Australia's new automated-decision transparency duty begins on 10 December 2026. Its practical test is which computer programs use personal information to make, or directly shape, decisions that significantly affect individuals.
Observed facts: the December trigger is about decisions
From 10 December 2026, Australian Privacy Principle (APP) entities must add specified information about automated decisions to their privacy policies where three conditions are met. The entity has arranged for a computer program to make a decision, or do something substantially and directly related to making it; the decision could reasonably be expected to significantly affect an individual's rights or interests; and personal information about that individual is used in operating the program [1][2]. The duty was enacted in the Privacy and Other Legislation Amendment Act 2024 and is still prospective as at 27 September 2026 [1][2].
The law reaches more than decisions made entirely by software. APP 1.8 separately asks for the kinds of decisions made solely by computer programs and the kinds for which a program performs a substantially and directly related step [1]. A human signing off at the end therefore does not, by itself, settle whether a process is in scope. The July 2026 analysis by Ashurst Perkins Coie notes that rules-based tools, scoring systems and spreadsheet automation may matter alongside machine learning [4].
Observed facts: what a privacy policy must describe
For a covered process, the privacy policy must describe the kinds of personal information used, the kinds of decisions made solely by a program, and the kinds of decisions for which a program does something substantially and directly related to making the decision [1][2]. The statute expressly includes refusing or failing to make a decision and says a decision can affect an individual beneficially as well as adversely [1]. Its examples include access to a statutory benefit, rights under a contract, and access to a significant service or support [1].
This is a disclosure duty tied to a defined decision process, not a blanket requirement to list every piece of software in a public policy. The threshold is whether the expected effect on rights or interests is significant and whether the program uses that person's personal information [1][2]. The OAIC's May issues paper seeks views on interpreting those boundaries, including what counts as a substantially and directly related step and how significance should be assessed [2]. Those consultation questions are evidence of an unresolved interpretation, not a final exemption or safe harbour.
Observed facts: guidance points to an inventory
The National AI Centre's implementation guidance, published in May 2026, calls for an organisation-wide inventory of AI models and systems. It lists purpose, accountable people, data provenance, risk assessments, test results and review dates among the useful fields [3]. It also recommends documenting how users and affected stakeholders will be told about AI-enabled decisions, and obtaining information from suppliers that is needed for transparency [3]. These are guidance practices; they do not expand the statutory APP trigger to every AI deployment.
The privacy regulator has kept the deadline visible. In a September 2026 speech, the OAIC said privacy policies will need information about substantially automated decisions that significantly affect individuals' rights or interests, including the kinds of decisions and personal information used [5]. The OAIC also said it would shortly release guidance following consultation [5]. Until that final guidance is available, organisations can map processes against the enacted text while recording any classification questions for review [1][2].
Where a business process may cross the line
Consider a service application that uses an automated score to rank applicants before a staff member approves or rejects access. If personal information drives the score and that ranking substantially and directly shapes access to a significant service, the process may meet the APP conditions even though the final click is human [1][2][4]. The same logic could apply to a rules-based system that determines eligibility under a contract. These are illustrations of the statutory test, not conclusions about any named organisation or product.
Conversely, a tool that merely formats a document or summarises general market data may not satisfy the personal-information and significant-effect conditions [1]. The distinction depends on the actual workflow: what data enters the program, what it produces, how much that output influences the decision, and what is at stake for the individual. Ashurst Perkins Coie also notes that arrangements with third-party providers may need examining because the entity can arrange for an external system to support a decision [4].
Oakhampton inference: inventory the decision path
Oakhampton's inference is that the first useful deliverable is a decision-path inventory, rather than a generic statement that an organisation uses AI. For each potentially consequential workflow, record the decision, the individual affected, the personal-information categories used, the program's specific contribution, the human review point, and the accountable owner [1][3]. That map makes it possible to distinguish a solely automated decision from one materially supported by software and to draft the corresponding policy wording [1].
A second pass can test whether the decision could reasonably be expected to significantly affect rights or interests, with reasons recorded for both inclusions and exclusions [1][2]. The National AI Centre's recommended system register and supplier-information practices offer a practical structure for that exercise [3]. Where a vendor's role is opaque, requesting the data flows and decision logic relevant to the process is more useful than relying on a product label such as 'assistant' or 'AI-powered' [3][4].
Remaining uncertainty
The exact boundary of a step that is 'substantially and directly related' to a decision is fact-specific, and the OAIC consulted on that question in May [2]. The same is true of whether an effect is significant for a particular person or service. The regulator's announced final guidance had not been identified in the sources reviewed for this article as at 27 September 2026 [2][5]. Any final wording should be checked against guidance when issued, as well as the enacted APP clauses [1].
The new clause requires transparency in a privacy policy; it does not itself establish a general right to an explanation of every automated output or make every use of AI unlawful [1][4]. Existing privacy, consumer and other obligations may apply independently, but their reach depends on the particular facts [3]. This article describes the published framework and a way to organise evidence, rather than making a legal assessment for any entity.
Sources
- Privacy and Other Legislation Amendment Act 2024, Schedule 1 Part 15Federal Register of Legislation · 10 December 2024
- Automated Decision-Making Transparency Obligation (APP 1): Issues PaperOffice of the Australian Information Commissioner · 18 May 2026
- Guidance for AI adoption: implementation guidanceNational AI Centre · 5 May 2026
- Automated decisions in Australia series: a quick guide to new privacy rulesAshurst Perkins Coie · 13 July 2026
- AFIA Risk Summit speechOffice of the Australian Information Commissioner