Melbourne, Victoria Australia
Blog
AI Is Making Decisions in Your Business. From 10 December, You May Have to Say So
Somewhere in your business, software is probably already making calls about people. A CRM ranks which leads get a call back. A recruitment platform shortlists candidates. An online checkout flags an order as suspicious and cancels it. A chatbot decides whether a customer qualifies for a refund. Increasingly, an AI agent someone built in an afternoon is doing all of the above.
Until now, most Australian businesses have not had to tell anyone this was happening. That changes on 10 December 2026, when a new transparency obligation under the Privacy Act 1988 comes into force. With the Office of the Australian Information Commissioner (OAIC) publishing its final guidance on 30 September, there are now roughly eight weeks to get ready. Here is what is changing, who it affects, and a practical plan to be prepared before the deadline rather than during it.
What changes on 10 December 2026
The Privacy and Other Legislation Amendment Act 2024 added three new clauses to Australian Privacy Principle 1, the principle that governs your privacy policy. Under APP 1.7, an organisation covered by the Privacy Act must add information to its privacy policy when all three of these conditions are met:
1. A computer program is involved. The organisation has arranged for a computer program to make a decision, or to do something "substantially and directly related" to making a decision.
2. The decision matters. The decision could reasonably be expected to significantly affect an individual’s rights or interests.
3. Personal information is used. Personal information about that individual is used when the program runs.
When the test is met, APP 1.8 requires the privacy policy to describe:
• the kinds of personal information used by those programs;
• the kinds of decisions made solely by a computer program; and
• the kinds of decisions where a program does something substantially and directly related to the decision. And APP 1.9 confirms that "making a decision" includes refusing or failing to make one. An application that is automatically declined counts. So does a customer who is quietly never shown an offer.
This is not just about "AI"
The law talks about computer programs, not artificial intelligence. That is deliberate. A spreadsheet formula, a rules engine in your booking system and a large language model can all fall within scope if they meet the three conditions. In practice, though, AI is what is pushing far more businesses into scope, because it is now being embedded into everyday tools without anyone formally deciding to adopt it.
Some common examples worth checking in your own business:
| Where it shows up | What the software might be doing |
|---|---|
| Recruitment | Screening CVs, ranking applicants, deciding who is invited to interview |
| Sales & CRM | Scoring leads, deciding pricing tiers or payment terms for a customer |
| Credit & accounts | Approving trade accounts, setting credit limits, triggering collections |
| eCommerce | Flagging orders as fraudulent, blocking accounts, cancelling transactions |
| Bookings & tenancy | Accepting or declining bookings or applications based on a score |
| Customer service | Chatbots or AI agents deciding eligibility for refunds, returns or support |
| Workforce | Rostering, performance flags or monitoring outputs that inform HR decisions |
The fastest-growing risk is AI agents and automations built by individual staff. Connecting an AI model to your inbox, CRM and accounting platform takes minutes with modern tools. The obligation attaches to what the program does, whether or not anyone in the business noticed it was created.
Does it apply to your business?
The obligation applies to "APP entities", the same organisations already bound by the Privacy Act. As a general rule, that means businesses with an annual turnover above $3 million. However, some smaller businesses are covered regardless of turnover, including health service providers, businesses that trade in personal information, Commonwealth contracted service providers and businesses that have opted in to the Act.
Two cautions are worth noting. First, the small business exemption has not been abolished, despite what some online articles suggest, so check your actual position rather than assuming either way. Second, even if the December obligation does not apply to you, mapping how your systems make decisions about people is good governance, and your larger customers may start asking about it in contracts and supplier questionnaires.
Why it matters now
AI adoption among Australian small and medium businesses has moved quickly. NAB Economics research published in April 2026 found that 42% of Australian SMEs are already using AI, with a further 14% planning to adopt it. Much of that use sits in exactly the areas the new rule targets: customer service, sales and administration.
Regulatory attention is rising too. The OAIC ran its first privacy compliance sweep of business privacy policies in 2026, and the 2024 reforms gave it stronger enforcement tools, including infringement notices, compliance notices and a tiered civil penalty regime. A privacy policy that fails to include the required information can itself be a breach.
A practical six-step plan before 10 December
1. Build an inventory of your systems. List every platform, integration, automation and AI tool that touches customer, employee or applicant data, including third-party SaaS and anything staff have connected themselves.
2. Map the decisions. For each tool, record what it decides or recommends, about whom, and how much weight people give its output. Remember that refusing or not deciding counts.
3. Run the three-part test. Is a computer program involved? Could the decision significantly affect someone’s rights or interests? Is their personal information used? Flag everything that answers yes to all three.
4. Map the personal information. For each flagged system, note the kinds of personal information it uses. This becomes the basis of your privacy policy wording.
5. Check your vendors. Using a third party’s engine does not shift responsibility. If you arranged for the program to inform your decision, the obligation sits with you. Ask vendors what their tools do and what data they use.
6. Update your privacy policy, then keep it current. Work with your legal adviser on the wording, publish before 10 December, and put a simple review process in place so new AI tools are assessed before they go live.
What the rule does not require
• It does not ban automated or AI-driven decisions.
• It does not require you to publish source code or reveal commercially confidential details of how a system works.
• It does not require individual notices for each decision. The federal obligation is a privacy policy disclosure.
It does, however, require you to actually know where these systems are and what they do, which for many businesses is the hard part.
How Techloom can help
Most of the work behind this obligation is technical, not legal. You cannot describe your automated decision-making until you know what is running across your systems, what data it touches and how it connects. Our AI & Business Automation team helps Melbourne and Australian businesses audit existing tools and integrations, document where automation influences decisions, and design new AI workflows with transparency and human review built in from the start.
Because privacy obligations sit alongside security, we also review how these systems store and protect personal information as part of our Cyber Security Solutions. For the final privacy policy wording, we work alongside your legal adviser rather than replacing them.
If you are not sure what is making decisions in your business, get in touch and we will help you find out before 10 December.
