Transparency is the watchword for the 2026 Automated Decision Making Disclosure Requirements in Australia. When 10 December 2026 comes around, any organisation under the Privacy Act 1988 will be expected to put in their privacy policy an account of when they are making substantially automated decisions on the basis of personal information that could have a legal or other significant bearing on an individual.
Put simply, where an algorithm or artificial intelligence is part of an important decision concerning someone, it should be clear to all concerned that there is automation at work, how the decision is arrived at and on what information. In this guide Evelyn Marlowe sets out the rules and the pitfalls as well as the course of action open to Australian organisations.
What is in store for Australian Organisations
Do not assume the new obligation requires a place in the privacy notice for every instance of artificial intelligence. The focus is on those decisions that are substantially automated, use personal data and carry a legal or otherwise significant effect for the person in question. See these AI marketing privacy guidelines for related context.
The difference is material. One does not put an AI that composes an internal email in the same league as a system that has the power to deny a loan, bar someone from a service or rule on eligibility for a benefit. It is for compliance teams to judge by the result rather than the name of the technology.
The Core Rule
Relevant privacy policies must now make some description of automated decision-making practices, as per the Privacy and Other Legislation Amendment Act 2024. What is required is for the policy to set out in meaningful terms the nature of the decisions, the type of personal information employed and the workings of the process.
View it as a matter of transparency. There is no licence here to amass information without limit and the old duties around security, accuracy, access and correction are not abrogated.
Nor should an organisation rely on a privacy policy as some kind of talisman; if the decision is of a serious nature, a general pronouncement lost in a lengthy document is of little use to the consumer. A distinct notice or an explanation tailored to the decision would be better.
Applicable Privacy Laws
For any automated decisions that involve personal information the framework is still the Privacy Act 1988 and the Australian Privacy Principles. The Office of the Australian Information Commissioner is the federal administrator and source of guidance for government and private sector alike.
The new requirements are in addition to what is already in place. An organisation has to ask itself if the information was lawfully obtained and used for its purpose, and if it has been safeguarded against unauthorised access or misuse. Those do not just vanish with the introduction of automation.
Australian Privacy Principles
APP 1 is of prime importance in the open and transparent handling of personal information and is where one will find the privacy policy disclosure on relevant automated decisions.
Then there is APP 5 on notification of collection. Should an organisation be gathering information for a system capable of a significant automated decision, the collection notice has to be plain enough for the individual to grasp the consequences and purpose.
Under APP 10 the quality of the data is the issue. Before it is put into an automated system, an organisation ought to think about how it is vetting the information, since substandard data can lead to unfair or discriminatory results.
There are other principles to consider as well covering such matters as sensitive information, use and disclosure, and access. The right approach will be dictated by the organisation, the system and the decision.
For up to date privacy resources from the regulator see the privacy guidance of the Office of the Australian Information Commissioner.
A Case for Disclosure
One has to determine if an individual is affected in a legal or significant way by a decision that is for the most part automated. Having a human hit an approval button is not tantamount to a genuine human decision.
An algorithmic recommendation is not always going to call for the same level of disclosure either. There is a world of difference between a system for the routing of low risk administrative work and one that is deciding on credit, housing, employment or insurance.
Defining Significance
In legal terms an effect may be the creation or denial of rights or obligations. But a significant effect is a wider concept, encompassing anything with serious repercussions for a person’s standing, reputation, finances or access to services. One will not find in the legislation a tidy list with every qualifying decision put on a label. It is for organisations to make an assessment of the context and the person’s situation, to consider what an error might do and to judge the real impact.
Take an automated system for putting customer-service tickets in rank order: its direct impact is minimal. But an automated fraud score that has the effect of locking an account or denying a customer his essential funds is another matter altogether, even were the system to be called a “risk-ranking tool” within the organisation.
Substantial Automation Matters
There can be substantial automation in a decision despite some human presence in the workflow. If all a person does is put his name to a result from the system without any examination of the information behind it, one cannot say there is meaningful judgment at work.
In the course of a compliance project I was involved in, looking over the automated workflow descriptions revealed how frequently “human oversight” amounted to no more than a manager hitting the approve button; hardly a review in any meaningful sense. For the reviewer to have grounds to question the result he must have the time, the authority, the independence and the information to do so.
What An AI Disclosure Should Explain
A disclosure is of use if it puts things in plain Australian English for the ordinary person to comprehend, and is up to date and accurate, without making him feel the need for a computer-science degree or a billy of coffee. The wording is dictated by the system but a sensible approach would be to address these points.
| Disclosure area | What to explain | Practical example |
|---|---|---|
| Use of automation | That a substantially automated process is at work with personal information | Applications are put through an automated eligibility system |
| Types of information | The sort of personal information being used | Account activity, identity details, income or a history of transactions |
| Decision type | What the system is making or supporting | Be it ranking, approval, suspension or refusal |
| Effect on the person | The legal or otherwise significant bearing of the decision | It could determine whether a service or credit is available |
| Meaningful logic | The main factors and process in plain terms | Eligibility rules are applied to stated income and repayment history |
| Human involvement | Whether a review takes place and what it can alter | A trained assessor will look at relevant evidence and may see fit to change the outcome |
| Challenge options | Access, correction or further explanation can be had | The process and contact details for a request for reconsideration |
By “meaningful information about logic” we do not mean you should be publishing source code or commercially sensitive security controls, let alone confidential model weights. Nor is it enough to put down “we use artificial intelligence to assess your application”, which while technically correct is of no practical value.
How To Update Privacy Notices
Make an inventory to begin with of all systems, including those from technology vendors and contractors, that use personal information to restrict, prioritise, score, approve or refuse people. Another company may run the software but the responsibility for the outcome lies with the organisation.
Then put the data flow on paper. Where did the information come from, what goes into the system, who has access to the output and is the result handed off to someone else? How long is it kept?
Privacy Policy Improvements
Under a catch-all for “business purposes” is no way to deal with the categories of automated decisions a privacy policy ought to identify. The broad logic should be set out in a manner that holds up when the rules or the model are altered.
And provide a contact pathway that makes sense. Someone who thinks inaccurate data has coloured a decision should not be put to the task of sifting through a website as though he were a traveller on the Stuart Highway in want of a working dunny.
Any new model, a change in the data or the review process, or an expansion in the decision’s impact calls for a policy review. Put down the date and who is accountable for it.
Collection Notice Improvements
When personal information is collected, the notice should state the purpose. Do not wait until the form is in before revealing that the information will underpin an important automated decision.
Be direct and use examples and short headings. Make clear if the system is giving a final outcome, a preliminary score or a recommendation; they are not the same and the consumer is entitled to know.
As for AI marketing privacy guidelines, have the claims tally with the legal notices. To put forward a system as “fully human reviewed” when in practice the staff seldom trouble to challenge it is to invite a transparency issue.
High-Impact Decisions Need Controls
While “high impact automated decisions Australia” is a handy phrase for compliance, it would be unwise for an organisation to think there is a statutory definition that fits every industry and high-impact decision alike. One is better served by singling out those decisions with the potential to have a serious effect on an individual and putting in place more rigorous controls.
Take employment, lending or insurance as cases in point; also housing, essential services, education, immigration and important account access. Any of these can be high-impact, particularly if the decision is predicated on sensitive data, results in an outright refusal or leaves the person with little recourse to put up a challenge.
Human Review That Works
There is no blanket right to human review of an automated decision under Australian law. Yet for any matter of consequence, it is a sensible precaution and one that may be called for by other legal or contractual duties, sector rules or house policy. An effective review must give the reviewer the means to put right any errors and alter the outcome after having seen the pertinent information and the rationale behind it. The system should not be given a rubber stamp.
Bias, Accuracy And Security
One should test for bias and discrimination in the relevant groups and see if proxy variables, old decisions or absent data are leading to inequitable results. Be especially circumspect with information that might disclose a person’s health, religion, political views, ethnicity or other protected matters.
Then there is the question of record keeping. Put down in writing all testing, approvals, model changes, incidents and complaints. This will stand an organisation in good stead to account for itself if a decision is put to the test, and it is better to uncover any process shortcomings than have a regulator, court or journalist do so.
Practical Compliance Checklist
Australian organisations of any size, from a small business on a vendor platform to a large entity with multiple in-house models, will find this checklist of use in getting ready for the 2026 disclosure requirements.
- Make a list of all processes, automated or AI-assisted, that draw on personal information.
- Note which decisions are of a legal or significant nature.
- Put aside for record the source and retention of the information used, and who has access to it.
- Determine if the system is recommending, supporting or making the final call on an outcome.
- Have a look at the privacy policies and the wording at collection.
- In plain terms set out what drives the main decisions.
- Lay down the powers and escalation routes for human review and document the training.
- Run tests for security risks, accuracy and any form of bias or discrimination.
- Have a procedure in place for complaints, access, correction and to have things reconsidered.
- Record any review decisions, incidents and model changes.
- Look over your vendor contracts as to audit rights and notification duties.
- Name an owner who is to be held to account and put a date on the review prior to 10 December 2026.
Mistakes That Are Made
It is rarely a case of an organisation being tripped up by a loose use of the term “AI”. More often it is because the decision process has not been mapped from start to finish.
Some will make the error of supposing their obligations are met by a vendor’s privacy statement. A supplier can tell you how its platform operates but the onus is on the organisation to make clear to those affected by its decisions why it is using that platform.
Do not hold out the prospect of a human review your staff are not in a position to deliver. Do not mistake mathematics for objectivity in a model or statistical accuracy for fairness. There are systems that will be accurate in the aggregate yet deliver substandard results for some groups.
Who this guide is for
We have put together this guidance for any organisation under the Australian privacy framework making use of personal information in its automated decision-making or assessments. You will find it of particular interest if you are in a compliance or human-resources role, or a privacy officer, legal adviser, product manager or head of technology.
For a business whose only recourse to AI is the low-risk business of document formatting, translation or drafting and which does not make decisions on individuals from personal data, this is of less concern. Though one should not forget that the usual obligations around security, confidentiality and privacy hold.
Frequently Asked Questions
What do the Australian Privacy Principles demand of an organisation using personal information in an automated fashion?
Compliance with the 1988 Privacy Act is a must. And as of 10 December 2026 there will be further disclosure requirements for any substantially automated decision of a legal or otherwise significant nature.
Is a business in Australia obliged to put out a disclosure when AI is making a decision?
Disclosure is not called for in all instances. It comes down to whether a substantially automated decision is being made with a significant or legal effect and personal information is part of it. If so, the new rules mean the organisation has to be forthcoming in its privacy policy with meaningful detail on the logic, the type of decision and the data at hand.
In what way does the new obligation for automated decision making manifest?
It is incumbent on relevant privacy policies to set out in some detail those decisions that are substantially automated and involve personal information. The explanation of how the process works in general terms and what information is put to use must be of substance.
The contents of an AI privacy notice
A good notice will cover the automation in play, the sort of personal information used and the types of decisions and their probable impact on the individual, as well as the principal factors or logic behind them. A review pathway or point of contact should be offered where it makes sense.
How would one define a high-impact automated decision?
Any decision with the potential to have serious repercussions for a person’s employment, housing, education, finances, access to services or other interests and rights. Do not be guided by the system’s own nomenclature; look at the consequences in the real world.
Are Australian firms required to have a human in the loop?
No blanket rule exists for human review of every automated decision. But for anything of a serious nature, having a human provide a meaningful review is sound governance. That reviewer needs the authority to put right any errors and alter the result.
A word on compliance
Organisations in Australia would be well advised to see the matter of disclosing automated decisions as a transparency project of substance and not something to be tacked on to the privacy policy at the eleventh hour. Make an inventory of your data and significant outcomes, map them, test for any unfairness, put in place a workable review process and explain the logic.
Those that can give a straight answer to “How has this system impacted me and what redress is there if it is wrong?” will fare better. With an answer that is clear and on the record, the path to compliance is a good deal smoother.