From 10 December, you'll have to tell people when a machine helped decide.
From 10 December, Australian privacy law will require you to disclose where automated decision-making touches the people you deal with. Writing the paragraph is the easy part. Being able to answer the question behind it is the real work.
Someone applies for finance, or a job, or lodges a claim, and gets a no. They ring up to ask why. The person who answers the phone doesn't actually know, because a model did most of the sorting before a human ever saw the file. That isn't a scandal. It's how a fair few mid-market businesses already run.
From 10 December, that gap gets a legal edge to it.
The Privacy and Other Legislation Amendment Act 2024 added a new transparency obligation to the Privacy Act, and it commences on 10 December 2026. If your organisation is covered by the Australian Privacy Principles and you use a computer program to make, or to substantially shape, decisions that significantly affect people, you will have to say so in your privacy policy. The OAIC has put out an issues paper on how it will work, consultation closed in mid-June, and its guidance is due by September. So the shape of this is close to settled.
The trigger has three parts. A computer program makes a decision, or does something substantially and directly related to making it. The decision could reasonably be expected to significantly affect a person's rights or interests. And personal information is used along the way. Meet all three and your privacy policy has to describe:
• the kinds of personal information the program uses;
• the kinds of decisions made solely by the program; and
• the kinds of decisions the program substantially helps a person make.
It is worth being clear about what this is not. Unlike the European version, it does not give anyone a right to contest a decision, demand a human review, or be told personally. It is a transparency rule. You describe what you do, in language a normal person can follow, in a document most people never read. On its own, that is a small job.
The paragraph is the easy part
A lawyer can draft the privacy policy wording in an afternoon. That is not the work. The work is being able to answer the question sitting underneath it: where, exactly, does software touch a decision about a person in your business?
For most mid-market operators that is genuinely hard to answer, and not because anyone was careless. AI did not arrive as a project with a steering committee. It crept in, one tool at a time. The recruitment platform started ranking CVs. The lending workflow added a score. The support desk began routing and prioritising tickets on its own. Each one was a sensible upgrade bought for a sensible reason. Nobody sat down and drew the map of where, across all of it, a machine is now making or shaping a call about a human being.
So that is the job between now and December, and it is an operating job before it is a legal one. Walk the decisions that actually land on the people you deal with (who gets approved, hired, flagged, prioritised, declined) and for each one ask two plain questions. Is software making or shaping this? And could we explain how, in a sentence, to the person on the receiving end?
If the answer to the second question is no, the privacy policy is the least of your problems. You have a decision you cannot account for, and the regulation is just the thing that made you notice.
A document is cheap. Knowing is not.
This is the pattern with most of the AI governance turning up now. The compliance artefact (a policy, a disclosure, a register) is a document, and documents are cheap. Knowing where the machine touches your customers is a capability, and capabilities take a bit of work to build and a habit to keep. The businesses that find December easy will be the ones that already treat that as something worth knowing.
The deadline is doing mid-market Australia a quiet favour. It is forcing a question every operator should be able to answer anyway, the first time a customer asks it: did a person decide this, or did a computer? You do not want to be working that out in December. Work it out now, while it is still just good practice and not yet the law.