From 10 December 2026, the Australian Privacy Principles require an entity's privacy policy to disclose where a computer program makes — or substantially helps make — decisions that could significantly affect someone's rights or interests. This page sets out the exact statutory test, the three things that must be disclosed, what the obligation does not say, and what to do between now and the commencement date.
The Privacy and Other Legislation Amendment Act 2024 inserts new paragraphs into Australian Privacy Principle 1 — the principle that governs what an entity's privacy policy must contain. The obligation is a transparency requirement, and it is written around the words computer program, not the word "AI".
A privacy policy must include information about automated decisions where the entity "has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision", the decision "could reasonably be expected to significantly affect the rights or interests of an individual", and "personal information about the individual is used in the operation of the computer program".
Making a decision includes refusing or failing to make one, and rights or interests may be affected whether adversely or beneficially. A system that automatically declines, defers or silently screens out is inside the test, not outside it.
Quoted from the Act as made, which is published under a Creative Commons Attribution licence. The full text is linked in the sources below — read it yourself rather than relying on any summary, including this one.
All four limbs must be satisfied. This is the assessment most organisations have not done — not because it is difficult, but because nobody has listed the systems that make or shape decisions about people.
| # | The limb | What it means in practice |
|---|---|---|
| 1 | You are an APP entity | The Privacy Act covers you. Whether it does is settled by the Act's own coverage rules, not by this obligation — check that question first if you are unsure. |
| 2 | You have arranged for a computer program to make a decision, or to do a thing substantially and directly related to making one | Two limbs in one. The second is the wide one: a program that scores, ranks, filters, flags or recommends can be doing something substantially and directly related to the decision even though a person signs it off. |
| 3 | The decision could reasonably be expected to significantly affect an individual's rights or interests | Credit, employment, eligibility, access to a service, pricing that materially changes what someone pays, allocation of support. Beneficial effects count as well as adverse ones. |
| 4 | Personal information about the individual is used in the operation of the program | If the program runs on information about identifiable people, this limb is met. It does not matter whether that information came from the individual or from somewhere else. |
APP 1.8 is specific about what goes in the policy. Note the word running through all three: kinds. This is a disclosure about categories, not a publication of models, source code or thresholds.
What categories of personal information those programs operate on — not a field-by-field data dictionary, but an honest description a reader can understand.
Where no person is in the loop at the point of decision. These are the ones organisations most often cannot name without checking.
The human-in-the-loop cases: a person decides, but a program did something substantially and directly related to that decision. Easy to overlook, and squarely inside the requirement.
Several things are being repeated about this change that the text does not support. Being precise here matters: over-reading it wastes money, under-reading it misses systems.
The Act says computer program. A rules engine, a scoring spreadsheet, an eligibility check inside a line-of-business system or a workflow automation can meet the test with no machine learning anywhere near it. Scoping this to "our AI tools" is the most likely way to miss something.
APP 1.7 to 1.9 are about what a privacy policy must contain. They do not prohibit automated decision-making, require a human to re-decide, or create an individual right to an explanation of a particular decision.
The requirement is to disclose kinds of information and kinds of decisions. It is not a demand for model documentation, weights, thresholds or source code.
The disclosure has to be accurate when the obligation commences. The work that takes time is not the wording — it is knowing which systems meet the test, and being able to show how you reached that conclusion.
| When | What |
|---|---|
| 10 December 2024 | The Privacy and Other Legislation Amendment Act 2024 receives Royal Assent. The automated-decisions amendments sit in Schedule 1 with a delayed commencement. |
| 18 May 2026 | The OAIC opens consultation on guidance for transparency in automated decision-making, publishing an issues paper. |
| 15 June 2026 | Submissions to that consultation close. |
| 30 September 2026 | The OAIC publishes resources on the APP 1.7–1.9 transparency obligation (a fact sheet, a supplementary fact sheet for government agencies and a flowchart) and updates Chapter 1 of its APP Guidelines to version 2.0. |
| 10 December 2026 | The obligation commences — 24 months after Royal Assent. Privacy policies of affected entities must contain the APP 1.8 information. |
The OAIC's guidance helps with how the disclosure is worded. It does not change which of your systems meet the statutory test. That question you can answer now, and it is the part that takes the longest.
Across every system, not just the ones labelled AI: core line-of-business platforms, add-on modules, automations, spreadsheets that have quietly become infrastructure, and supplier-operated services that decide or score on your behalf.
Record the answer and the reasoning, not just a yes or no. The reasoning is what lets you defend the scope later, and what stops the assessment being redone from scratch every year.
For each in-scope program: the kinds of personal information it uses, and whether it decides alone or substantially contributes. These descriptions become the privacy policy text.
Plain language, accurate on the day it commences, and consistent with what your systems actually do — a policy that describes a process nobody follows is a worse position than no policy at all.
New systems and changed systems move in and out of scope. Without an owner and a review cadence, the disclosure is accurate once and drifts from there.
An AI management system aligned with ISO/IEC 42001 is not required by the Privacy Act. It is the structure that makes this and the obligations after it routine: a register, an owner, an assessment process and evidence you can produce on request.
No. The Act says computer program, not AI. A rules engine, a scoring spreadsheet, an eligibility check inside a line-of-business system or a workflow automation can meet the test even though nobody calls it AI. Using AI is not the trigger; using a computer program to make, or to do something substantially and directly related to making, a decision about a person is.
APP 1.8 requires three things: the kinds of personal information used in the operation of those computer programs; the kinds of decisions made solely by them; and the kinds of decisions for which a computer program does something substantially and directly related to making the decision. It is a disclosure of kinds, not of source code or model detail.
Not under this obligation. APP 1.7 to 1.9 are transparency requirements about what a privacy policy must contain. They do not, by themselves, prohibit automated decisions, require human review, or create an individual right to an explanation of a particular decision.
Yes. On 30 September 2026 the OAIC published resources on the APP 1.7–1.9 transparency obligation (a fact sheet, a supplementary fact sheet for government agencies and a flowchart) and updated Chapter 1 of its APP Guidelines (version 2.0). The guidance helps with how to describe the decisions; it does not change which of your systems meet the statutory test.
We cite primary sources only — legislation and regulator publications. No blogs, no consultant commentary, no law-firm summaries. If you want to challenge anything above, these are the documents to open.
| Statement on this page | Primary source |
|---|---|
| The wording of APP 1.7, 1.8 and 1.9; the four limbs; "refusing or failing to make a decision"; "adversely or beneficially"; Royal Assent and the 10 December 2026 commencement | Privacy and Other Legislation Amendment Act 2024 (Cth), No. 128 of 2024, Schedule 1 — Federal Register of Legislation |
| Consultation status, the issues paper of 18 May 2026 and the closing date of 15 June 2026 | Consultation on guidance for transparency in automated decision-making — Office of the Australian Information Commissioner |
| The OAIC's transparency resources of 30 September 2026, and Chapter 1 of the APP Guidelines (version 2.0), including that "computer program" covers rules-based processes as well as AI and machine learning | New resources on transparency for use of AI and automated decision-making — OAIC · APP Guidelines, Chapter 1 — OAIC |
| Who the Australian Privacy Principles apply to | Privacy Act 1988 (Cth) — Federal Register of Legislation |
| ISO/IEC 42001 as an AI management system standard | ISO/IEC 42001:2023 — referenced by clause. We do not reproduce the standard's text; it is copyright ISO/IEC and available for purchase from ISO or Standards Australia. |
Where we could not verify something against a primary source, we have not asserted it. Notably: we summarise the statute and point to the OAIC's guidance rather than paraphrasing it, so read its resources directly for the regulator's view; we state no view on penalties or enforcement approach; and nothing on this page is legal advice — the coverage question and the wording of your policy are matters for your own advisers.
That is the question the obligation turns on, and it is answerable now. We run the assessment across your real systems — including the ones nobody calls AI — record the reasoning behind each decision, and give you the descriptions your privacy policy needs, in plain language, from a BSI-certified ISO/IEC 42001 Lead Implementer.