Automated decision-making: preparing for the new transparency obligation

Australia is entering a new phase of regulation for automated decision-making (ADM). With transparency obligations set to commence on 10 December 2026 and broader reforms on the horizon, organisations captured by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) need to understand where automation influences key decisions and ensure they are ready to comply.

Under the new transparency obligation, entities will be required to disclose details of their use of ADM in their privacy policy. The changes sit within new APPs 1.7 – 1.9, introduced by the Privacy and Other Legislation Amendment Act 2024 (Cth), and will be triggered where three conditions are met:

1. the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; and
    
2. the decision could reasonably be expected to significantly affect the rights or interests of an individual; and
    
3. personal information about the individual is used in the operation of the computer program to make the decision.

In May 2026, the Office of the Australian Information Commissioner (OAIC) released an Issues Paper seeking feedback to inform the development of guidance on the ADM obligation. The Issues Paper included several fictional ‘edge cases’ designed to test the boundaries of triggering the ADM obligation. These scenarios will be most significant for APP entities assessing their compliance position. Following its consideration of feedback on the Issues Paper, the OAIC is expected to release its guidance on the ADM transparency requirements in September 2026.  

ADM transparency requirements: ambiguity to clarity

The Issues Paper draws out several areas of the transparency obligation which could benefit from further guidance from the OAIC. The following concepts require careful consideration from organisations that are seeking to address their compliance with this new obligation.

‘Computer program’

The term ‘computer program’ is intended to be interpreted broadly. It could encompass rule-based processes, AI, machine learning, apps and commonly used software. Even tools like Microsoft Excel may fall within scope, depending on how they are used. The definition does very little filtering work on its own, and organisations should cast a wide net when auditing their systems. However, the real limitation on scope comes from the requirements discussed below.

Importantly, ADM and AI are related but distinct concepts. ADM is a broader category. It captures any use of a computer system to make or materially influence a decision without meaningful human input, whether powered by AI or by simple rules-based logic. Not all ADM involves AI, and not all AI use constitutes ADM. The new transparency obligation targets ADM rather than AI specifically, although the rising adoption of AI has accelerated the prevalence of ADM.

‘Substantially and directly related to making a decision’

The Explanatory Memorandum to the Privacy and Other Legislation Amendment Act 2024 (Cth) clarifies that ‘substantially’ means the computer program’s output is a key factor in facilitating the human’s decision-making. ‘Directly’ means the output has a direct connection with making the decision. A program does not need to make the decision autonomously – it is sufficient that it recommends or guides a human decision-maker, provided that the output is a key factor and has a direct connection to making a decision. 

In assessing whether a computer program substantially facilitates and is directly connected to a human’s decision, the Issues Paper identifies several relevant factors.: 

• the degree of reliance on the system’s output;
   
• the ability and likelihood of human override;
   
• whether the output is advisory or determinative;
   
• the transparency and explainability of outputs; and
   
• the system’s integration into the decision-making workflow. 

The Issues Paper presents the edge case of an agency which uses a generative AI chatbot to summarise candidate profiles and recommend eligibility outcomes, with human staff always making the final decision. This example is intended to test whether a system that recommends rather than decides autonomously is nonetheless ‘substantially and directly related to making a decision’, particularly where human reviewers consistently follow the AI’s output.

‘Significantly affect the rights or interests of an individual’ 

The transparency obligation only applies where the decision ‘could reasonably be expected to significantly affect an individual’s rights or interests’. The new APP 1.9 clarifies that this effect may be either adverse or beneficial. ‘Rights’ and ‘interests’ are intended to be interpreted broadly, with some examples detailed in the Explanatory Memorandum:

• decisions to grant or refuse a statutory benefit (e.g. admission into the country, entitlement to a housing benefit);
   
• decisions affecting an individual’s rights under a contract (e.g. a life insurance policy);
   
• decisions affecting access to a significant service or support, such as healthcare services, physical assistance or support; financial assistance; educational, in-home, banking and credit services, or telecommunications and utilities; or
   
• where the use of computer programs to target individuals results in differential pricing.

However, the threshold question is more nuanced than these examples suggest. The Issues Paper presents the fictional scenario of an e-commerce company that uses algorithmic differential pricing based on a customer’s postcode – charging $100 for a book in a wealthy Sydney suburb versus $35 in a country town. This illustrates that ‘significance’ is not binary, but a spectrum influenced by context: at what level of price differential, and for what type of product, does algorithmic pricing cross the threshold?

This context-dependency means the threshold cannot be resolved by reference to the nature of the product or service alone. The same decision may significantly affect one, vulnerable individual but not another. The Issues Paper asks organisations to think about what other factors or scenarios, other than the use of sensitive information, the involvement of vulnerable persons (e.g. children, minority groups), intrusive practices or financial outcomes, might increase the likelihood that a decision could affect an individual’s rights or interests.

‘Arranged for’

The Issues Paper indicates that the entity that ‘arranged for’ the computer program to be used for decision-making bears the transparency obligation, even where a third-party operates the system. Examples provided are when a business procures a third-party AI tool to screen job applications, or permits employees to use an AI chatbot to draft performance assessments that drive promotion decisions, the business bears the disclosure obligation. Entities must consider both scenarios where they ‘arranged for’ a computer program to make a decision and where they are directly ‘operating’ ADM.

‘Making a decision’

In the Issues Paper, the OAIC notes that it has considered the meaning of ‘decision’ across other legal frameworks, such as the Administrative Review Tribunal Act 2024 (Cth), to assist with the interpretation of this term in this context. As a result, entities should expect a broad definition of ‘decision’, which includes:

• making, suspending, revoking or refusing orders, determinations, approvals, consents, permissions, licences or other instruments;
   
• imposing conditions;
   
• making declarations, demands or requirements; and
   
• doing or refusing to do any other act. 

In the new APP 1.9, making a decision includes refusing or failing to make a decision. 

The Issues Paper presents an edge case on whether passive algorithmic curation constitutes a ‘decision’ through the fictional scenario of an engineering firm advertising graduate roles on a job platform. The platform’s algorithm uses gender as one metric to determine which candidates receive the advertisement – meaning a female engineering graduate never sees the posting. This example tests the outer boundary of ‘making a decision’: if algorithmically withholding content from a user amounts to a decision (or a failure to do a thing), a wide range of platform curation systems may fall within scope.

APP 1.8: What must be disclosed?

Where the transparency obligation is triggered, APP entities will need to disclose in their privacy policy and describe in plain language the kinds of: 

1. personal information used in the operation of such computer programs;
    
2. decisions made solely by the operation of such computer programs; and
    
3. decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs.

The OAIC’s view is that disclosures must balance meaningful transparency with clear communication. Commercial-in-confidence information about ADM systems is excluded from the disclosure requirement. 

Responding to the ADM transparency obligation now

The ADM transparency obligation represents a significant new compliance requirement. With the deadline of 10 December 2026 approaching, entities should take the following steps now (which can be tested and validated following the release of the OAIC’s Guidance) to prepare:

1. Audit ADM use cases. Conduct a comprehensive audit to identify where automated systems are used to make or materially influence decisions about persons (whether such systems are used by your organisation directly or by a third-party service provider on your behalf).
    
2. Assess which decisions cross the ‘significantly affect’ threshold. Determine which automated processes could reasonably be expected to significantly affect persons’ rights or interests.
    
3. Update privacy policies. Prepare draft updates to privacy policy disclosures that meet the specificity required by the new APP 1.8. Generic statements about ‘using technology to improve services’ will not suffice. Disclosures need to be clear and easy to understand.