The privacy regulator has published the guidance firms need to update their privacy policy before the 10 December 2026 deadline.
When we first flagged this rule in July, the obligation was set but the practical detail was not. That has now changed. On 30 September 2026 the Office of the Australian Information Commissioner (OAIC) published its transparency resources for automated decision-making, the how-to that firms had been waiting on ahead of commencement.
The package comes in four parts: updated APP 1 Guidelines, a fact sheet on the APP 1.7 to 1.9 transparency obligation, a supplementary fact sheet for government agencies, and a flowchart with worked privacy-policy examples. The OAIC says it drew on 90 written submissions from its consultation in shaping the resources.
What your privacy policy has to say
From 10 December 2026, if your firm has arranged for a computer program to make, or to substantially inform, decisions that could significantly affect a person's rights or interests, your privacy policy must spell out three things: that a computer program is involved, the kinds of personal information it uses, and the kinds of decisions it makes.
One point catches many firms off guard. The rule is not limited to AI, it covers any "computer program," so an automated eligibility check or a rules-based scoring tool is caught just as much as a machine-learning model.
For accounting and advisory firms and for law firms, this is directly actionable. If you use automated tools to make or inform decisions that matter to clients, the work now is to map where those tools sit and to get the right wording in place before December. The flowchart and worked examples give you a template to follow, so this is a writing-and-review task rather than a rebuild, and it needs to live on your website where clients and regulators can find it.
The calm read: the deadline is real but the path is now clear. Treat the OAIC's examples as your starting point, confirm which of your tools fall in scope, and update the policy once, well ahead of 10 December.
Frequently asked questions
Do I need to update my privacy policy for the OAIC's automated-decision transparency guidance before 10 December 2026?
The OAIC's automated-decision transparency guidance sets an obligation that commences on 10 December 2026. If your firm uses a computer program to make or substantially inform decisions that significantly affect people, yes, you need to update your privacy policy to disclose that use before then. The OAIC's new flowchart and worked examples show you what that disclosure should look like.
Does the OAIC's automated-decision transparency obligation only apply to AI systems?
The OAIC's automated-decision transparency obligation is not limited to AI. It covers any "computer program," not just AI or machine-learning tools, so an automated eligibility check or a rules-based scoring tool can be caught in the same way a machine-learning model is.
What does the OAIC's automated-decision transparency guidance require in my privacy policy?
The OAIC's automated-decision transparency guidance requires your privacy policy to spell out three things: that a computer program is used in the kinds of decisions covered, the kinds of personal information the program uses, and the kinds of decisions it makes, whether made solely by the program or substantially informed by it.
My firm uses automated tools for client work. Are we caught by the OAIC's automated-decision transparency rule?
The OAIC's automated-decision transparency rule applies to your firm if those tools make or inform decisions that could reasonably be expected to significantly affect a client's rights or interests. The practical step is to map where automated decisions happen across your firm and update your disclosure before the 10 December 2026 deadline.
