confirmed elsewhere2 min readPublished
Larger Australian firms must name their automated decisions in privacy policies from 10 December 2026
Australian organisations with turnover above $3 million must say in their privacy policies, from 10 December 2026, which decisions their software helps make. The slow part is finding every system behind those decisions, including AI built into software a firm bought.
The Board Room · Leadership desk
What happened
- The rule covers computer programs that make, or substantially help make, decisions that could reasonably be expected to significantly affect a person's rights or interests.
- Turnover is the broad test, but the obligations attach to APP entities and also to certain other organisations regardless of their turnover.
- The Office of the Australian Information Commissioner ran its first-ever privacy compliance sweep earlier this year, reviewing privacy policies at around 60 businesses in six sectors.
- In a Conga survey of 1,500 business leaders, one in five did not know whether their contract lifecycle or configure-price-quote software had AI embedded.
Compiled by The Board RoomSomething wrong?How this is made
Why it matters
- constraint The policy deadline works as an inventory deadline, since a firm cannot list a decision type for a system it has not yet found in its own software estate.
- decision Each firm has to settle how widely it reads 'substantially help make' and 'significantly affect', and that reading sets how many systems its policy lists and its teams review.
- exposure After 10 December a privacy policy is a public account of a firm's automated decisions, and privacy policies are the document the regulator's first sweep chose to examine.
The duty itself, as itwire describes it, is a disclosure. A privacy policy has to spell out the kinds of personal information used and the types of decisions the systems help make [3]. The article's advice goes further. It tells organisations to check whether each decision process is visible and auditable, then to bring internal policies into line with the public one [8]. It also says the rules, for now, reach only the narrower set of systems where personal data influences outcomes [9].
A general counsel could fairly argue that this is one paragraph in a public document, and a job for the weeks before December. I think that underrates the step before the drafting. About 300 of the 1,500 leaders in the Conga survey could not say whether their contract or pricing software had AI in it [13]. The article describes AI in those tools setting prices from market data and recommending contract terms [11]. It says the processes around them often run on customer or personal data, with limited visibility across systems [12].
The scope is also wider than the products sold as AI. The law is written about computer programs, though the article expects most businesses to concentrate on AI [5]. A list built from AI purchases would miss a rules-based discount engine or an automated approval workflow, and the article places both kinds of automation within the amended Act's possible reach [12]. The high-stakes uses it names are hiring, lending, insurance and customer service [10].
The date is fixed: the amendments made by the Privacy and Other Legislation Amendment Act 2024 take effect on 10 December 2026 [1]. The policy paragraph is the short task and the inventory is the long one. The decision this quarter is who owns that inventory, given that the systems sit with whichever team bought them. The article does not say what penalty attaches to an inaccurate disclosure.
Next quarter's consequence is upkeep. I'd expect a list compiled once to drift as vendors add features to tools a firm already runs, and the survey suggests many buyers would not notice [7].
What to watch
- Guidance from the Office of the Australian Information Commissioner on how it reads 'substantially help make' and 'significantly affect' would settle how long most firms' disclosure lists need to be.
- A post-deadline OAIC sweep that checks privacy policies specifically for automated-decision disclosures would show how the regulator tests the new text.
- Further surveys on embedded AI in business software would show whether Conga's one-in-five figure holds beyond contract and pricing tools.