AI Framework

APP 1.7: What to Disclose Before 10 December 2026

8 October 2026

From 10 December 2026, APP 1.7 requires organisations covered by the Privacy Act to disclose in their privacy policy when a computer program makes, or substantially supports, a decision that could significantly affect someone's rights or interests. Three things must be disclosed: the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds of decisions it substantially supports.

Updated 8 October 2026: the OAIC published its final guidance on 30 September, a fact sheet, a flowchart and updated APP 1 guidelines. This page now reflects it.

If you searched "automated decision making privacy act," this is it. Australian Privacy Principle 1 covers how an organisation manages personal information generally - see the full list of all 13 APPs for where this sits in the wider framework. From 10 December 2026, three new subsections of APP 1 - 1.7, 1.8 and 1.9 - add a specific requirement: disclosing when automated systems are involved in decisions about people.

Who it applies to

APP 1.7 binds APP entities - organisations covered by the Privacy Act. That is generally businesses with annual turnover above $3 million. A business that has exceeded $3 million in any year since the exemption began generally stays covered, even if turnover drops back.

Smaller businesses are usually outside the Privacy Act, but some are caught regardless of turnover. Examples include businesses that provide a health service and hold health information, businesses that disclose or collect personal information for a benefit, contracted service providers to the Commonwealth, and credit reporting bodies. Businesses that became anti-money laundering reporting entities on 1 July 2026 are covered for the personal information they handle for those obligations - not for the whole business.

If your business isn't an APP entity, APP 1.7 doesn't apply to it. Working out whether it is comes first.

What actually triggers the obligation

The APP 1.7 test has three elements, all of which must be present. A computer program has to be arranged to make, or substantially and directly help make, a decision. That decision has to be one that could reasonably be expected to significantly affect someone's rights or interests. And personal information about that person has to be used to make it. If any one of the three is absent, the obligation under APP 1.7 is not triggered for that system.

"Computer program" is deliberately broad. The OAIC's fact sheet lists pre-programmed rule-based processes, AI and machine learning, software, apps and word-processing tools, and generative AI, including chatbots. A rules-based CRM that scores leads, an automated eligibility checker or a chatbot that triages support requests can all qualify, depending on what they're deciding and whether personal information feeds into it.

The APP 1.7 trigger test - all three must be true

What the final guidance confirms

The OAIC's final guidance didn't narrow anything. Four points stand out for business owners.

A spreadsheet can count. The fact sheet's first worked example is a health and aged care provider using a spreadsheet formula to score and rank clients for triage. It's in scope. So is using the same ranking to decide who not to contact.

Software you buy is still your responsibility. Buying, configuring or relying on a third-party program counts as "arranging for" it. The OAIC expects the disclosure to sit with the organisation making the decision, and says software providers should give their clients clear, high-level information about how their tools make decisions. If you use vendor software that scores, screens or ranks people, ask your vendor for that information.

Advice counts as well as automation. A program can be in scope whether its output is advisory or determinative - if it advises on, determines or otherwise influences the outcome.

If in doubt, include it. The OAIC's advice to entities unsure whether a program is in scope is to take a cautious approach and include it in the privacy policy.

The misconception that trips up most businesses

A human reviewing the automated output does not automatically remove the disclosure obligation. The OAIC says a decision may be in scope "even where a computer program output does not replace the entire decision-making process or is subject to human review."

Its worked example: a sales team's bonuses are suggested by a generative AI tool, HR oversees the process and a director approves every decision in writing. It's still in scope, because the tool's recommendation is relied on as a key factor.

There is a limit. The OAIC says the same output could fall outside scope if staff did the real work themselves - interrogating the output, reviewing the underlying information, using other evidence and documenting why they departed from the recommendation. It also says machine learning and generative AI outputs used in significant decisions would generally be in scope "unless subject to extensive human oversight and control." A signature at the end is not that.

What you actually have to disclose

Three things, and only three things, under APP 1.8: the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds of decisions the program substantially supports. "Kinds," not specifics - this is a category-level disclosure, not a line-by-line audit trail of every decision made.

You can group decisions and kinds of information into categories, but the OAIC says the result must be meaningful to a reasonable person, and the use of more sensitive information, such as health information or biometrics, should be clear. The fact sheet includes sample privacy policy wording.

Do you have to reveal how your system actually works?

No. This is worth stating plainly because it's the fear most likely to stop a business owner from taking this seriously. Commercial-in-confidence information about a computer program is excluded, as the Explanatory Memorandum to the amending Act noted and the OAIC's fact sheet confirms. The obligation covers the kind of decision and the kind of data - not a scoring formula, model weights or a vendor's proprietary logic.

The exclusion has limits. The OAIC says that standard practices, such as using personal information for fraud detection, aren't commercial-in-confidence, and information that would merely cause embarrassment or public criticism isn't excluded either.

Which of your tools actually count?

A short checklist, since "automated decision-making" sounds more exotic than it usually is in practice:

If personal information feeds into any of these and the outcome could significantly affect someone, APP 1.7 may be relevant. The OAIC's own list of decisions generally in scope includes recruitment screening, loan and credit approvals, insurance eligibility, differential pricing of significant goods, and AI-generated reports used to rank employee performance or set pay.

What happens if a business doesn't comply

The penalties that apply are the same general Privacy Act regime that already covers privacy policies - there's no separate, higher figure specifically for missing ADM disclosure. Infringement notices for a privacy policy missing required content run to 200 penalty units - around $72,800 at current rates (the OAIC quoted $66,000 in late 2025, before the July 2026 indexation). Civil penalties for serious or repeated breaches can scale much higher under the 2024 amendments - but that's the general serious-breach maximum, not a number specific to this requirement.

There's also no separate grace period after 10 December 2026. The roughly two years since the amending Act passed in 2024 is the lead-in time businesses have had - Commissioner Carly Kind has described it publicly as "a small change but really important for businesses." Once the date arrives, it arrives.

Separately, and worth not confusing with this requirement: the OAIC's first privacy compliance sweep started in January 2026, checking around 60 businesses across sectors like real estate, pharmacies and car dealerships for basic privacy policy adequacy under APP 1.4. That sweep isn't checking automated decision-making disclosure - it can't yet, since the obligation doesn't commence until December. But it's a real, current sign the regulator is actively checking privacy policies.

If you want the full picture of what applies to your specific business beyond this one requirement, AI Framework maps it against the Commonwealth and state instruments that apply to your industry in one pass.

FAQ

Does this apply to every business? No. It applies to organisations covered by the Privacy Act - generally those with turnover above $3 million, plus some smaller businesses caught for other reasons. See "Who it applies to" above.

Does a chatbot or lead-scoring tool count as automated decision-making? It can, if personal information feeds into it and the outcome could significantly affect someone - regardless of whether the tool uses AI or simple rules. Check it against the three-part APP 1.7 test above.

Does a spreadsheet count? It can. The OAIC's first worked example is a spreadsheet that scores and ranks clients for triage, and it's in scope. A spreadsheet that only adds up numbers probably wouldn't be - it's the scoring that drives a decision that brings it in.

If a human reviews the automated output, are we exempt? Not automatically. The OAIC says a decision can be in scope even when the output is subject to human review. Only genuinely extensive oversight - where people do the real deciding and document it - may take it outside.

We bought the software. Isn't disclosure the vendor's job? No. The OAIC expects the disclosure to sit with the organisation making the decision. Your vendor should give you high-level information about how the tool works so you can describe it.

Do we have to disclose how our algorithm or scoring system works? No. The disclosure covers the kinds of personal information used and the kinds of decisions made - not the internal logic, model, or vendor's proprietary system.

If we already comply with the GDPR or the EU AI Act, are we covered? No - APP 1.7 is a separate Australian test with its own three-part definition. Compliance with an overseas framework doesn't automatically satisfy it.

Is there a grace period after 10 December 2026? No. The roughly two years since the 2024 amending Act passed is the only lead-in time - there's no further leniency window once the requirement commences.

For a broader view of how Australian privacy law applies to AI, see Data privacy regulations in Australia.

This page covers one requirement. To see which Commonwealth and state laws apply to your business's use of AI, start with AI Framework.

This post is general information, not legal advice.

Current as at October 2026.

← Back to Insights