The privacy regulator is about to spell out one of the trickier obligations from the 2024 Privacy Act changes, and it’s one plenty of Australian businesses haven’t clocked. From 10 December 2026, any organisation covered by the Privacy Act that uses personal information in automated decision-making — decisions made, or substantially made, by a computer program that could significantly affect someone’s rights or interests — has to say so in its privacy policy, including the kinds of personal information used and the kinds of decisions made. The OAIC’s consultation on how this works (submissions closed in June) wraps into formal guidance landing around now, ahead of the deadline.

Here’s why it matters more than it first appears. The obligation applies to APP entities — broadly, businesses with turnover above $3 million — but the trigger is the activity, not some big AI project you think you don’t have. Across the client environments we look after on the Northern Beaches and in Central West NSW, the pattern is the same: a business switches on an AI feature already baked into software it pays for — a Copilot in Microsoft 365, an automated approval or risk-scoring step in an accounting or lending tool, a booking system that quietly filters customers — and nobody asks whether it’s now making decisions about people. If personal information goes in and a meaningful decision comes out, you’re likely in scope, even if you never called it “AI”.

So do two things before summer. First, map where automated or AI-assisted decisions actually happen — pricing, credit and eligibility checks, fraud flags, rostering, anything that sorts or judges people. You can’t disclose what you haven’t found. Second, update your privacy policy to describe those systems in plain terms. Neither is a five-minute job, which is why starting now rather than late November is the sensible move.

Not sure what’s running under the hood, or whether that new AI toggle someone enabled counts? Talk to All IT Services — we’ll help you map where automated decisions are being made and get ahead of the December deadline.