Strategy
Australia’s AI privacy rules change on 10 December. Here’s what it means for your business.
01 · The obligation
Three conditions trigger the disclosure
The obligation is set out in new Australian Privacy Principles (APPs) 1.7 to 1.9, inserted by the Privacy and Other Legislation Amendment Act 2024.[2] It applies when all three conditions are met.[3]
01
A computer program is used
The program makes the decision, or performs a task substantially and directly related to it.
02
The effect is significant
The decision could significantly affect an individual’s rights or interests.
03
Personal information is involved
The program uses that individual’s personal information.
Where the conditions are met, the privacy policy must describe the kinds of personal information used and the kinds of decisions made. A refusal or failure to decide is itself a decision.[1]
The scope is broader than many organisations expect
Technology
The rule is not limited to AI
Rules engines and third-party software are also captured.
Human involvement
Assisted decisions are captured
A software output that is a key factor in a staff member’s decision may be covered.[3]
Legacy systems
Existing systems are included
Every decision made from commencement is covered, regardless of when the system was introduced.[4]
Accountability
Responsibility remains with the user
The obligation rests with the organisation using the program, not its supplier.[4]
The Office of the Australian Information Commissioner (OAIC) issued final guidance on 30 September 2026. It is widely read as confirming a broad scope that extends to decision-support tools and embedded technology.[5]
The small business exemption has limits
Most businesses with annual turnover of $3 million or less are exempt. Some are covered regardless of size.[6] These include entities with anti-money laundering and counter-terrorism financing (AML/CTF) obligations,[7] credit reporting bodies, Consumer Data Right-accredited businesses, entities related to a covered body corporate, and businesses that trade in personal information. Lenders, brokers and advisers should confirm their position against the OAIC checklist.
02 · Strategic context
Customers and regulators expect transparency
Transparency
89%
Want to know when their information is used in automated decisions about them (OAIC, 2023).[8]
Safeguards
96%
Want conditions in place before AI is used in decisions about them (OAIC, 2026).[9]
Acceptance
25%
Consider automated decisions such as loan approvals acceptable (OAIC, 2026).[9]
Financial services is directly in scope
Sector
Decisions that may be captured
Lenders and brokers
Credit scoring, serviceability assessments, automated declines
Insurers
Claims triage, fraud scoring, pricing
Wealth and advice
Risk profiling, suitability assessments
All sectors
Identity verification (KYC) and AML/CTF screening
Whether a given decision is captured requires case-by-case assessment and legal advice.
ASIC
ASIC found that licensees were adopting AI faster than they were establishing governance.[10]
APRA
Prudential Standard CPS 230 requires regulated entities to manage risk arising from material service providers.[11]
03 · Consequences
Non-compliance will be visible
No filing is required. However, privacy policies are public, so an omission is readily identified.
Individuals
Complaints
An individual who is refused a loan or claim may complain to the OAIC, which may investigate.[6]
Regulator
Compliance sweeps
In January 2026 the OAIC reviewed the privacy policies of approximately 60 organisations.[12] ADM disclosures are expected to receive similar scrutiny.[13]
Penalties
Infringement notices
Contraventions of APPs 1.3 or 1.4 attract notices of up to $21,840 each for most entities.[14]
Courts
Civil penalties
Serious interferences with privacy are subject to the tiered civil penalty regime introduced in 2024.[15]
A point for legal review
The OAIC’s list of infringement notice provisions does not name APP 1.7.[14] Organisations should seek advice on how a missing ADM disclosure would be treated.
04 · Implementation
Eight steps to compliance
The disclosure itself is brief. The substantive work lies in steps 2 to 4.
1
Confirm coverage under the Privacy Act.
2
Inventory systems. Ask suppliers which AI features are enabled by default.
3
Map decisions that each system makes or informs.
4
Assess significance. Identify decisions affecting finances, access to services or opportunities, including refusals.
5
Record the personal information each in-scope program relies on.
6
Draft the disclosure in plain English. Policy commitments can create legal obligations.
7
Review and publish before commencement.
8
Maintain it with a named owner and a scheduled review.
Steps 2 to 4 also produce a risk register with value beyond privacy compliance.
05 · Governance
Transparency strengthens governance
Can we explain how we make decisions about people?
Fairness
Errors become visible
A biased or faulty decision cannot be corrected until it is identified.
Trust
Clear disclosure differentiates
Organisations that explain their decision-making stand apart from those that do not.
Judgement
AI is deployed deliberately
AI is applied where it adds value, and people are retained where judgement is required.
Accountability
Ownership is clear
The disclosure process assigns accountability for the conduct of AI agents.
Next steps
Arrange an ADM readiness review
Navigator offers a 30-minute readiness review. We will identify the systems and decisions likely to be in scope and the disclosures your privacy policy may require. Participants receive our ADM inventory checklist.
Shammi Pant — Senior Principal, AI Advisory
Arrange a readiness review
Sources · References
Sources
General information only, not legal advice. Seek advice on how the requirements apply to you.
