Australia's Privacy Act automated-decision rules start on 10 December 2026

The OAIC's announcement of 30 September 2026, quoted.

APP 1.9, as the OAIC's APP 1 guidelines set out, adds that making a decision includes refusing or failing to make one, that doing a thing includes refusing or failing to do it, and that a decision may affect someone's rights or interests "whether the rights or interests of the individual are adversely or beneficially affected."

Wider than "AI". The OAIC's fact sheet names spreadsheets and chatbots alike.

The OAIC's fact sheet says a computer program includes:

• "pre-programmed rule-based processes"
• "artificial intelligence and machine learning processes"
• "software, apps or word-processing tools"
• "generative AI used to generate text, images, videos, code or synthesis, including chatbots."

Among the decisions the fact sheet says "would generally be considered in scope": recruitment software used to sort candidate profiles and make hiring decisions, computer programs used to approve or reject a loan or credit application, programs involved in assessing eligibility for insurance, and reports created by AI used to rank employee performance, determine promotions or decide pay.

For software vendors, the OAIC "generally expects that APP 1 transparency obligations typically remain with the APP entity who is using personal information", and that providers of third-party software "should provide clear, high-level information about how their software can be used to make decisions" so their customers can write their policies.

APP 1.7 to 1.9 are about what the privacy policy says. A record is how you know what to say.

The provisions quoted above set out what a privacy policy must describe. They do not, in the text quoted here, require a log of each decision. But an organisation cannot describe the kinds of decisions its programs make, or the kinds of personal information they use, without knowing what its programs actually do. When a customer complains or a regulator asks, a dated record of which agent decided what is easier to stand behind than a recollection.

• Which programs: every AI agent registered on APIR has signed papers and an owner, so the list of agents behind your disclosure is a list, not a guess.
• Which kinds of decisions: each agent's mandate says what it may and may never decide.
• What happened: the log book records each action and decision, hash-chained and timestamped nightly by an outside RFC 3161 authority, without sending your prompts or customers' words to APIR (only SHA-256 hashes, for an agent that runs outside APIR).
• When someone asks: an Evidence Pack seals one agent's record behind a link anyone can verify.

APIR does not give legal advice. Your own lawyer writes the disclosure; APIR keeps the record it rests on.

Not a checklist for compliance. The questions the OAIC's materials raise.

• Which computer programs have we arranged for, including procured, configured and off-the-shelf software, that make or substantially and directly inform decisions about people?
• Which of those decisions could reasonably be expected to significantly affect someone's rights or interests, including people experiencing vulnerability?
• What kinds of personal information does each program use?
• Which decisions does a program make on its own, and for which does it do a thing substantially and directly related to a person's decision?
• Is the human review we rely on "extensive human oversight and control", in the OAIC's words, or a click-through?
• If a customer or the OAIC asks what a program decided about someone, what record do we show them?

When do the Privacy Act automated-decision rules start?

On 10 December 2026. From that date APP 1.7 to 1.9, inserted into the Privacy Act 1988 by the Privacy and Other Legislation Amendment Act 2024, require privacy policies to describe certain decisions made or informed by computer programs. The OAIC published its guidance and a fact sheet on 30 September 2026.

What is APP 1.7?

The rule that triggers the disclosure. Per the OAIC, it applies if an entity has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, and personal information about that individual is used in the program's operation. APP 1.8 then lists what the privacy policy must contain.

What must the privacy policy say?

Per APP 1.8 as quoted by the OAIC: the kinds of personal information used in the operation of such computer programs, the kinds of such decisions made solely by the operation of such programs, and the kinds of such decisions for which a thing substantially and directly related to making the decision is done by the programs.

Does it apply if a human reviews the decision?

It can. The OAIC's fact sheet says a decision may be within scope "even where a computer program output does not replace the entire decision-making process or is subject to human review", and that machine learning or generative AI outputs used to make significant decisions would generally be in scope "unless subject to extensive human oversight and control."

Does it cover generative AI and chatbots?

Yes, as a computer program. The OAIC's fact sheet lists "generative AI used to generate text, images, videos, code or synthesis, including chatbots" alongside rule-based processes, machine learning and ordinary software.

Does APIR give legal advice on the Privacy Act?

No. APIR keeps a signed, tamper-evident record of what each AI agent did, which an organisation can draw on when it describes its automated decisions. The organisation's own lawyer writes the disclosure. Read the OAIC's guidance at oaic.gov.au.