On 30 September 2026 the privacy regulator released its guidance on a rule that starts in just over two months. The OAIC automated decision making guidance explains what businesses must add to their privacy policies from 10 December 2026.
If your business uses software to make, or help make, decisions about people, this is worth ten minutes of your time. Here is what the guidance says, in plain English, and what to do about it.
What the OAIC released
The Office of the Australian Information Commissioner (OAIC) is the national privacy regulator. It updated its guidelines on Australian Privacy Principle 1, and published a fact sheet and a flowchart.
The rule itself is not new. Parliament passed it in 2024. What is new is that we now know how the regulator reads it.
In short, the rule covers decisions that could significantly affect a person. From 10 December 2026, a business covered by the Privacy Act must say in its privacy policy when a computer program makes those decisions, or plays a key part in them. The policy must describe the kinds of decisions and the kinds of personal information used.
Who the OAIC automated decision making guidance applies to
It applies to businesses the Privacy Act already covers. Most businesses with an annual turnover of $3 million or less are still exempt. There are exceptions, such as health service providers.
The small business exemption has not been removed. You may have read otherwise, but no law has passed and no date has been set.
One group should check carefully. On 1 July 2026, real estate agents, accountants, lawyers and conveyancers became reporting entities under the anti-money laundering rules. If that is you, the Privacy Act now applies to the personal information you handle for those obligations. Our guide to the December 2026 change explains who is covered.
Five things the guidance makes clear
1. It is not just about AI
The law says computer program, and the OAIC reads that broadly. It includes AI and chatbots, but also apps, rule based systems and everyday software. One of the OAIC’s own examples is a spreadsheet that scores and ranks people for a service.
So the question to ask is not whether you use AI. It is whether any software plays a key part in decisions about people.
2. A human signing off does not take you outside the rule
Many owners assume they are fine because a person makes the final call. The guidance says otherwise. If the person relies on the program’s score or recommendation, the program is still playing a key part.
The OAIC gives the example of a panel that uses a computer ranking of applicants. The decision is still covered, even though the panel can overrule the ranking.
3. Software you buy, and tools your staff use, both count
The duty sits with the business that arranged for the program to be used. Buying a supplier’s software does not pass the duty to the supplier.
It also covers tools you allow staff to use. The OAIC’s example is an employer who lets staff use an AI chat tool to draft performance assessments that feed into promotion decisions. That is a good reason to know which tools your team uses. Our earlier piece on the policy gap created when staff use ChatGPT covers this.
4. Whether a decision is significant depends on who it affects
A decision is covered if it could significantly affect a person’s rights or interests. That means more than a trivial effect, and it can be good or bad for the person.
The OAIC asks businesses to think about vulnerable people. A decision that is minor for most customers can be significant for someone who depends on the service.
5. Plain language is expected, and secrecy is a narrow excuse
Your privacy policy should be clear and meaningful to an ordinary reader. You can group similar decisions together. You do not need to explain how the software works.
You can leave out real trade secrets. But the OAIC says information is not secret just because it might be embarrassing. And if you are unsure whether something is covered, the OAIC suggests taking the cautious path and including it.
Examples the OAIC uses
The guidance and fact sheet include examples of decisions that are covered. They include:
- Recruitment software that sorts or screens job applicants
- Scoring rental applications
- Approving or declining loans, credit and insurance
- Software that automatically approves or declines refunds
- Charging different prices to different customers based on their details
- Ranking employees for pay rises or promotion
- Suspending a customer’s account
Using a word processor to type up a decision you made yourself is not covered.
What this means for a small business
Take a real estate agency. Many agencies use a tenancy application platform that scores or ranks applicants. That score uses personal information, and it shapes who gets the property. On the OAIC’s reading, it is very likely covered, even though the property manager makes the final choice.
The same thinking applies to a clinic that uses software to prioritise patients, or a lender that uses a tool to pre-assess applications.
The first job is the same for everyone: find out which of your tools help make decisions about people. Our article on building an AI system inventory explains how to start.
What to do before 10 December
- Check whether the Privacy Act applies to your business
- List the software and AI tools you use, including tools staff have picked up themselves
- Mark any that score, rank, approve, decline or recommend something about a person
- Decide which of those could significantly affect someone
- Add a clear section to your privacy policy and have it reviewed and approved
- Review your privacy policy at least once a year, as the OAIC recommends
For the step by step version, with example wording, see our practical guide on how to update your privacy policy for automated decisions. Our earlier article on the Privacy Act AI disclosure requirements gives the background to the law.
Questions business owners are asking
Is this a new law?
No. The law passed in 2024 and starts on 10 December 2026. The guidance explains how the regulator will read it.
We only use AI to write emails and social posts. Are we affected?
Probably not for those uses. Writing an email is not a decision that significantly affects a person. It is still worth checking your other software.
Our software supplier says their product is compliant. Is that enough?
No. The duty to update your privacy policy is yours. Ask the supplier for a plain description of what their tool does with personal information, then write your own section.
What if we are exempt as a small business?
Then this rule does not bind you today. Knowing which tools shape decisions about people is still good practice, and larger clients are starting to ask about it.
4 thoughts on “OAIC Automated Decision Making Guidance: What It Means”