Australia's New AI Privacy Rule Is Coming. Is Your Business Ready?

On 10 December 2026, Australia's privacy rules change for some automated and software-assisted decisions. Here is what the rule covers, what APP 1.7 requires policies to explain, and what to map now.

Play

If an organisation covered by the Australian Privacy Principles has arranged for software to use personal information in a decision that could reasonably be expected to significantly affect someone's rights or interests, its APP Privacy Policy must include additional information.

This is not a blanket law covering every Australian business or every use of AI. But it is broader than fully automated decision-making, and that distinction is easy to miss.

What changes on 10 December 2026

The new APP 1.7-1.9 provisions were added by Schedule 1, Part 15 of the Privacy and Other Legislation Amendment Act 2024. That Part commences on 10 December 2026.

The trigger has three connected parts:

1. An APP entity has arranged for a computer program to make a decision, or do something substantially and directly related to making it.
2. The decision could reasonably be expected to significantly affect an individual's rights or interests.
3. Personal information about that individual is used by the program in making the decision or doing that related thing.

The Act says a decision can affect an individual beneficially or adversely. Its examples include decisions about a benefit under legislation, rights under a contract or arrangement, and access to a significant service or support. Refusing or failing to make a decision can also count.

That does not mean every algorithm, AI assistant or internal automation is captured. The legal test still matters. Start with the decisions and work through the elements instead of labelling every software process as "AI".

The catch: a human click may not take the workflow out of scope

A common first assumption is that the rule only concerns decisions made entirely by software.

The statutory wording is wider. It also refers to a program doing something "substantially and directly related to making" the decision.

That means a human review step is not an automatic exemption. A person might review a recommendation and click approve, yet the software-assisted part may still require analysis if it used personal information and was substantially and directly related to a decision with the required level of impact.

The right conclusion depends on the real workflow. The useful starting questions are:

• What decision is ultimately being made?
• Where does software influence the outcome?
• What personal information does that software use?
• How significant could the decision be for the individual?
• Is the software making the decision, or doing something substantially and directly related to it?

What the privacy policy must explain when APP 1.7 applies

Where APP 1.7 applies, APP 1.8 requires the policy to describe:

• the kinds of personal information used in the operation of the relevant programs;
• the kinds of decisions made solely by those programs; and
• the kinds of decisions for which a program does something substantially and directly related to making the decision.

The requirement is framed around kinds of information and kinds of decisions. It is not an instruction to publish source code, model weights or every technical implementation detail.

The OAIC also says an APP Privacy Policy should be clearly expressed, up to date, easy to understand and tailored to the entity's actual information-handling practices.

Start with the decisions - not a vague paragraph about AI

A generic sentence saying that an organisation "may use AI" is unlikely to answer the operational question. Teams need to know which workflows should be assessed and what the software actually does inside them.

1. List consequential decisions

Find workflows that may significantly affect a person's rights or interests. Focus on the decision and its effect, not the product label attached to the software.

2. Map software-assisted steps

Document where a program makes a decision, generates a recommendation, ranks an option, applies a rule, withholds an outcome or performs another step connected to the final decision.

3. Trace the personal information

Record the kinds of personal information used at each relevant step, where the information comes from and what role it plays.

4. Review human-approval workflows

Do not discard a workflow merely because a person gives final approval. Check whether the program's contribution is substantially and directly related to the decision.

5. Update policy and operational controls

Get appropriate privacy and legal advice on the policy wording. In parallel, make sure the live workflow has controls around actions that can affect people, money, data or access - and that the organisation can reconstruct what happened.

The amendments apply to decisions made after commencement even where the arrangement, information use, acquisition or creation happened earlier. Existing systems therefore deserve attention; this is not only a new-project checklist.

Where runtime control fits

A privacy-policy update explains relevant practices. It does not, by itself, control what software can do at runtime.

HaltState sits at the action boundary before an agent or automated workflow reaches a real system. It checks an action against policy, returns ALLOW, APPROVAL_REQUIRED or DENY, and records the timestamp, policy version, decision, evidence ID and verification result.

That can help teams govern high-consequence actions such as payments and refunds. It does not decide whether an organisation is legally covered, replace privacy advice or guarantee compliance.

Read the primary sources

• OAIC: APP 1 - open and transparent management of personal information
• Federal Register of Legislation: Privacy and Other Legislation Amendment Act 2024

General information only. This article and video are not legal advice.