What changes on 10 December 2026?
From 10 December 2026, organisations covered by the Australian Privacy Principles (APP entities) must add information to their privacy policy when they have arranged for a computer program to make, or do something substantially and directly related to making, a decision that could significantly affect an individual's rights or interests, and personal information is used in running the program. The Office of the Australian Information Commissioner (OAIC) published fact sheets and updated guidelines on this on 30 September 2026.
What must the policy say?
- The kinds of personal information used by those programs.
- The kinds of decisions the programs make on their own.
- The kinds of decisions where a program does something substantially and directly related to the decision.
What counts as a computer program?
The OAIC's updated guidelines read it broadly. They say it covers pre-programmed rule-based processes, AI and machine learning, and generative AI tools. They also say "arranged for" covers programs you buy from or run through someone else, and that you should actively identify, assess and oversee them.
What does it not require?
It is a transparency measure about your privacy policy. A law firm's summary describes it as transparency only, and the OAIC's own issues paper says it creates no right to contest a decision or to request information. Trade secrets and commercial-in-confidence details are not required to be disclosed.
How does this connect to AI search work?
Our reading: most marketing and AI-visibility work does not make decisions about individuals, so most businesses will have little to say. But check what you actually run. If a tool scores, ranks or screens people, such as leads, job applicants or customers, and a person's circumstances could be significantly affected, it may be in scope. Our own free check scores a website, not a person, and our privacy policy says so.
What can you do before 10 December?
- List the software that scores, ranks, approves or screens people.
- For each, note what personal information goes in and who, if anyone, makes the final call.
- Update your privacy policy to match what you actually do, and ask your legal adviser to check the wording.
What does this article not tell you?
- Whether your business is an APP entity. See our article on the small business exemption.
- How the OAIC will enforce this after 10 December. Its release does not say.
- This is general information, not legal advice.
Is your website ready for AI?
Our free check reads your site the way AI tools do, tests four AI crawlers live and scores nine dimensions out of 100.
Sources
- New resources on transparency for use of AI and automated decision-making · OAIC, 30 September 2026. Read by us on 27 October 2026.
- APP Guidelines, Chapter 1 (APP 1), version 2.0 · OAIC, updated 30 September 2026. Read by us on 30 September 2026.
- ADM transparency: what APP entities need to know about the APP 1 amendments · Allens, 10 June 2026. Law-firm summary, read by us on 30 September 2026.
We keep what a source says separate from our reading of it. If a source is from another country or a different date, we say so. We are not giving advice, and nothing here is a promise of rankings, citations or sales.