On 10 December 2026, the requirement for APP entities to disclose their use of AI and automated decision-making comes into effect. New guidance will assist entities to put the finishing touches on their compliance strategies in the lead up to the obligation commencing. 

This obligation arises under Australian Privacy Principles (APPs) 1.7 – 1.9, which require APP entities to include information about their use of computer programs in their privacy policies. These new APPs were introduced under the Privacy and Other Legislation Amendment Act 2024 (Cth) as part of the first tranche of significant privacy reforms. Consultation on the second tranche of reforms is now underway.

The Office of the Australian Information Commissioner (OAIC) recently released guidance on these changes, including an updated version of Chapter 1 of the OAIC APP Guidelines, two fact sheets¹ and a step-by-step flow chart (together, the Guidance Material), which will no doubt assist entities implementing changes to meet their obligations ahead of this deadline.

The Guidance Material takes a broad view of the disclosure obligation. It provides examples, many of which are likely to be helpful to entities when deciding upon a disclosure approach.

This article provides an overview of the key points from the Guidance Material and sets out key action items APP entities should undertake to meet their obligations.

1. When does it start and who will it apply to?

APPs 1.7 – 1.9 commence on 10 December 2026 and apply to every APP entity, including private sector organisations and government agencies (for which OAIC has issued a supplementary fact sheet).

The transparency obligations are triggered where the following three conditions are met:

1. the entity has “arranged for” a computer program to make a decision, or to do a thing that is substantially and directly related to making a decision; 
2. the decision could reasonably be expected to significantly affect the rights or interests of an individual; and 
3. personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.

Where there is doubt about whether a computer program is in scope, the OAIC recommends taking a cautious approach and including the required information in the privacy policy. 

2. The scope and application of APP 1.7 – 1.9 is broad

The Guidance Material treats “computer programs” and “decisions” as broad concepts. It clarifies that “computer programs” include AI (including machine learning and generative AI, including chatbots) and also includes pre-programmed rule-based processes and ordinary software, apps and word-processing tools. Even a spreadsheet formula used to rank individuals may be caught. “Decisions” cover not only the making of a decision but also failures or refusals to act. A decision may be within scope even when the computer program does not replace the entire decision-making process, or it is subject to human review.

The Guidance Material states that entity may have “arranged” for a computer program if it uses in-house software, procures a third-party program, configures off-the-shelf software, authorises a computer program to make determinative decisions, or relies on advisory outputs. The guidance emphasises that “arrangements” include outsourcing arrangements.   

Interestingly, the Guidance Material gives as an example a situation in which an employer permits or directs employees to use an AI chat tool to draft performance assessments that determine promotion decisions. This implies that permitted use as well as directed use of a computer program will, in the OAIC’s view, be caught by the disclosure requirement. It is important for entities to review policies and contractual obligations relating to use of computer programs to ensure that they prohibit any uses which are not appropriate, or which the entity does not wish to publicly disclose as part of its privacy policy.

Whether a computer program is substantially and directly related to making a decision turns on whether the program is a key factor in the human’s decision (“substantially”) and has a direct connection with the decision (“directly”). This includes where it in any way influences the outcome of a process, regardless of whether the output is advisory or determinative.   The guidance makes it clear that a use of a computer program output may be within scope even where humans review or participate in the decision making process.

The Guidance Material suggests that entities consider the following factors when considering whether a computer program is doing a thing substantially and directly related to making a decision: 

• The extent of reliance on the computer program output; 
• The ability and likelihood of human override of the computer program output;
• Whether the output is advisory or determinative;
• The extent to which the decision maker has visibility of what the computer did and why; and
• The complexity of the computer program and the extent to which it is integrated into the workflow.

For a decision to significantly affect the rights or interest of an individual, the impact must be more than trivial and have the potential to considerably influence an individual’s circumstances. The OAIC has adopted a broad interpretation of a right to include moral as well as a legal rights to have or be able to do something, including social and economic rights (eg. to housing, food, healthcare etc) and civil and political rights.

Examples provided by OAIC’s of decisions within the scope of transparency obligations include:

• decisions in relation to benefits under legislation; 
• decisions affecting rights under a contract, agreement or arrangement (eg. a life insurance policy); and
• a decision affecting access to a significant service or support (eg. healthcare).

Specific examples given include:

• facial recognition technology used for watchlists matching in retail stores and stadiums;
• differential or personalised pricing practices used by online retailers in the sale of significant goods; and 
• computer programs used to prioritise the provision of health or disability services.

3. What the privacy policy must contain

APP entities within the scope of the transparency obligations must disclose the following information in their privacy policy:

1. the kinds of personal information used in the operation of such computer programs;
2. the kinds of such decisions made solely by the operation of such computer programs; and
3. the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs.

Disclosures should be understandable and tailored to the entity’s circumstances, avoid overwhelming technical detail, and be structured so individuals can request further information and the decisions can be reviewed. Entities may group decisions and types of personal information into categories, but the detail must be meaningful to a reasonable person. Use of sensitive information, such as health information or biometric templates, should be made clear. 

There is a carve out for commercial-in-confidence information. This covers commercially sensitive information and trade secrets. The OAIC takes the view that this carve out applies only if release of the information could harm an APP entity’s commercial interests. 

4. Key action items before 10 December 2026

APP entities should take the following steps as a priority:

1. Map all computer programs (not just AI tools) that do a thing which is directly related to one or more decisions with the potential to significantly affect the rights or interests of individuals.
2. Ensure going forward that vendor contracts require vendors to provide any information needed for privacy policy disclosures. 
3. Obtain any information required from vendors for disclosure.
4. Update privacy policies before the commencement date. Where the position is unclear, adopt a cautious approach and disclose. 

The OAIC’s Guidance Material provides welcome clarification of the breadth of the new transparency obligations. With 10 December 2026 approaching entities will need to assess relevant matters promptly to meet the new disclosure requirements in time.

1. ^

   APP 1.7-1.9 Transparency Obligation and ADM Transparency Obligation