Is your business ready for new AI transparency obligations?

From 10 December 2026, new Australian Privacy Principles will require covered organisations to disclose certain uses of computer programs that make or inform significant decisions about individuals.

New OAIC guidance signals that organisations should start preparing now.

How confident are you that your organisation understands where automated tools, AI systems or software applications influence decisions about individuals?

DO THE TRANSPARENCY OBLIGATIONS APPLY TO YOU?

The OAIC has identified three key questions to help organisations determine whether the new automated decision-making transparency obligations apply.

Before an organisation is required to disclose information about automated decision-making in its privacy policy, it should consider whether all three threshold requirements are met.

FIRST QUESTION

Has your business arranged for a computer program to make or do a thing that is substantially and directly related to making a decision?

What is a “computer program”? 

Broadly defined and intended to take its ordinary meaning. This may include commonly-used software, apps, word-processing tools, and Generative AI tools.  It is how a tool is used, not just what it is called, that matters.

What is a “decision”?

Broadly defines and captures any action, inaction, recommendation or outcome (including a refusal or failure to act). A human in the loop is not a cure-all. A program may still be covered if its output substantially facilitates, guides or influences the human decision-maker.

What is “substantially and directly related” to making a decision?

This refers to computer programs have a direct connection and are a key factor in facilitating the decision. Importantly, the OAIC’s Guidelines state that a decision may still be covered even if a computer program does not make the final decision. If the computer program's output substantially facilitates, guides or influences the human decision-maker, the transparency obligations may still apply.

SECOND QUESTION:

Does the computer program use personal information about the individual to make or do a thing that is substantially and directly related to making a decision?

What if your organisation is not directly “using” the personal information in the computer program?

The obligation is not limited to situations where your organisation develops or controls the technology itself. An organisation may still be responsible where personal information is used by a third-party platform, software provider or AI tool as part of a decision-making process.

In many cases, the transparency obligations will remain with the organisation that relies on the computer program to make, support or inform decisions that significantly affect an individual's rights or interests, even where the software vendor controls the underlying technology, algorithms or system parameters.

This means organisations should understand not only what decisions are being made, but also how third-party systems use personal information when generating recommendations, scores, rankings, assessments or other outputs that influence those decisions.

THIRD QUESTION:

Could the decision significantly affect the rights or interests of an individual?

What is the threshold for a decision to significantly affect an individual’s rights or interests? 

This must be assessed objectively. The OAIC provides a non-exhaustive list of potentially significant rights and interests, including access to health services, education, housing, employment, insurance, financial assistance/credit, government benefits and essential goods or services. Noting that an individual’s circumstances, including any vulnerability they may be experiencing, should also be considered.

WHAT NOW?

If the answer to all three questions is yes, your organisation is likely to be subject to the new transparency requirements and should begin identifying and documenting relevant automated decision-making activities. 

By 10 December 2026, your privacy policy must cover:

• the kinds of personal information used in the operation of such computer programs;
• the kinds of such decisions made solely by the operation of such computer programs; and
• the kinds of decisions for which something substantially and directly related to the decision is done by a computer program.

Such disclosures should be meaningful, understandable and appropriately structured. Generic or vague transparency statements will not be sufficient to satisfy the obligation.

YOUR ACTION PLAN

Four key steps to take before 10 December 2026

1. Audit your automated decision-making processes: Identify where computer programs, whether developed in-house or supplied by third parties, use personal information to make decisions about individuals or perform functions that are substantially and directly related to those decisions.
2. Engage with your technology providers: Obtain a clear understanding of how third-party tools use personal information and influence decision-making. Review existing contracts to ensure they include appropriate information-sharing, audit and notification obligations, and consider whether additional warranties or compliance protections are required.
3. Update your privacy policy before 10 December 2026: Prepare clear and meaningful disclosures describing relevant automated decision-making activities, the types of personal information used, and the kinds of decisions to which those activities relate.
4. Review governance, policies and staff practices: Update acceptable use, AI and technology governance policies to address the use of AI and other automated tools in significant decision-making. Ensure staff understand when these tools may trigger transparency obligations and establish appropriate oversight and approval processes.

Or simply contact Jackson McDonald’s Privacy & Data Governance team if you would like assistance preparing for the new requirements. We can help you review your automated decision-making practices, assess your compliance position and risk profile, evaluate vendor arrangements, and prepare privacy policy disclosures that align with the new transparency obligations. Engaging early can help identify potential compliance gaps and ensure your organisation is ready ahead of the 10 December 2026 commencement date.

This article was written by Ariel Bastian, Special Counsel, Corporate Commercial.