What Australia's December 2026 AI Requirements Mean for Your Business

From 10 December 2026, affected Australian Privacy Principles (APP) entities must include information about certain automated decisions in their privacy policies. This is a transparency obligation, not a blanket requirement applying to every business that uses AI.

When the obligation applies

The OAIC guidance published on 30 September 2026 sets out three conditions:

• The entity has arranged for a computer program to make a decision, or do something substantially and directly related to making it.
• The decision could reasonably be expected to significantly affect an individual's rights or interests.
• Personal information about that individual is used by the program in making the decision or doing the relevant thing.

Being an APP entity and meeting these conditions matter. Using ChatGPT to draft a generic agenda does not, by itself, establish that the obligation applies. Decision support can require review even when a person makes the final decision.

What the privacy policy must describe

Where the conditions apply, the policy must describe the kinds of personal information used, the kinds of decisions made solely by computer programs, and the kinds of decisions for which a program does something substantially and directly related to making the decision.

Your qualified privacy or legal adviser should determine applicability and wording. An inventory and evidence of actual system use can support that work.

Practical preparation

1. List relevant tools and workflows, including embedded software features.
2. Record the information involved and how each output influences a decision.
3. Identify the owner, human-review steps and existing records.
4. Flag potentially significant decisions for specialist review.
5. Keep the approved privacy wording consistent with how the systems actually operate.

These preparation steps can improve visibility even when this particular obligation does not apply. They are not a substitute for legal review.

Copilot and data access are a separate governance question

Copilot permission hygiene and confidential-data boundaries are useful controls in their own right. They should not be presented as automatically triggering the December obligation. Assess the actual workflow, information and decision impact.

Choose a starting point

Use the free AI governance check to find a practical first action, or inspect the AI Governance Risk Snapshot for a bounded evidence review. No system access or unredacted client files are requested for the Snapshot.

Last reviewed: 9 October 2026. This article provides practical governance guidance, not legal advice.