> ## Content Index
> Fetch the complete content index at: https://www.theaidirectory.com.au/llms.txt
> Use this file to discover other available public pages before exploring further.

# The OAIC has said what the 10 December AI rule means. If AI shapes big decisions about people, you're in.
- URL: https://www.theaidirectory.com.au/news-oaic-adm-guidance-australia-2026/
- Published: 2026-10-22T23:00:00.000Z
- Updated: 2026-10-22T19:39:51.000Z
- Description: From 10 December 2026, your privacy policy must explain how software helps you make significant decisions about people. The OAIC's final guidance reaches further than most expect.
- Author: Adam
- Tags: News, Regulation & Policy, #news

**Posted:** 23 October 2026 · **Category:** News

> **TL;DR:** The OAIC published its final guidance on the new automated decision rule on 30 September. From 10 December 2026, if software helps you make a significant decision about a person using their personal information, your privacy policy must say so. A quick human sign-off probably won't take you out of scope.

## What changed

The rule sits in APP 1.7 to 1.9 of the Privacy Act and starts on 10 December 2026\. Our June posts covered the [rule](https://www.theaidirectory.com.au/news-oaic-adm-transparency-australia/) and the [draft guidance](https://www.theaidirectory.com.au/privacy-act-automated-decision-making-transparency-2026/). The guidance is now final.

Three points stand out:

- **Chatbots can count.** The OAIC's definition of a computer program names generative AI, "including chatbots". It matters when the output shapes a significant decision about someone.
- **Light human review is not an exit.** AI outputs used in significant decisions are generally in scope "unless subject to extensive human oversight and control". Genuine scrutiny, documented, can change that.
- **The duty generally stays with you.** Vendors should give you "clear, high-level information". You write the disclosure.

## What to do by 10 December

The OAIC's in-scope examples include recruitment software that sorts candidates, loan and credit approvals, insurance eligibility and online retailers' personalised pricing of significant goods. If an AI tool helps you make decisions like these, your privacy policy must cover:

1. The kinds of personal information those programs use.
2. The kinds of decisions they make on their own.
3. The kinds of decisions they substantially and directly help a person make.

You can group these by decision type, but the detail must be meaningful to a reasonable person. Flag sensitive inputs such as health information or face scans. Commercially sensitive detail is excluded. Unsure if a tool is in scope? The OAIC says take a cautious approach and include it.

Small businesses with annual turnover of $3 million or less are generally exempt from the Privacy Act. Health service providers, businesses that trade in personal information and some others are covered regardless.

## Does this change our recommendation?

Yes, for any recruitment, lending or insurance tool you use to decide about people. Before you renew, ask the vendor for a plain-English description of what the tool decides and which data it uses. No answer by December is a risk you carry. Our June posts stay up unchanged, for the record.

This is general information, not legal advice. It doesn't replace qualified professional advice for your business.

## Sources

1. OAIC, "New resources on transparency for use of AI and automated decision-making", 30 September 2026\. https://www.oaic.gov.au/news/media-centre/new-resources-on-transparency-for-use-of-ai-and-automated-decision-making. Wayback: https://web.archive.org/web/20261022192011/https://www.oaic.gov.au/news/media-centre/new-resources-on-transparency-for-use-of-ai-and-automated-decision-making. Read 23 October 2026.
2. OAIC, APP 1.7-1.9 Transparency Obligation Fact Sheet, September 2026, pp. 1-5\. https://www.oaic.gov.au/\_\_data/assets/pdf\_file/0021/269013/APP-1.7-1.9-Transparency-Obligation-Fact-Sheet.PDF. Wayback: https://web.archive.org/web/20261022192018/https://www.oaic.gov.au/\_\_data/assets/pdf\_file/0021/269013/APP-1.7-1.9-Transparency-Obligation-Fact-Sheet.PDF. Read 23 October 2026.
3. OAIC, APP Guidelines Chapter 1, paras 1.35-1.36 and 1.67-1.72\. https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-1-app-1-open-and-transparent-management-of-personal-information. Wayback: https://web.archive.org/web/20261022191039/https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-1-app-1-open-and-transparent-management-of-personal-information. Read 23 October 2026.
4. OAIC, Small business. https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business. Wayback: https://web.archive.org/web/20261022191045/https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business. Read 23 October 2026.
5. Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024), Schedule 1 Part 15\. https://www.legislation.gov.au/C2024A00128/asmade/text. Read 23 October 2026.