Automated decision-making examples: which tools does Australia's new rule cover?

The three questions

The rule applies to a tool when all three are true:

1. a computer program makes a decision, or does something substantially and directly related to making it;
2. the decision could reasonably be expected to significantly affect someone's rights or interests;
3. personal information about that person is used in running the program.

It also only applies to organisations the Privacy Act covers. Our free checker walks through these questions, and the 10 December rule explained covers the rule itself.

Tools that may be covered

"Computer program" is broad. According to the commentary on the OAIC's guidance, it covers rule-based tools, AI and machine learning, generative AI and chatbots, and everyday software including spreadsheets. Examples given in the guidance and commentary include:

• credit-scoring models used to approve or decline loan applications;
• insurance underwriting tools that analyse an applicant's personal information to set the price or terms of cover;
• recruitment software that screens or ranks job applications, where the obligation sits with the organisation that uses it, not the software supplier;
• a spreadsheet formula that scores and orders people, where the score is a key factor in a person's decision (the OAIC used a spreadsheet that triages callers as an example in its May 2026 issues paper);
• differential or personalised pricing for significant goods or services, and targeted job advertising.

Things that generally aren't

• using a word processor to write up a decision, or a spreadsheet to do arithmetic;
• a formula that only works out someone's age from their date of birth: related to a decision, but not substantially;
• a technology provider that only hosts the software or maintains the infrastructure it runs on. The obligation sits with the organisation using the tool.

A person checking the result doesn't take a tool outside the rule

Many organisations assume that because a person makes the final call, the rule doesn't apply. The guidance points the other way: where a program's output is a material input into a decision, it will generally be captured even with human oversight. The factors include how much people rely on the output, how likely they are to override it, and whether it's advisory or decides the outcome.

What "significantly affect" covers

Rights include legal rights. Interests include health, housing, finance, employment and utilities. Examples of decisions that may qualify include granting or refusing a benefit under legislation, decisions affecting rights under a contract, and decisions affecting access to a significant service or support. The guidance also asks whether a program produces materially different outcomes for a vulnerable group than for the general population.

How much detail the privacy policy needs

The privacy policy needs to describe the kinds of personal information these programs use, the kinds of decisions made by programs alone, and the kinds of decisions programs help make. According to the commentary, the guidance isn't prescriptive and doesn't appear to require technical detail. Decisions can be grouped into categories, but separate processes with different outcomes, purposes or data should be described separately, and sensitive information such as health or biometric information should be called out clearly.

The rule applies to decisions made from 10 December 2026, even where the personal information was collected earlier.

A practical way to find your tools

1. List the systems your organisation uses, including suppliers' software and automation added through updates over time.
2. For each one, ask the three questions above.
3. For those that qualify, note the personal information each uses and what its output is used for.
4. Ask suppliers how any automation built into their products works: the obligation sits with you as the user.
5. Draft the privacy policy wording, grouped into clear categories.
6. Review the list when you add a tool or change how one is used.

An AI tool inventory and a risk register make the first and third steps easier to keep up to date. Both are part of the AI Policy & Risk Pack.

Sources

• OAIC: APP 1.7–1.9 transparency obligation fact sheet
• Allens: Mandatory automated decision-making disclosure requirements are coming: key takeaways from the OAIC guidance (October 2026)
• Gilbert + Tobin: Automated decision-making transparency under the Privacy Act
• Hamilton Locke: Transparency in automated decision-making: what regulated entities need to know and do before December 2026

This article is general information, last checked against these sources on 30 October 2026. It isn't legal advice. For advice on your situation, speak to a qualified adviser.