The 10 December Privacy Deadline: Does Your Privacy Policy Need an AI Clause?
On 10 December 2026, Australian businesses covered by the Privacy Act have to start doing something most of them have never done: explain, in their privacy policy, where software is making or shaping decisions about people.
That sounds like a job for the big banks and insurers. It is not only theirs. If your business screens job applicants with software, approves payment plans automatically, lets a chatbot handle refunds, or uses AI to rate staff performance, you may be in scope too.
The good news: the regulator has now told us exactly how it reads the rule. The Office of the Australian Information Commissioner (OAIC) released its final guidance on 30 September 2026. This post turns it into plain English, shows you which everyday tools are likely caught, and gives you a checklist and a sample clause structure to work from.
Quick answer: From 10 December 2026, businesses covered by the Privacy Act must explain in their privacy policy when software makes, or is a key factor in, decisions that could significantly affect a person using their personal information. That includes AI and simple rule-based tools. A human approving the result does not automatically take you out of scope.
What actually changes on 10 December
The change sits in Australian Privacy Principle 1, the principle that governs your privacy policy. It was added by the Privacy and Other Legislation Amendment Act 2024 and switches on two years later, on 10 December 2026.
It is a transparency rule, not a ban. Nothing stops you using AI or automation. You just have to be upfront about it.
The rule is triggered when all three of these are true:
You have arranged for a computer program to make a decision, or to do something substantially and directly related to making one.
The decision could reasonably be expected to significantly affect someone's rights or interests.
Personal information about that person is used when the program runs.
If all three are true, your privacy policy must describe:
Your privacy policy must cover | In plain English |
|---|---|
The kinds of personal information used by those programs | What data feeds the tool (for example contact details, financial history, employment history) |
The kinds of decisions made solely by a program | Where software decides with no person involved |
The kinds of decisions where a program does something substantially and directly related to the decision | Where software recommends, scores or ranks, and a person relies on it to decide |
That third row is the one most businesses miss, and it is where AI assistants live.
What the OAIC's final guidance made clear
The OAIC consulted through 2026, received 90 written submissions, and on 30 September published an updated APP 1 guidelines chapter, a fact sheet and a decision flowchart. You can read the OAIC's APP 1 guidelines directly. Here is what matters for a small or mid-sized business.
Question | What the OAIC says |
|---|---|
Does it only cover AI? | No. "Computer program" includes rule-based processes, AI and machine learning, ordinary software and apps, and generative AI including chatbots |
What about a human in the loop? | A decision can still be in scope even when the program's output is reviewed by a person. Advisory outputs count as well as determinative ones |
What about ChatGPT-style tools? | Machine learning or generative AI outputs used in significant decisions will generally be in scope unless subject to "extensive human oversight and control" |
We bought it from a vendor. Is it their problem? | No. Buying, configuring or relying on a third-party program still counts as you having "arranged for" it |
What counts as "significantly"? | More than trivial, with potential to considerably influence the person's circumstances or outcomes. Vulnerable people raise the stakes |
Only bad outcomes? | No. The rule covers decisions that benefit or disadvantage someone |
How much detail? | Plain language, meaningful to a reasonable person, no source code. You can group decisions into categories, but call out sensitive data such as health or biometric information |
What if we are unsure? | The OAIC's advice is to take a cautious approach and include the information |
That last line is worth sitting with. When the regulator says "if in doubt, disclose", the cheapest path is a clear, honest paragraph now rather than an argument later.
Who has to comply
The rule applies to APP entities, the organisations covered by the Australian Privacy Principles. In broad terms that means:
businesses with annual turnover above $3 million,
some smaller businesses regardless of turnover, including health service providers, businesses that trade in personal information, and contracted service providers to the Australian Government, and
Australian Government agencies.
If you are under $3 million and none of the exceptions apply, the rule may not bind you yet. Two cautions before you relax. First, removing the small business exemption has been on the reform agenda for years. Second, larger customers increasingly push privacy obligations down to their suppliers by contract. Check your position with your adviser, and if you are close to the line, build as though the rules apply.
Is your business in scope? A reality check
The OAIC's fact sheet lists decisions it would generally treat as in scope, including recruitment software sorting candidates, AI reports ranking employee performance or setting bonuses, loan and credit approvals, insurance eligibility, differential pricing for significant goods, prioritising health or disability services, and facial recognition for watchlist matching.
Here is how that maps onto tools a typical Australian business actually uses. Treat this as a risk view, not a legal ruling. Your answer depends on how each process works in your business.
What your business does with software | Likely in scope? | Why |
|---|---|---|
Software screens, scores or ranks job applicants | High | Employment opportunities are named by the OAIC as significant |
AI rates staff performance or informs pay and promotion | High | Named in the OAIC's list of in-scope decisions |
Automatic approval or decline of credit, payment plans or finance | High | Access to credit and financial support is significant |
Pricing that changes per customer for significant goods or services | Medium to high | Differential pricing is specifically called out |
Fraud or risk tools that block accounts or orders | Medium to high | Losing access to a service can be significant, especially for vulnerable people |
Chatbot or automation that approves or declines refunds and complaints | Medium | Depends on the value and what happens if it says no |
Patient, client or job triage using a spreadsheet score | Medium to high | The OAIC's own example of a caught spreadsheet is health triage |
AI drafts emails that a person reviews and sends | Low | Software is helping write, not deciding about anyone |
AI meeting notes and summaries | Low | Unless the summary drives a decision about a person |
Marketing copy, social posts, internal reports | Very low | No decision about an individual |
The pattern: the more a tool sorts, scores, filters or approves people, the more likely it is caught. The more it drafts or summarises for a person who genuinely decides, the less likely.
"We only use ChatGPT for a few things"
This is where most businesses get caught off guard, and it is rarely the official tools that cause the trouble.
A manager pastes ten resumes into an AI chat and asks for the top three. A team leader asks AI to rate staff comments ahead of a performance review. Someone uploads a customer's hardship request and asks whether to approve it. None of these went through IT. All of them are software doing something substantially related to a decision about a person, and your business arranged for it simply by letting it happen.
You cannot disclose what you do not know about. That is why the first step below is an honest inventory, and why a short written AI policy matters as much as the privacy policy itself. Our guide on what not to paste into ChatGPT covers the staff side of this.
What an AI clause in your privacy policy looks like
The OAIC does not publish a model clause, and your wording needs to fit your actual processes. But the structure is consistent. A good automated decisions section usually has four parts:
A plain heading, such as "How we use automated tools and AI in decisions".
The kinds of decisions, grouped sensibly, and split into decisions made fully by software and decisions where software helps a person decide.
The kinds of personal information each group uses, with sensitive information named clearly.
How to ask questions or seek a review, so a person can follow up or challenge the outcome.
Here is an illustrative example of the shape, for a hypothetical services business. It is not legal wording and should not be copied as is:
We use automated tools, including AI, to help with some decisions that may affect you. Our recruitment software helps us shortlist job applicants using information you provide, such as your work history, qualifications and responses to screening questions. A member of our team makes every hiring decision. Our payment system automatically approves or declines payment plan requests using your account history and payment records. If you would like more information, or want a decision reviewed by a person, contact our Privacy Officer.
Notice what it does: it names the decision, the data, whether a person is involved, and how to ask for a review. It does not explain the algorithm or name the vendor. That is the balance the OAIC is asking for.
Your six-week checklist
From the time this post goes live there are about six weeks until 10 December. That is plenty of time to do this properly, and not much time to do it in a panic.
Inventory every tool that touches personal information. Recruitment, HR, finance, CRM, booking, chatbots, spreadsheets with formulas, AI assistants. Include tools staff set up themselves.
Run each one through the three tests. Does it make or substantially shape a decision? Could that decision significantly affect someone? Does it use their personal information?
Ask your vendors directly. The OAIC expects software providers to give you clear, high-level information about how their product makes or informs decisions. Ask: does it score, rank, filter or approve people? On what data? Is any of it fully automated?
Decide where a person genuinely decides. For each high-risk process, write down who makes the call, what they look at, and that they can and do override the tool.
Draft the clause in plain English. Use the four-part structure above. Group decisions sensibly and name sensitive data clearly.
Get it checked. Have a privacy lawyer review the wording against your actual processes before you publish.
Lock in a review rhythm. New automations get switched on quietly. Check quarterly what has changed, and update the policy when it does.
This is general information, not legal advice. Confirm your obligations with a privacy lawyer.
The regulator is already reading privacy policies
This is not a theoretical risk. In January 2026 the OAIC ran its first ever privacy compliance sweep, checking the privacy policies of around 60 businesses across six sectors and flagging infringement notices of up to $66,000. Privacy policies are now the front door the regulator checks first. From 10 December, the automated decisions section is part of that front door.
Why this is an advantage, not just a cost
Every customer, candidate and staff member is going to start asking the same question: "Did a computer decide this?"
The business that can answer calmly, in one clear paragraph, with a named person accountable for every decision that matters, earns trust. The business that has to go and find out ends up handling a complaint.
The work that makes you compliant is also the work that makes AI safe and useful: know what your tools do, keep people on the decisions that matter, and let software take the grind. If you have not yet put a written AI policy in place, start with our guide on how to write an AI policy for your business. In property management, where tenancy screening raises the stakes, our property manager guide to the automated decisions rule goes deeper.
Frequently asked questions
When does the automated decision-making rule start? 10 December 2026. From that date, businesses covered by the Australian Privacy Principles must include the required information about automated decisions in their privacy policy.
Does my privacy policy need an AI clause? If your business is covered by the Privacy Act and uses software, including AI, to make or substantially shape decisions that could significantly affect people using their personal information, yes. If you are unsure, the OAIC recommends taking a cautious approach and including the information.
Does a human approving the decision take us out of scope? Not automatically. The OAIC says a decision can be in scope even when a person reviews the output. What matters is whether the software is a key factor in the decision. Generative AI outputs used in significant decisions are generally in scope unless subject to extensive human oversight and control.
Does the rule apply to simple software and spreadsheets, or just AI? Both. The OAIC reads "computer program" broadly, covering rule-based processes, ordinary software, apps, machine learning and generative AI. A spreadsheet formula that scores people for priority can be caught.
Do we have to explain how our algorithm works? No. You must describe the kinds of personal information and the kinds of decisions in plain language. Commercially sensitive information and trade secrets are excluded, though embarrassment is not a reason to leave something out.
Does this apply to small businesses? Generally only to businesses covered by the Privacy Act: those with turnover above $3 million, plus some smaller businesses such as health service providers and businesses that trade in personal information. Check your position with an adviser.
What if our software vendor makes the decisions? The obligation stays with your business. Buying, configuring or relying on a third-party program counts as you arranging for it. Ask your vendor for the information you need to disclose.
Get it sorted before the deadline
If you want a clear view of which of your processes are caught, where AI can safely save your team hours, and what to fix first, book a 60-minute AI Game Plan Session. You walk away with a written summary, a real return on investment number, yours to act on, with or without us.
Third Vision helps Australian businesses put AI to work safely, backed by 25 years in IT and security. AI agencies don't know security. IT firms don't know growth. We do both. See how our Fractional AI Officer service delivers Your AI Growth Department, with governance built in from day one.
