Your privacy policy now has to describe your AI

Beginning on 10 December 2026, Australian privacy policies must explicitly outline the use of automated decision-making processes. This requirement stems from the amendments to the Privacy Act, introduced through the Privacy and Other Legislation Amendment Act 2024. These changes affect all organizations classified as APP entities.

To ensure compliance, the Office of the Australian Information Commissioner (OAIC) released guidance material, including a fact sheet and flowchart, in response to 90 submissions from various stakeholders.

A computer program falls under the scope of these regulations if it utilizes personal information to make decisions, or contribute significantly to decision-making, about an individual. The decision may either be solely generated by the program or substantially influenced by a human. Regardless of whether the outcome positively or negatively impacts the individual, it is considered a decision that must be disclosed in the privacy policy.

This rule applies not only to artificial intelligence and machine learning but also to pre-programmed rule-based processes, as long as they meet the criteria.

The privacy policy must provide information on the types of personal data the programs utilize and the categories of decisions they are involved in. The guidelines differentiate between decisions made exclusively by the program and those where the program contributes to the decision-making process alongside human input. For instance, if a model ranks rental applicants and a property manager selects from the top five, the ranking algorithm must be disclosed.

Organizations must maintain accurate disclosures over time as AI systems evolve. This requires implementing a governed context layer that manages connections and rules dynamically. By centralizing the rules and approved connections in a shared layer, organizations can ensure their privacy policies remain current even after updates or swaps, such as model replacements or the introduction of new tools.

This approach helps prevent discrepancies between the documented system capabilities and actual operations, thereby maintaining compliance with the new regulatory requirements.