What does Australia's 10 December 2026 Privacy Act AI-disclosure rule require?
A dated, hard deadline: privacy policies must say whether, and how, personal data feeds automated decisions that significantly affect people. Saying 'how' is the real work.
The answer, up front
5 things that decide this
- 01From 10 December 2026, entities covered by Australia's Privacy Act must disclose automated decisions in their privacy policy. That policy must say whether personal data feeds decisions that significantly affect people, and how.
- 02Civil penalties under the Privacy Act run up to A$50 million or 30% of turnover, which puts a missing disclosure well beyond paperwork risk.
- 03Australia's small-business exemption was narrowed by a 2024 amendment, not removed. Full removal is a pending reform, not yet law, whatever other pages claim.
- 04Preparing means an inventory first: list every automated decision your systems make, work out with counsel which ones significantly affect people, then write the disclosure from what you found.
- 05This page is analysis from a software firm, not legal advice. Confirm scope and wording with Australian counsel before the deadline.
What the rule actually says
This duty has two parts, and the second one bites. A covered entity must state whether it uses personal information in automated decision-making that significantly affects individuals. It must also state how. Answering 'whether' takes one sentence. To answer 'how', you must trace which data feeds which decision, and what it changes for the person on the other end.
That is why this lands as an engineering task before it lands as a drafting one. Say you adopted an AI booking agent or a screening tool last year. If nobody can describe what it decides, with whose data, you've got nothing accurate to put in the policy yet.
Who has to comply
Entities the Privacy Act covers must comply, and that group is broader than many owners assume. The Privacy and Other Legislation Amendment Act 2024 narrowed the small-business exemption that once kept smaller operators out of scope.
Be precise about what has not happened, though. You'll find pages claiming the exemption is gone. That claim runs ahead of the law: full removal is flagged for a later tranche and hasn't passed. If your business sits anywhere near the coverage line, get an opinion from counsel rather than relying on either guess.
What to do before 10 December
Work backwards from the disclosure you'll have to write. Policy wording comes last, and it's the cheapest step.
- 01List every place software makes or shapes a decision about a person: an AI phone agent that triages calls, a booking system that accepts or refuses, a screening tool that ranks candidates, a scoring model that sets terms.
- 02Work out with counsel which of those decisions clear the Act's significance bar. That test decides your disclosure, so it's not one to guess.
- 03Write the 'how' disclosure from your system inventory, not from a vendor's marketing page.
- 04Fix the systems you can't explain. A decision path nobody can describe can't be disclosed accurately.
- InventoryEvery automated decision, listed
- ClassifyThe ones that affect people, per counsel
- InstrumentDecision logs and review gates added
- DisclosePolicy written from the inventory
Counsel owns the classification; engineering owns the logs.
Where custom tooling helps
Your disclosure is really a report on your systems, so the build work is making them reportable. In practice that means decision logs: what was decided, from which inputs, and whether a person reviewed it. It also means human-review gates at the decision points that matter. We build AI agents with those audit trails designed in. Our AI consulting work starts exactly where this rule does: mapping what your systems decide and which personal data they touch.
We build for the Australian market already. We shipped WorkmateAI, a home-services marketplace, for an Australian client. It's the kind of system this rule now reaches: software making calls about real people's jobs and money.
Questions that come next
01Does the rule apply if a human makes the final decision?+
Maybe not. The duty attaches to automated decisions that significantly affect individuals, so a decision a person genuinely reviews and can change may sit outside it. A human clicking approve on whatever the system says is not real review, though. Treat borderline systems as in scope for your inventory and let counsel rule them out, not the other way around.
02We use an off-the-shelf AI tool. Is disclosure the vendor's problem?+
No. Your privacy policy is the one that must carry the disclosure. Under the Act, the duty sits with the covered entity, not its suppliers. A good vendor will document how their system uses data, and you'll need that record, but publishing the disclosure stays your job.
03Has the small-business exemption been removed?+
Not yet. A 2024 amendment narrowed it, so more businesses are covered than before. Full removal is flagged for a later reform tranche, and pending reform is not current law. If your coverage is unclear, get a legal opinion rather than assuming you're exempt.
Related
- Is your AI build EU AI Act compliant? →The EU's dated AI deadlines, held to the same standard of precision.
- AI consulting →System inventories and decision mapping start here.
- AI agent development →Agents built with decision logs and human-review gates.
- WorkmateAI: home-services marketplace, Australia →A system we shipped for the Australian market.
