If Your Charity Uses AI to Make Decisions, New Rules Start in December

Here’s one that’s slipped under the radar for most not-for-profits. From 10 December 2026, any organisation covered by the Privacy Act that uses personal information in automated decision-making — an AI or computer program making, or heavily shaping, a decision about a person — has to spell that out in its privacy policy. It comes from the Privacy and Other Legislation Amendment Act 2024, and the privacy regulator is finalising its guidance now. You’ll need to disclose the kinds of personal information you use and the kinds of decisions the system makes.

Why this lands harder on NFPs than you’d think

Plenty of charities tell us “we don’t use AI to make decisions” — then describe exactly that. If your CRM auto-scores donors, your intake form triages who gets a callback first, or a tool pre-assesses hardship or eligibility before a staff member signs off, that’s automated decision-making. A human sign-off at the end doesn’t get you off the hook — the law captures systems “substantially and directly related to” a decision affecting someone’s rights or interests. For a group deciding who receives help, that bar is easy to clear. Many small NFPs still sit under the Privacy Act’s small-business exemption, but that’s squarely on the reform chopping block — so start now.

What to do before December

Start with an honest inventory. List every tool that touches personal information and flag anything that ranks, scores, filters or recommends — that’s your shortlist. For each, note in plain English what goes in and what decision comes out, then update your privacy policy to match. The regulator wants plain language, not legalese. It’s also worth confirming a real person can explain and overrule any automated call — “the computer said no” won’t wash with a funder, a board or a complainant.

It’s fiddly work for a lean back-office, and most of the not-for-profits we support around Brookvale, the Northern Beaches and out in Orange run on skeleton IT crews. If you’d like a hand mapping your systems and getting your policy sorted before the deadline, our not-for-profit IT team can walk you through it in about 20 minutes.