Renzo DemartiniIn short
- From 10 December 2026, a business the Privacy Act covers must say in its privacy policy where a program makes or informs significant decisions about people.
- The Privacy Act covers a business with turnover over A$3 million, and some kinds of business at any turnover.
- No general AI law applies to businesses today, so the privacy policy line is the dated duty to prepare for.
From 10 December 2026, a business the Privacy Act covers must say in its privacy policy where a computer program makes or informs decisions that significantly affect people. On 31 October 2026 that is 40 days away.
No general AI law applies to a growing business today. This one dated rule does, and it reaches more than AI. Here is who it covers, what it asks for and what to do first.
One privacy policy rule starts on 10 December 2026, and it has three tests
OAIC
10 Dec
The date the rule starts
2026, for businesses the Privacy Act covers.
Countdown
40 days
From 31 October to 10 December 2026
APP 1.7
3 tests
A program, a significant decision and personal information used
No general AI law applies to your business today
One AI-related duty is dated: the privacy policy line from 10 December 2026
| What | Status on 31 October 2026 | Who says |
|---|---|---|
| Privacy policy line (APP 1.7 to 1.9) | Law, from 10 December 2026 | OAIC |
| A general AI law | None for businesses | Productivity Commission; Prime Minister |
| Australian Standards for AI | Announced 15 July 2026; legislation aimed for early 2027 | Prime Minister |
| AI-specific regulation as a last resort | A recommendation, not law | Productivity Commission |
| Privacy duties for personal information put into AI | Apply now to covered businesses | OAIC |
There is no general AI law for businesses in Australia as at 31 October 2026. The Productivity Commission wrote in December 2025 that AI-specific regulation should be a last resort. That is a recommendation to government, not law.
More is coming. On 15 July 2026 the Prime Minister said the government will establish Australian Standards for AI and aims to bring legislation to Parliament early next year. The same speech ties the standards to large data centres. It does not say they apply to every business that uses AI.
Existing law still applies to what you do. Privacy law is the clearest case.
More detail
Checked on 31 October 2026. The Productivity Commission’s report says AI-specific regulation should be a last resort (Recommendation 1.2). The Prime Minister’s speech of 15 July 2026 says the government will establish a set of Australian Standards for AI. It adds that its standards will also set clear rules for large data centres. OAIC’s guidance on commercially available AI products says privacy obligations will apply to any personal information input into an AI system.
Who the Privacy Act covers
Turnover over A$3 million covers a business, and some kinds are covered at any turnover
The turnover test
- More than A$3 million a year: the Act covers the business
- A$3 million or less: a small business, unless the next list applies
Covered at any turnover
- Health service providers
- Businesses that trade in personal information
- Commonwealth contractors
- Tenancy database operators and credit reporting bodies
- AML/CTF reporting entities
- Consumer Data Right accredited businesses
- Businesses related to a covered business, or opted in
Source: OAIC, small business (Privacy)
The rule binds APP entities. That is the Privacy Act’s name for the businesses it covers. Turnover is the first test. OAIC says a small business has an annual turnover of A$3 million or less. Above that, the Act covers the business.
Turnover is not the only test. OAIC lists 12 kinds of business the Act covers whatever their turnover. Health service providers are one. Businesses that trade in personal information are another. A business can also be covered because it is related to a covered business, or because it opted in.
Read OAIC’s full list, and get privacy advice where your position is unclear.
More detail
Source: OAIC, small business, checked on 31 October 2026. The list also has employee associations, businesses that conduct protection action ballots and businesses the Privacy Regulation 2013 prescribes. Some sources write the boundary as ‘less than’. OAIC, the regulator, writes ‘or less’, so a business with turnover of exactly A$3 million is a small business.
The rule applies when three tests are met
All three tests must be met before the privacy policy line is needed
- 01A program is arranged for
The business bought, set up or relies on a program that makes a decision, or does a step directly related to it.
- 02The decision could significantly affect a person
Significant means more than trivial: it could considerably influence the person’s circumstances or outcomes.
- 03Personal information is used
Information about that person is used when the program makes the decision or does the step.
APP 1.7 sets three tests, and all three must be true. OAIC’s APP Guidelines set them out at paragraph 1.35.
‘Substantially’ means the program is a key factor in the person’s decision. ‘Directly’ means the step has a direct connection with making it.
A person reviewing the output does not remove the rule. OAIC says a decision can be in scope even where a program does not replace the whole process or is subject to human review. It generally treats machine learning or generative AI outputs that shape significant decisions as in scope, unless there is extensive human oversight and control.
More detail
Sources, checked on 31 October 2026: OAIC, APP Guidelines, Chapter 1 and OAIC, APP 1.7 to 1.9 fact sheet. The fact sheet says significantly means more than trivial, with the potential to considerably influence a person’s circumstances or outcomes.
What counts as a program and a decision
Rules, AI and bought software count; a word processor used to write up a decision does not
Counts as a program
- A rule in a spreadsheet or system
- AI, machine learning and chatbots
- Software you bought and configured
- A tool whose advice you usually follow
Not captured
- A person decides and writes it up in a word processor
Source: OAIC, APP 1.7 to 1.9 fact sheet
Six of OAIC’s twelve in-scope examples fit a growing business, and each is a question
| Decision | OAIC’s example, shortened | Ask in your business |
|---|---|---|
| Hiring | Software that sorts candidate profiles and makes hiring decisions | Does any tool rank or filter applicants? |
| Credit | Programs that approve or reject a loan or credit application | Does a rule approve accounts or limits? |
| Insurance | Programs that assess a person’s eligibility for insurance | Does a tool decide who qualifies? |
| Staff pay | AI reports that rank performance or decide promotions and bonuses | Does a report score your staff? |
| Support | Programs that decide a scholarship, grant or other financial support | Does a tool decide who gets support? |
| Pricing | Personalised pricing by online retailers selling significant goods | Do two customers see different prices? |
OAIC’s list is not exhaustive.
A program is wider than AI. OAIC includes rule-based processes, machine learning, generative AI and chatbots, and software, apps or word-processing tools. Buying a third-party program or configuring packaged software is arranging for it. So is relying on a program’s advice.
One boundary matters for a small team. If a person decides and uses a word processor only to write the decision up, it is not captured.
A decision is significant when its effect is more than trivial. OAIC’s own example is differential pricing of essential goods: even a small difference can compound over time into more than trivial.
More detail
Source: OAIC, APP 1.7 to 1.9 fact sheet (September 2026), and paragraph 1.40 of the APP Guidelines for the word-processor boundary. OAIC’s list of examples is not exhaustive.
What to write, and what to ask vendors
A policy paragraph needs three items, each in one plain sentence
| APP 1.8 item | What to name | Sample wording |
|---|---|---|
| Kinds of information | Types of personal information the programs use | We use contact details, CV details and purchase history. |
| Decisions by a program alone | Kinds of decisions with no person in the step | A program approves or declines low-value trade accounts. |
| Decisions with a program step | Kinds where a program does a step first | A program ranks applications. A person then shortlists. |
Sample wording for a fictional business. Adapt it to yours and check it with a privacy adviser.
Illustrative figures, not client data.
The vendor supplies the facts, and the policy and the duty stay with you
Ask the vendor
- How the tool can make or inform decisions
- Which personal information it uses
- Where a person can step in or override it
You keep
- The list of programs and their owners
- The policy wording
- The call to include it when in doubt
Source: OAIC, APP 1.7 to 1.9 fact sheet
The policy line is short. It names three things. First, the kinds of personal information the programs use. Second, the kinds of decisions a program makes on its own. Third, the kinds where a program does a step before a person decides. You can group them by type.
The detail must be meaningful to a reasonable person. A vague line such as ‘we use technology’ is unlikely to meet that.
Your vendors hold the facts. OAIC expects software providers to give clear, high-level information about how their tools can make decisions. The duty usually stays with you. If you are in doubt, OAIC says take a cautious approach and include the information.
To see what each task sends to a tool, read what a board should ask about customer data.
More detail
Source: OAIC, APP 1.7 to 1.9 fact sheet. Commercial-in-confidence information about computer programs is excluded from the rule. The rule asks for kinds of information and decisions, not product names.
Four sample businesses, tested
Two of four sample businesses need a new paragraph in their privacy policy
| Sample business | Program | Decision | Result |
|---|---|---|---|
| Recruiter, 40 staff, A$12M turnover | CV ranking tool | Who is shortlisted | In scope: add the policy line |
| Online grocery and pharmacy retailer, 15 staff, A$6M | Offer rules by purchase history | Which customers get a discount | In scope: essential goods, and small differences add up |
| Bookkeeper, 6 staff, A$1.8M | Spreadsheet rules for payment terms | Which clients get credit | Not reached: a small business, unless a listed kind applies |
| Manufacturer, 80 staff, A$30M | Word processor for staff reviews | None: a person decides | Not captured: the program only writes it up |
Fictional businesses, not clients. Turnover is annual.
Illustrative figures, not client data.
In the sample recruiter, the update is about 8 hours of staff time and A$0 of new software
Hours
8 hours
Staff time to update the policy
List the programs 2, ask three vendors 3, write and review 3.
Dollars
A$0
New software
The policy is edited on the existing website.
Running
2 hours
A yearly check of the wording
Also when a tool or vendor changes.
Illustrative figures for a fictional business, not a client result or an estimate for yours. Adviser fees are extra and depend on the quote.
Illustrative figures, not client data.
Four fictional businesses show how the tests work. Two need a new policy paragraph. Two do not, for different reasons.
Small prices matter too. A sample online retailer of essential goods, such as groceries and pharmacy items, that charges one customer A$15 more on each of 24 orders a year creates A$360 a year of difference. OAIC’s example is essential goods: there, even a small difference can compound over time into more than trivial.
The effort is mostly hours. The sample recruiter spends about 8 hours of staff time listing its programs, asking vendors and writing the paragraph. It spends A$0 on new software. The cost to plan for is any adviser review, which depends on the adviser’s quote and is not in these figures.
Check whether the rule reaches you
Exhibit 12 · Try itDoes the 10 December rule reach your business?Tick what is true for your business. The check says whether the 10 December 2026 privacy policy rule reaches you, and what to write in your policy.Open the checker ↓Close ↑
General information, not legal advice. Based on OAIC guidance (APP 1.7 to 1.9, September 2026) and the Privacy Act’s small business rules. Sample answers only. Check your position with a privacy adviser if it matters.
Tick what is true for your business. The checker says whether the 10 December rule reaches you, what applies and the next step. Nothing you tick leaves your browser.
It is general information, not legal advice. Check your position with a privacy adviser if it matters.
What to do first
Five steps get a covered business ready before 10 December 2026
- 01List the programs that decide about people
Rules, AI tools, bought software and advice your team follows. Note who owns each.
- 02Ask each vendor for high-level facts
How the tool makes or informs decisions, and which personal information it uses.
- 03Test each program against the three tests
A program, a significant effect and personal information used. The checker above covers the first two; the third is nearly always true for decisions about a named person.
- 04Write the paragraph before 10 December
Name the kinds of information and decisions. Group them by type, in plain words.
- 05Review it once a year
And whenever a tool, a vendor or the way you decide changes.
Start with the list. The policy wording is short. Finding every program that touches a decision is the work.
Common questions
Is there an AI law in Australia?
Not a general one for businesses, as at 31 October 2026. The government has announced Australian Standards for AI and aims to bring legislation to Parliament early in 2027. A privacy policy rule starts on 10 December 2026.
Does the Privacy Act cover a small business?
Usually not. A small business has an annual turnover of A$3 million or less. OAIC lists kinds of business the Act covers at any turnover, such as health service providers and businesses that trade in personal information.
What changes on 10 December 2026?
Businesses the Privacy Act covers must add information to their privacy policy where they have arranged for a computer program to make or inform decisions. The decisions are those that significantly affect individuals’ rights or interests.
Does using ChatGPT or another AI tool trigger the rule?
Only if a program makes or informs a decision that significantly affects a person and uses their personal information. Using a tool to draft your own text is not that. If you are in doubt, OAIC says take a cautious approach.
Do I have to name my software vendors in the policy?
The rule asks for the kinds of personal information and the kinds of decisions, not product names. Ask each vendor for clear, high-level information so you can describe them.
Is this legal advice?
No. It is general information from OAIC guidance, read on 31 October 2026. Get privacy advice where your position is unclear.
Chartered Accountant (CA ANZ) and finance executive, based in Canberra. Practical AI and automation for SMEs, and adviser to owners, CEOs and boards on integration and finance.