The three conditions

APP 1.7 applies to a decision when all three of these are true:

  1. You have arranged for a computer program to make the decision, or to do something substantially and directly related to making it.
  2. The decision could reasonably be expected to significantly affect an individual's rights or interests.
  3. Personal information about that individual is used to run the program for that purpose.

If all three are met, APP 1.8 says your privacy policy must describe three things: the kinds of personal information used in those programs, the kinds of decisions made solely by programs, and the kinds of decisions where a program does something substantially and directly related to making them.

The obligation starts on 10 December 2026. The OAIC published its guidance, a fact sheet and a flowchart on 30 September 2026.

"Computer program" is read broadly

The OAIC gives the term its ordinary meaning. It covers pre-programmed rules, machine learning and generative AI, and can include commonly used software and apps. What it does not capture is a program used for something unrelated to the decision, such as the word processor a person uses to write it up.

In practice, that means a scoring rule inside a workflow tool can count just as much as a purpose-built AI model.

When a program "substantially and directly" shapes a decision

Most decisions still have a person at the end. The rule reaches those too. The OAIC reads "substantially" as meaning the program's output is a key factor in the person's decision, and "directly" as meaning it has a direct connection to the decision. Both must be met.

The guidance's examples make the point:

  • A loan officer who relies heavily on a risk score produced by a program.
  • A scholarship panel that can ignore a program's ranking of applicants, but still considers it.
  • A rental company whose suitability score feeds straight into the assessment screen.

Human review does not, by itself, take a process out of scope. The questions that matter are how much people rely on the output, how often they override it, and how embedded it is in the workflow.

What "significantly affect" means

The effect has to be more than trivial and capable of considerably influencing someone's circumstances. It can be beneficial as well as adverse. The guidance points to access to essentials such as food, healthcare, financial assistance, education, banking and credit, telecommunications, utilities, employment and housing.

Context matters. If a program's output is materially different for a vulnerable group, such as children, than for the general population, the OAIC suggests treating the decision as significant.

How much detail the policy needs

The policy describes kinds of information and kinds of decisions, not every system. The OAIC expects:

  • enough meaningful information for a reasonable person to understand how programs are used, without excessive detail
  • plain language, grouped logically by category of decision and type of information
  • a clear statement where sensitive information, such as health information or biometric templates, is used

Commercial-in-confidence detail can be left out, but only where releasing it would harm commercial interests, not simply because it has commercial value.

An illustration

The wording below is an illustration only, to show the level of detail. Your own wording should come from your inventory and be settled with your legal team.

Automated decision-making. We use computer programs in some decisions that may significantly affect you.

When you apply for credit, a program uses your income, expenses, existing debts and credit history to produce a risk score. Our lending staff rely on that score when deciding whether to approve your application and on what terms.

To protect accounts from fraud, a program uses your identity information, device and location data to decide whether to allow, flag or block access to your account. Some of these decisions are made by the program alone.

Vendors don't carry the obligation for you

The obligation generally sits with the organisation that uses personal information to make the decision, even when a third party supplies the program. AI features switched on inside your CRM, HR or ERP platform are your disclosure to make, if they meet the conditions.

What to do before 10 December

  1. List the decisions you make about people that could significantly affect them.
  2. For each, find the programs involved, including vendor features and outsourced processes.
  3. Test each one against the three conditions and write down your reasoning.
  4. Group what's in scope into kinds of decisions and kinds of information.
  5. Draft plain-English policy wording and have your legal team review it.
  6. Set triggers to reassess when systems change or people start relying on outputs differently.

The first two steps are where most of the effort goes. Our next article covers how to find the automated decisions in your organisation.

Check where you stand

Ten questions, two minutes. The ADM self-check gives a quick read on how ready your organisation is for 10 December.

Take the self-checkOr book a 20-minute call →

Sources

This article is a planning summary, not legal advice. Confirm your obligations against the OAIC's current guidance and with your legal adviser.