Start from decisions, not systems
A system inventory will give you hundreds of applications and very little insight. Start instead with the decisions your organisation makes about people, then trace which programs touch each one.
Begin with a workshop for each business area and ask one question: what do we decide about customers, members, students, staff, applicants or citizens that could considerably change their circumstances? Common answers include:
- eligibility, entitlement and benefit decisions
- credit, pricing, premiums and hardship arrangements
- recruitment screening, shortlisting and rostering
- fraud and risk flags that hold, suspend or escalate an account or claim
- triage and prioritisation of complaints, claims, cases or requests
- wellbeing, safety or attendance flags in education and care
- targeted job advertising and personalised pricing
Remember that a decision can also be a refusal, or a failure to decide. A filter that quietly removes applications from a queue can be shaping outcomes just as much as one that approves them.
Where programs hide
Once you have the decisions, follow each one back through the process. The obvious systems are rarely the problem. Look for:
- Rules inside workflow tools. A routing rule or eligibility check configured years ago and never documented.
- AI features in platforms you already license. Assistants and agents inside CRM, service management, HR and ERP products that summarise, rank, route or recommend.
- Outsourced processes. A provider that screens applicants or assesses claims on your behalf using its own software.
- Models built by analysts. A scoring model in a spreadsheet or notebook whose output a team relies on every week.
Record each decision pathway
For every decision-and-program pair, capture enough to test it against the conditions and to describe it later. A simple register works:
| Field | What to record |
|---|---|
| Decision | What is decided, about whom, by which business area |
| Program | System, feature or model involved, and who supplies it |
| Personal information | Kinds of information the program uses, flagging sensitive information |
| Output | Score, ranking, recommendation, summary or final decision |
| Human role | Who can override, how often they do, and how much they rely on the output |
| Effect on the person | What changes for them, and whether vulnerable groups are affected differently |
| Assessment | Whether each of the three conditions is met, with the reasoning |
| Owner | The named person accountable for the decision pathway |
Test against the three conditions, and keep the reasoning
For each pathway, decide whether the program makes the decision or does something substantially and directly related to it, whether the decision could significantly affect the person, and whether personal information is used. Write down why. Borderline calls are common, and a short note of your reasoning is what lets you defend the call later, or revisit it when circumstances change.
For the detail of each condition, see APP 1.7 explained.
Group into kinds for the policy
The privacy policy describes kinds of decisions and kinds of information, not individual systems. Once the in-scope pathways are clear, group them into a handful of categories a reasonable person would understand, such as credit decisions, fraud and account security, recruitment, and service eligibility.
Keep it current
The inventory starts going out of date the day it's finished. Agree what triggers a reassessment:
- a new system, feature or vendor that touches an in-scope decision
- a change in how much people rely on an output, or how often they override it
- a platform update that switches on new AI features
- a quarterly review by the owners, reported to risk
How long it takes
For most mid-sized organisations, a focused effort takes about three weeks. In week one, find the decisions and programs through six to eight short interviews. In week two, test each pathway against the conditions. In week three, draft the policy wording, an exposure statement for General Counsel and a plan for the gaps.
Done this way, the inventory becomes the first version of something more useful than a compliance record: a register of your AI agents.
Check where you stand
Ten questions, two minutes. The ADM self-check gives a quick read on how ready your organisation is for 10 December.
Sources
- OAIC: APP Guidelines, Chapter 1 (APP 1)
- Gilbert + Tobin: Automated decision-making transparency under the Privacy Act
- Allens: Key takeaways from the OAIC guidance, October 2026
This article is a planning summary, not legal advice. Confirm your obligations against the OAIC's current guidance and with your legal adviser.