Does the automated-decision privacy rule apply to your business?

From 10 December 2026, businesses covered by the Privacy Act must explain in their privacy policy when software or AI makes, or substantially and directly helps make, decisions that could significantly affect people. Answer four questions to see where you stand. General information, not legal advice.

What the new rule says

APP 1.7 applies when all three of these are true: your business has arranged for a computer program to make a decision, or to do something substantially and directly related to making it; the decision could reasonably be expected to significantly affect someone's rights or interests; and personal information about that person is used by the program.

When it applies, APP 1.8 says your privacy policy must describe three things: the kinds of personal information the programs use, the kinds of decisions made solely by the programs, and the kinds of decisions where a program does something substantially and directly related to making the decision.

What counts as a computer program and a decision

The regulator reads "computer program" broadly: rule-based software, AI and machine learning, generative AI tools and chatbots, and everyday apps. A decision includes refusing or failing to decide, and the effect can be good or bad for the person.

Examples the regulator gives of decisions that may significantly affect someone include granting or refusing a benefit under law, decisions about rights under a contract or arrangement such as an insurance policy, and access to a significant service or support such as healthcare. Whether an effect is significant depends on the person's circumstances, and it must be more than trivial.

Human review and third-party software

Having a person check the result does not by itself take a decision out of scope, and neither does a program that only handles part of the process. Using software just to record a human's decision, like a word processor, is not captured.

If a vendor's system makes or helps make the decision, your business is still the one that "arranged for" it. The regulator's examples include an AI tool that screens and ranks job applicants, software that automatically approves or declines refunds, a case system that auto-escalates complaints, and staff using an AI chat tool to draft assessments that decide promotions.

Who has to comply

The rule applies to businesses covered by the Privacy Act. Most small businesses with annual turnover of A$3 million or less are not covered, but some are regardless of turnover, including health service providers, businesses that trade in personal information, contractors under a Commonwealth contract, credit reporting bodies and AML/CTF reporting entities.

Sources

Need the paperwork done? The AI & Privacy Compliance Pack builds your automated-decision register and writes the privacy-policy wording.

Frequently asked questions

When does the automated-decision rule start?

On 10 December 2026. It applies to decisions made from that date, so privacy policies need the new information in place by then.

Does it apply if a person reviews the AI's result?

It can. The regulator says a decision may be in scope even when a computer program's output is reviewed by a person or does not replace the whole decision-making process.

Do chatbots and AI tools count?

They can. The regulator treats generative AI tools and chatbots as computer programs. Whether the rule applies depends on whether the tool makes, or substantially and directly helps make, a decision that could significantly affect someone, using their personal information.

My business turns over less than A$3 million. Does this apply to me?

Usually not, because most businesses at or under A$3 million turnover are not covered by the Privacy Act. Some are covered regardless of turnover, such as health service providers and businesses that trade in personal information. Check the OAIC small-business page if you are unsure.

Is this checker legal advice?

No. It is general information based on the regulator's published guidance. For advice about your situation, speak to a privacy lawyer or adviser.