The AI you use to decide things about customers now has a deadline

The most consequential AI development for Australian businesses this month did not come from OpenAI or Anthropic. It came from Canberra, quietly, on a consultation page.

On 15 June, consultation closed on the Office of the Australian Information Commissioner's draft guidance for transparency in automated decision-making. That guidance interprets a change to the Privacy Act that commences 10 December 2026 — and it applies to far more businesses than most owners assume.

What the rule actually says

From 10 December, a new Australian Privacy Principle (APP 1.7) requires you to disclose in your privacy policy when you use a computer program to make — or substantially help make — a decision that "could reasonably be expected to significantly affect an individual's rights or interests."

"Significantly affect" is broad. The legislation's own examples include decisions that grant or refuse benefits, affect contractual rights, or change someone's access to a significant service. Approving a loan. Pricing an insurance quote. Screening a rental application. Ranking job candidates. Flagging an account for closure.

If AI sits anywhere in that chain, your privacy policy must spell out three things: the kinds of personal information the program uses, the decisions made entirely by automation, and the decisions where automation substantially assists a human.

Why this matters more than another model launch

Most Australian small and medium businesses now run at least one tool that quietly makes or shapes decisions about customers — a CRM lead score, an automated approval flow, a fraud flag. Few have read the fine print on what their software does with personal information, and almost none mention it in a privacy policy.

That gap is now a compliance exposure. The OAIC can issue infringement and compliance notices, and non-compliant privacy policies attract civil penalties. There is no soft-launch grace period written into the provisions.

Our take

This is not a reason to rip out your AI tools. It is a reason to do an inventory. Before December, list every tool that touches a customer decision, ask the vendor what personal information it processes, and have your privacy policy redrafted to match. The businesses that treat 10 December as a paperwork deadline will be fine. The ones that discover it in January will not.

We will publish a plain-English checklist for non-technical owners before the deadline. For now: if you can't answer "which of our tools makes decisions about customers," that is the question to take into July.

This is general information, not legal advice. For decisions with compliance consequences, consult a qualified Australian privacy lawyer.

Sources: Office of the Australian Information Commissioner, draft guidance on transparency in automated decision-making (consultation closed 15 June 2026); Privacy and Other Legislation Amendment Act, APP 1.7–1.9, commencing 10 December 2026, as analysed by Johnson Winter Slattery, "Practical implications of the new transparency requirements for automated decision making."