Automated decision-making duties start 10 December 2026.
If your organisation is covered by the Privacy Act, your privacy policy must explain where computer programs use personal information to make, or substantially help make, decisions that significantly affect people. Most organisations can't yet say where that happens.
Start by mid-November to finish a three-week readiness check before the deadline.
The duties are now in force. If your policy isn't updated yet, an ADM gap review finds what is missing and drafts the fix.
What your privacy policy now has to cover.
The personal information used
The kinds of personal information used in the computer programs that make or shape decisions.
Decisions made solely by a program
The kinds of decisions a computer program makes with no human making the call.
Decisions a program substantially shapes
The kinds of decisions where a program does something substantially and directly related to making them, such as scoring, ranking or recommending.
Where it bites
Only decisions that could reasonably be expected to significantly affect an individual's rights or interests. Eligibility, pricing, access to services and employment screening are typical places to look.
Why this matters beyond compliance. Writing the policy honestly means finding every system and agent that shapes decisions about people. That inventory is also the foundation of a governed AI workforce, so the work pays twice.
How ready are you? Ten questions, two minutes.
Answer for your organisation as it stands today. Your answers stay in your browser.
Do you have a current list of every system, AI tool and agent that makes or shapes decisions about individuals?
Do you know which of those systems use personal information?
Have you identified the decisions made solely by a computer program?
Have you identified where a program does something substantially and directly related to a decision, such as scoring, ranking or recommending?
Have you assessed which of those decisions could significantly affect someone's rights or interests?
Does your privacy policy already describe these kinds of decisions and the personal information used?
Does each decision-making system have a named business owner?
Do you know which AI features have been switched on inside platforms you already license, such as CRM, HR or ERP?
Has General Counsel or your Privacy Officer agreed a plan and owner for 10 December?
Can your updated privacy policy be drafted, reviewed and approved before 10 December?
This self-check is a planning aid, not legal advice. Confirm your obligations against the OAIC's current guidance and with your legal adviser.
ADM Readiness Check
Be ready for the Privacy Act's automated decision-making rules on 10 December 2026.
What you get
- ADM inventory: every system, agent and AI tool that shapes decisions about people
- Three-condition test for each one, with a tier and the gap against your current policy
- ADM Exposure Statement for General Counsel to sign off
- Draft privacy-policy wording in plain English, ready for legal review
- Remediation plan: owner, action and date for every gap
- 60-minute executive briefing on findings and decisions needed
Three weeks, three steps
- Week 1Find: census of decision-shaping systems and 6–8 short interviews.
- Week 2Test: each system against the three conditions.
- Week 3Close: statement, policy wording, plan and briefing.
Who it's for
General Counsel, Privacy Officers, Chief Risk Officers and COOs in any organisation covered by the Privacy Act.
We support General Counsel and do not give legal advice.
Send me the ADM briefing pack.
A short briefing for your executive team: what the new rules require, where automated decisions usually hide, and a 90-day plan from inventory to governed agent register.
Privacy and Other Legislation Amendment Act 2024, which inserts APP 1.7 to 1.9 into the Privacy Act 1988 (Cth), commencing 10 December 2026. Guidance from the Office of the Australian Information Commissioner.
Summary for planning purposes only. It is not legal advice.