An automated decision register lists every computer programme that makes, or helps make, significant decisions about people using their personal information. It records enough detail to write your privacy policy disclosure and to explain your reasoning if anyone asks. The OAIC's guidance, released on 30 September 2026, makes clear this goes well beyond AI: rules, chatbots and even spreadsheets can count. Below are the 12 columns we'd use: nine come straight from the OAIC's guidance, and three are good practice we'd add.
Why a register, and why now?
On 30 September, the OAIC published its final resources for the new transparency obligation: a fact sheet, a flowchart and updated APP 1 Guidelines, shaped by 90 written submissions. From 10 December 2026, organisations covered by the Privacy Act must disclose in their privacy policy when a computer program makes or informs decisions that could significantly affect someone.
Three things in the guidance tend to surprise people:
- "Computer programme" is broad. It covers rule-based processes, machine learning, generative AI, chatbots, and everyday software. The OAIC's fact sheet even includes a worked example of a spreadsheet whose formula scores people and ranks them for services.
- A human in the loop doesn't take you out of scope. A programme is caught if its output is a key factor in the decision, whether it's advisory or determinative. Machine learning and generative AI outputs used in significant decisions are generally captured unless they're subject to extensive human oversight.
- The obligation sits with you, not your vendor. If you use a third-party tool in your decisions, you need to account for it.
Legal commentators are recommending an ADM audit that maps every programme, in-house or third-party, against these tests. A register is simply where that audit lives.
Start with decisions, not systems
The fastest way to build a register is backwards. Start by listing the significant decisions your organisation makes about people: who gets a service, what someone pays, who gets hired, whose account gets suspended. The OAIC's fact sheet lists decisions that are generally in scope, including recruitment, loan or credit approval, insurance eligibility, prioritising health or disability services, eligibility for housing or government benefits, and AI reports on employee performance or bonuses.
Then, for each decision, ask what programmes feed it. You'll find the obvious ones quickly. The spreadsheet in someone's OneDrive takes a bit longer.
The 12 columns
Nine columns come straight from the OAIC's guidance. Three are good practices we'd add to make the register easier to keep accurate.
# | Observation | What goes in it? | Why is it there? |
1 | Decision | The decision about a person, in plain words. | OAIC: your policy must describe the kinds of decisions. |
2 | Significant effect? | Yes or no, with one line of reasoning. | OAIC: the significant effect test |
3 | Programme | The system, model, rule set or spreadsheet involved. | OAIC: what counts as a computer programme? |
4 | Built by | In-house, or the vendor's name. | OAIC: third-party programmes still need disclosure. |
5 | Role in the decision | Decides alone, key factor, or minor input. | OAIC: decisions made solely by a programme vs where it's a key factor. |
6 | Output type | Advisory or determinative. | OAIC: both can be in scope. |
7 | Human oversight | What people actually do: check the output, use other evidence, and record why they depart from it. | OAIC: the oversight measures in its worked examples. |
8 | Override rate | Roughly how often people overrule the output. | PerData: shows how much people really rely on the output. |
9 | Personal information used | The kinds of information, not field names | OAIC: your policy must describe the kinds of personal information. |
10 | Sensitive information? | Flag health, biometric and other sensitive information. | OAIC: sensitive information should be made clear. |
11 | Data source | Where the inputs come from, linked to your lineage records. | PerData: so you can describe the information accurately. |
12 | Owner and last reviewed | The accountable person and the date. | PerData: an accountable owner, as in the Guidance for AI Adoption. |
The two columns most people skip
Columns 7 and 8 are where registers get honest. The OAIC treats the level of human oversight as a factor in whether a program is in scope, and it points to concrete measures, such as questioning outputs and documenting departures from them.
If your team overrules the system almost never, "a person reviews it" is doing very little work. That's not a criticism. It's just useful to know before you write your disclosure.
Where AI agents fit
Copilot Studio agents and other AI agents that triage, route or pre-fill decisions belong on the register too. Microsoft is bringing its agent registry experiences together under Microsoft Agent 365, which can help you find agents you didn't know about. We'll cover agent identity in more depth on 18 November.
Keeping it true after 10 December
A register is only useful if it stays current. Add a check to how you approve new systems, vendor features and reports, as we suggested in Automated Decisions and the Privacy Act. A spreadsheet is a fine place to start. Microsoft Lists or SharePoint works well once more than one team is updating it.
FAQ
Is a register legally required? The legal obligation is the privacy policy disclosure. A register isn't named in the law, but it's the practical way to get the disclosure right and to show how you reached it.
Do spreadsheets really count? They can. The OAIC's fact sheet includes a worked example of a spreadsheet whose formula scores people and ranks them for services.
If a person always reviews the output, are we out of scope? Not automatically. Human involvement on its own doesn't take a programme out of scope. What matters is how much the output drives the decision.
What about vendor tools? You're responsible for disclosing the decisions you make with them. The OAIC expects your disclosure to draw on the vendor's information, so ask vendors how their tools use personal information, and check your contracts.
Starting your register and not sure what's in scope? PerData's Data Governance for AI team can help you build it and trace the data behind it before 10 December.
About the author: Timotius Devin is AI Lead at PerData Technology Partners in Melbourne. At PerData he helps Australian organisations design, govern and deploy AI.
Related reading
- Automated Decisions and the Privacy Act: What Australian Organisations Need to Do Before 10 December
Sources
- OAIC, New resources on transparency for use of AI and automated decision-making: https://www.oaic.gov.au/news/media-centre/new-resources-on-transparency-for-use-of-ai-and-automated-decision-making
- OAIC, APP 1.7-1.9 Transparency Obligation Fact Sheet: https://www.oaic.gov.au/__data/assets/pdf_file/0021/269013/APP-1.7-1.9-Transparency-Obligation-Fact-Sheet.PDF
- Corrs Chambers Westgarth, Transparency in automated decision-making: what the OAIC guidance means for your business: https://corrs.com.au/insights/transparency-in-automated-decision-making-what-the-oaic-guidance-means-for-your-business
- National AI Centre, Guidance for AI adoption: foundations: https://www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-foundations
- Microsoft Learn, What's new in Microsoft Entra Agent ID: https://learn.microsoft.com/en-us/entra/agent-id/whats-new-agent-id
