Australian businesses using AI and automated systems to make decisions about people may need to update their privacy policies before 10 December 2026. But how many businesses are aware of the changes?
The Office of the Australian Information Commissioner (OAIC) has released updated guidance about new transparency obligations under the Australian Privacy Principles (APPs).
At Hyplon, we recently received correspondence from the OAIC confirming the updated guidance and resources following its consultation on automated decision-making. The changes are important because businesses are increasingly using artificial intelligence (AI), software and automated systems to support everyday decisions, often without fully considering how those decisions affect individuals or whether their existing privacy policies adequately explain these practices.
What is changing on 10 December 2026?
From 10 December 2026, new transparency requirements under APP 1.7, 1.8 and 1.9 come into effect. These requirements were introduced through the Privacy and Other Legislation Amendment Act 2024. They require organisations covered by the Australian Privacy Principles to provide additional information in their privacy policies when they arrange for computer programs to make or substantially and directly inform decisions that could significantly affect individuals' rights or interests, using their personal information. In simple terms, if your business uses software or AI to make important decisions about people like your customers and employees or contractors, you may need to explain this in your privacy policy. And importantly, these obligations are not limited to artificial intelligence.
Traditional software such as a CRM platform like HubSpot, rule-based systems, automated workflows and third-party platforms may also fall within scope, but only if they meet the conditions explained below.
Why has the Australian Government introduced these changes?
Businesses have used automated decision-making for years. However, the rapid adoption of AI has increased the number of decisions that technology can influence. Consider a business using AI to assess job applications, evaluate financial circumstances or determine whether someone qualifies for a particular service. These decisions can have significant consequences for individuals. Yet the people affected may not know that a computer program played a role in reaching the outcome.
The changes are intended to improve transparency and accountability by giving individuals greater visibility into how their personal information is used in automated decision-making. They also support a broader objective of Australia's privacy reforms: ensuring that privacy protections remain relevant as technology and business practices evolve. The intention is not to prevent businesses from using AI or automated systems. It is to ensure that people can better understand when their personal information is being used to make or inform decisions that significantly affect them.
Does this apply to every Australian business?
No.
This is an important distinction, particularly for small businesses concerned about additional compliance costs. The new requirements apply to entities covered by the Australian Privacy Principles, generally including Australian Government agencies and many private-sector organisations with annual turnover exceeding $3 million.
However, some smaller businesses are also covered by the Privacy Act because of the nature of their activities. Even where a business is covered by the APPs, the new disclosure requirements only apply when the relevant conditions are met.
Under APP 1.7, the organisation must have arranged for a computer program to make a decision, or do something substantially and directly related to making a decision, where:
Personal information about an individual is used in the operation of the program.
The decision could reasonably be expected to significantly affect the individual's rights or interests.
Not every AI tool, chatbot or automated workflow will meet these conditions. For example, using AI to draft marketing content or summarise general business information would not ordinarily trigger these specific disclosure requirements. However, using AI to evaluate whether someone should receive a financial product, employment opportunity or important service may require closer examination.
The key question is not simply whether your business uses AI. It is how the technology uses personal information and influences decisions about people.
What types of business activities could be affected?
Many businesses may already be using software that influences decisions without necessarily describing it as automated decision-making. Here are some examples worth reviewing.
1. Recruitment and employment
A business uses an AI recruitment platform to assess applications, rank candidates or recommend who should progress to an interview. If the system's recommendations substantially and directly influence significant employment decisions, the new transparency requirements may apply.
2. Financial services and lending
A financial services provider uses software to analyse personal financial information and determine whether an individual qualifies for a loan, financial product or service. These decisions may significantly affect an individual's financial interests.
3. Insurance
An insurer uses automated systems to evaluate applications, assess claims or determine eligibility for cover. Depending on the significance of the decision and how personal information is used, these processes may fall within scope.
4. Access to services
A business uses software to determine whether an individual qualifies for an important service or opportunity. Where the decision has a significant impact on the person's rights or interests, additional transparency may be required.
5. Customer-facing AI systems
An AI chatbot that simply answers frequently asked questions will not automatically trigger the new requirements. However, if an AI system uses personal information to make or substantially influence significant decisions about customer eligibility, access to services or other important outcomes, the organisation should assess whether the requirements apply.
The above are illustrative examples. Whether a particular system is covered depends on the circumstances and the statutory criteria.
What if a human reviews the AI's decision?
This is an area businesses should pay particular attention to. Some organisations assume that having an employee review an AI-generated recommendation means the decision is no longer considered automated. That is not necessarily the case.
The OAIC's guidance explains that a computer program may still fall within scope even where its output is subject to human review.
For example, imagine an AI recruitment system evaluates 200 job applications and recommends 15 candidates for further consideration. A recruitment manager reviews the recommended candidates and makes the final decision. Although a person is involved, the AI system may have substantially influenced which candidates were considered. The organisation would need to examine the role of the system, the extent of meaningful human oversight and whether the decision could significantly affect individuals' rights or interests.
Human involvement alone does not automatically remove the transparency obligation.
What information must businesses include in their privacy policies?
Where the requirements apply, APP 1.8 requires organisations to explain three key things.
1. The kinds of personal information used
This means identifying the categories of personal information used by relevant computer programs. Depending on the system, this might include employment history, financial information, customer records or other personal information.
2. The kinds of decisions made entirely by computer programs
Businesses must describe the categories of significant decisions made solely through relevant automated systems.
3. The kinds of decisions substantially and directly informed by computer programs
This includes significant decisions where software plays a substantial and direct role, even if a person makes the final decision. The OAIC does not expect businesses to overwhelm individuals with technical explanations.
Privacy policies should provide meaningful, understandable information about relevant decision-making practices. A broad statement such as "We may use AI to improve our services" may not be sufficient where the new obligations apply. Businesses need to explain the relevant categories of decisions and personal information.
What about third-party AI tools and software providers?
Another important consideration is that businesses frequently rely on software developed and operated by external suppliers. This might include recruitment platforms, customer relationship management systems (CRM), financial assessment tools or AI-enabled business applications.
Using a third-party provider does not automatically transfer the organisation's privacy transparency responsibilities to that supplier. The OAIC's guidance indicates that the obligation will generally remain with the APP entity, meaning your business, that uses personal information to make or inform the significant decision. This means organisations should understand how their suppliers' systems operate and what role those systems play in decision-making.
Businesses may need to ask suppliers for information about:
The personal information processed by the system.
The types of decisions the system makes or influences.
Whether decisions are fully automated or involve human oversight.
How the system's outputs are used in business processes.
This is also why supplier due diligence is an important part of AI governance.
What should Australian businesses do before 10 December 2026?
It is understanding how your organisation uses AI and automated systems. Don't wait until December to start. Take action today.
We at Hyplon recommend the following approach.
Step 1: Identify the systems your business uses
Review AI applications, automated workflows, software platforms and third-party services used across your organisation. Pay particular attention to systems involved in decisions about customers, employees, applicants and other individuals.
Step 2: Understand how personal information is used
Identify the categories of personal information processed by each relevant system and the purpose for which that information is used.
Step 3: Review the decisions being made
Determine whether the software makes decisions independently or substantially and directly influences decisions made by employees. Consider whether those decisions could significantly affect an individual's rights or interests.
Step 4: Assess whether the new obligations apply
Use the OAIC's published flowchart and guidance to assess the relevant systems against APP 1.7–1.9. Document the outcome of your assessment, including the reasons for determining whether a system is within scope.
Step 5: Update your privacy policy where required
Where the new requirements apply, ensure your privacy policy includes the information required under APP 1.8. Use clear language that your customers and other individuals can understand, not legal language.
Step 6: Establish an ongoing review process
AI systems and software functionality can change and are changing quickly. A system that initially provides general administrative support may later be used to influence significant decisions. Businesses should review their privacy assessments when introducing new technology, changing how existing systems are used or enabling additional AI functionality. A privacy policy should reflect how the organisation actually operates, not simply how it operated when the document was first written.
Why updating a privacy policy alone may not be enough
The new requirements focus on transparency, but meeting them depends on understanding what is happening within the organisation. A business cannot accurately explain its use of automated decision-making if it does not know which systems are being used, what information they process or how their outputs influence decisions. This is where AI governance and privacy management become connected and important.
Organisations should have appropriate processes to identify AI systems, assess their risks, review suppliers and understand how personal information is being handled. These processes do not necessarily need to be complex or expensive. They should be proportionate to the organisation's activities and risks.
The objective is to ensure businesses can explain how technology is being used and demonstrate that their privacy practices reflect their actual operations.
Why IT, cybersecurity and legal support may not be enough on their own
One challenge for businesses preparing for the new transparency requirements is determining who within the organisation is responsible for assessing how AI and automated decision-making affect individuals.
Traditionally, organisations have relied on IT, cybersecurity and legal teams to manage technology, security and regulatory obligations. However, the new requirements involve more than technology security or legal documentation.
IT teams generally focus on implementing, maintaining and supporting technology. While they may understand how systems operate, they may not have visibility over how automated decisions affect individuals, eithics side of using AI or whether those decisions trigger privacy obligations.
Cybersecurity teams focus on protecting systems, information and infrastructure against security threats. These responsibilities are essential, but securing an AI system does not necessarily mean its use complies with privacy requirements or that its decisions are transparent.
Legal teams provide important advice on interpreting legislation, contractual obligations and regulatory requirements. However, legal advice does not always extend to reviewing how AI systems operate in practice, mapping personal information flows, assessing decision-making processes or implementing ongoing governance controls.
This can leave an operational gap and you may not even know it.
For example, a business might introduce an AI-enabled recruitment platform that has undergone a cybersecurity assessment and legal contract review. However, has anyone assessed:
Whether the platform uses personal information to make or substantially inform recruitment decisions?
Whether those decisions could significantly affect applicants?
How much influence the AI-generated recommendations have on the final decision?
Whether the organisation's privacy policy accurately explains those activities?
Who is responsible for reviewing the system when its functionality changes?
These questions require collaboration between technology, cybersecurity, legal, data protection officer (Privacy) and business teams.
This is where operational AI governance becomes important.
AI governance brings these responsibilities together by establishing processes to understand how AI is being used, assess its impact on individuals, assign accountability and maintain appropriate oversight. The objective is not to replace IT, cybersecurity or legal expertise. It is to ensure the organisation can translate regulatory requirements into practical business processes and demonstrate how those requirements are being addressed. As businesses adopt more AI-enabled technology, this coordination becomes increasingly important.
What guidance has the OAIC provided?
The OAIC has updated its Australian Privacy Principles guidance and published additional resources to support organisations preparing for the new requirements.
These include:
APP 1 Guidelines: Updated guidance explaining the transparency obligations and how they fit within existing privacy requirements.
APP 1.7–1.9 Transparency Obligation Fact Sheet: Practical explanations and examples of when the requirements may apply.
APP 1.7–1.9 Transparency Obligation Flowchart: A decision-making tool to support organisations in assessing whether their use of computer programs falls within scope.
Businesses should review these resources when assessing their obligations.
Final thoughts: AI adoption needs to be matched by transparency
AI and automated decision-making are becoming part of everyday business operations. However, adopting new technology also means understanding how it affects the people whose information is being processed and that responsibility ultimately sits with the business, its owners and its leadership.
Also, meeting the new transparency requirements is not simply a task for the IT team or CTO, cybersecurity (CISO) or legal teams. It requires an understanding of how automated systems operate within the business, what personal information they use, how they influence decisions about individuals and if it’s being used ethically This is where AI governance and privacy expertise can support organisations in turning regulatory obligations into practical, ongoing processes.
The changes taking effect on 10 December 2026 reinforce an important principle: individuals should be able to understand when computer programs are involved in decisions that significantly affect them. For Australian businesses, this is an opportunity to review how automated systems are being used, identify potential gaps and ensure their privacy policies remain accurate.
The starting point is not simply asking whether your business uses AI. It is understanding what your systems do with personal information and how they influence decisions about people.
How Hyplon supports businesses
At Hyplon, we support organisations in understanding their AI governance and privacy obligations, including reviewing how AI and automated systems are used across business operations. Our work includes AI governance assessments, privacy impact assessments, supplier due diligence, establishing AI governance strategies, providing advice to board members on their obligations and privacy policy reviews.
If your organisation is unsure whether the new automated decision-making transparency requirements apply, understanding your current systems and decision-making processes is a practical place to start.
Contact Hyplon: https://hyplon.com
Official OAIC resources
This article provides general information and does not constitute legal advice. Whether the requirements apply depends on an organisation's circumstances and the operation of the Privacy Act 1988 (Cth).
