Find the automated decisions in your software.

From 10 December 2026, an organisation covered by the Privacy Act that uses a computer program to make a decision about a person, or to do something substantially and directly related to making it, has to say so in its privacy policy when the decision could significantly affect that person’s rights or interests and the program uses their personal information. The Office of the Australian Information Commissioner (OAIC) published its guidance on 30 September 2026, with an update to its APP 1 Guidelines. Its definition of a computer program covers rule-based processes, AI and generative AI, and human review doesn’t automatically take a decision out of scope. So the first job is an inventory: where does software, including the software you already license, inform decisions about people?

This article sets out what the OAIC’s APP 1.7–1.9 transparency obligation fact sheet says, and how to build that inventory before December. It isn’t legal advice: your privacy lawyer decides what your policy says.

When the obligation applies

The fact sheet lists three conditions, and all three must hold:

• the organisation has arranged for a computer program to make a decision, or to do a thing that is substantially and directly related to making it;
• the decision could reasonably be expected to significantly affect the rights or interests of an individual;
• personal information about that individual is used in operating the program.

Where an organisation is unsure, the fact sheet says to take a cautious approach and include the information in its privacy policy.

What counts as a program and a decision

The OAIC reads “computer program” broadly. Its list includes pre-programmed rule-based processes, AI and machine learning, software, apps and word-processing tools, and generative AI used to produce text, images, video or code, including chatbots. A spreadsheet formula that ranks clients counts: the fact sheet’s first example is exactly that.

A decision includes choosing to act or not to act, and failing or refusing to do something. In the same spreadsheet example, using the ranking to decide whom not to contact is still in scope.

“Arranged for” reaches well beyond software you build. The fact sheet’s examples include procuring a third-party program, configuring or customising off-the-shelf software, and relying on a program’s advisory outputs.

Human review isn’t an exit

The fact sheet is direct about this:

A decision may be within scope of the transparency obligation even where a computer program output does not replace the entire decision-making process or is subject to human review.

A program is substantially related to a decision where it is a key factor in the person’s decision, and directly related where it has a direct connection to it. The OAIC says machine learning or generative AI outputs used to make decisions that significantly affect people “would generally fall within scope of the transparency obligation unless subject to extensive human oversight and control”.

Its third example shows where the line sits. Managers use a generative AI tool’s suggested bonus and salary adjustment as a key factor in remuneration decisions, with HR oversight and director sign-off, and that is in scope. If staff interrogated the outputs, reviewed the underlying indicators, narrowed the tool’s parameters, used other evidence and recorded why they diverged from its suggestion, that “could indicate” the output wasn’t substantially related to the decision. The difference is what reviewers actually do, and whether you can show it.

What the policy has to say

Under APP 1.8, the policy names three things:

• the kinds of personal information used in operating those programs;
• the kinds of decisions made solely by them;
• the kinds of decisions where a program does something substantially and directly related to making them.

The OAIC’s flowchart walks through the same tests. The fact sheet allows grouping, provided the detail is meaningful to a reasonable person, and asks that more sensitive information, such as health information or biometric templates, be clearly identified. Commercial-in-confidence information about a program, such as how it weights its inputs, doesn’t have to be disclosed. The fact that personal information is used for a purpose such as fraud detection does.

The obligation generally stays with the organisation making the decision, not the vendor whose software it uses. The OAIC says software providers should give clear, high-level information about how their software can be used to make decisions, so their customers can write their policies.

Decisions the OAIC names

The fact sheet’s non-exhaustive list of decisions it generally considers in scope includes:

• recruitment software that sorts candidate profiles and makes hiring decisions;
• programs that approve or reject a loan or credit application, or assess eligibility for insurance;
• programs that prioritise health or disability services;
• AI-generated reports used to rank employee performance or decide promotions, bonuses or pay;
• programs that decide eligibility for a government benefit, housing assistance, education or training;
• differential or personalised pricing for significant goods.

An inventory you can finish by December

A useful inventory has one row per feature, not per system, because one platform can hold several features that touch decisions. For each row:

1. The decision. Name the decision about a person the feature informs: a credit limit, a rental application shortlist, an appointment priority, a performance rating, a fee waiver.
2. The feature, and how it was switched on. Built in-house, procured, configured in a licensed platform, or added by a vendor update. Vendors add AI features through updates, so check the current plan, not the original contract. Our What you already pay for checker lists the AI features in common Australian business software, with each vendor’s published information.
3. Its role. Does the output decide, advise or otherwise influence the outcome? The fact sheet treats advisory and determinative outputs alike.
4. The effect. Could the decision significantly affect the person? The fact sheet says vulnerability is relevant: a decision can weigh more on a person experiencing vulnerability.
5. The personal information. List the kinds the feature uses, and flag sensitive information.
6. The human step, as it really runs. Record what a reviewer does with the output: accepts it, checks it against source records, or decides on other evidence and documents why. If you rely on oversight to argue a decision is out of scope, this record is what shows it.
7. The vendor’s description. Ask each vendor for the high-level information the OAIC expects them to provide, and keep their answer with the row.

Rows that meet all three conditions feed the new section of your privacy policy. Rows you judge out of scope keep their reasoning, so the judgement can be revisited when the feature or the process changes.

Where to start this week

Start with the systems that already make decisions about customers, applicants, tenants, patients or staff, and with any AI feature switched on in the last year. A draft-for-approval workflow keeps a person approving every action, but it can still fall within scope if its drafts are a key factor in a decision about someone. Recording what the approver checks, and when they change the draft, is the same evidence the fact sheet’s third example describes.