From 10 December 2026, organisations covered by the Privacy Act must explain in their privacy policy when computer programs use personal information to make, or substantially help make, decisions that could significantly affect people. Updating the policy is the easy part. The hard part is finding every system that qualifies, and knowing exactly what personal information flows into it.

Disclaimer: This article covers the technical groundwork. It isn't legal advice; work with your legal and privacy team on the final disclosures.

What's actually changing

Under the amended Australian Privacy Principle 1.8, your privacy policy will need to describe three things:

1. The kinds of personal information used in the operation of those computer programmes.
2. The kinds of decisions made solely by a computer programme.
3. The kinds of decisions where a computer programme does something substantially and directly related to making the decision.

The decisions in scope are those that could significantly affect someone's rights or interests. Legal commentators point to examples like eligibility for services, access to healthcare or support, insurance terms and pricing, and admission decisions. The effect has to be more than trivial, and it can be positive as well as negative.

Why this is harder than it sounds

Most organisations don't think of themselves as running "automated decision-making". But the definition doesn't stop at AI. It covers any computer programme that scores, ranks, recommends, flags or filters in a way that feeds a significant decision.

That includes the obvious ones, like a new AI agent triaging applications. It also includes the ones nobody thinks about: an eligibility rule buried in a CRM workflow, a risk score in a Power BI report that a team uses to prioritise cases, or a vendor platform with a "smart" recommendation feature switched on by default.

In our work across health, aged care and government-adjacent organisations, the pattern is consistent. The systems aren't hidden. They just aren't written down anywhere as decision systems.

The technical groundwork, step by step

1. Build an inventory of decision systems.
   • List every system that produces a score, ranking, recommendation, flag or automatic outcome about a person. Include vendor platforms and embedded features, not just in-house builds. If you already keep an AI register, which is one of the Government's six essential AI practices, start there, but expect it to be incomplete.
2. Map the decision pathway for each one. 
   • For each system, record what goes in, what comes out, who or what acts on the output, and what happens to the person as a result. This is where you establish whether the programme decides alone or does something "substantially and directly related" to a human decision.
3. Trace the personal information back to its source. 
   • Your disclosure has to describe the kinds of personal information used. That means knowing which fields feed each system and where they originally came from. In a modern data platform, a single field in a report can pass through several layers of transformation before it reaches the model or rule that uses it.
   • This is where data lineage stops being a data engineering nice-to-have and becomes a compliance tool. If you can trace a field from the report back to its raw source, you can describe it accurately. If you can't, you're guessing, and a privacy policy built on guesses is a risk in itself. On the Microsoft platform, Microsoft Purview and Fabric's lineage features are the natural starting point.
4. Classify the sensitivity of what you find. 
   • Mark which inputs are personal information and which are sensitive information, such as health data. This also tells you where to focus controls.
5. Apply the statutory test and document your reasoning. 
   • For each system, record whether the decision could significantly affect someone and why. Where it's borderline, write down the reasoning. That record is what you'll rely on if the regulator asks.
6. Draft the disclosures in plain language. 
   • Work with your legal and privacy team to describe the kinds of information and decisions. You don't need to reveal commercially sensitive details.
7. Set up change control. 
   • The obligation doesn't end on 10 December. New AI features, new vendor releases and new reports can all create new decision systems. Build a check into how you approve new systems and changes, so the inventory stays true.

Where AI agents make this more urgent

AI agents blur the line between "the system recommended" and "the system decided". An agent that drafts a response, routes a request, or pre-fills an assessment may be doing something substantially and directly related to a decision, even with a person in the loop. If you're building agents, design the decision pathway and the audit trail from the start. It's far cheaper than reconstructing them later.

A realistic timeline

With about eight weeks to go, a sensible plan is two to three weeks for the inventory and mapping, two to three weeks for lineage tracing and classification on the systems that matter most, and the remaining time for drafting disclosures and review. Organisations with a well-documented data platform will move faster. Those without one will find out quickly where the gaps are.

FAQ

Does this only apply to AI? No. It applies to computer programmes generally, including rules engines and scoring models, where they're used in decisions that could significantly affect people.

What if a human makes the final decision? The obligation still applies where the programme does something substantially and directly related to making the decision, such as producing a score or recommendation the person relies on.

Do we have to disclose how our algorithms work? The requirement is to describe the kinds of personal information and the kinds of decisions, in plain language. Commercial-in-confidence details don't need to be disclosed.

We use vendor software with AI features. Is that our responsibility? If you use the system in your decision-making, you'll generally need to account for it. Review vendor contracts so you understand what information the system uses.

Where does the Government's AI guidance fit? The Guidance for AI Adoption's six essential practices, especially keeping an AI register and sharing essential information, line up closely with this work.

Not sure which of your systems are in scope? PerData can help you build the inventory and trace the data behind it before 10 December.

About the author: Timotius Devin is AI Lead at PerData Technology Partners in Melbourne. At PerData Devin helps Australian organisations design, govern and deploy AI on the Microsoft platform.

Sources

1. Gilbert + Tobin, Automated decision-making transparency under the Privacy Act: are you prepared for 10 December 2026?: https://www.gtlaw.com.au/insights/automated-decision-making-transparency-under-the-privacy-act
2. White & Case, Australian Privacy Update: Automated decision making transparency requirement: https://www.whitecase.com/insight-alert/australian-privacy-update-automated-decision-making-transparency-requirement
3. National AI Centre, Guidance for AI adoption: foundations: https://www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-foundations