What changes on 10 December 2026 when AI helps decide about people

What changes on 10 December 2026

The change arrives with a date, and the OAIC states it plainly: on 10 December 2026, APP entities must include information in their privacy policy where they have arranged for a computer program to make or inform decisions that significantly affect individuals' rights or interests. The obligation was introduced by the Privacy and Other Legislation Amendment Act 2024, within APP 1 of the Australian Privacy Principles, to include information about computer program usage in an APP entity's privacy policy. Where an APP entity has arranged for an AI personal assistant to make, or do a thing substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, using personal information about them, it is the kind of program this clause is about.

The Act's own words for the new clause, and for the information it requires, are these.

1.7 Without limiting subclause 1.3, the APP privacy policy of an APP entity must contain the information covered by subclause 1.8 if:

1. the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; and
2. the decision could reasonably be expected to significantly affect the rights or interests of an individual; and
3. personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.

1.8 The information covered by this subclause is:

1. the kinds of personal information used in the operation of such computer programs; and
2. the kinds of such decisions made solely by the operation of such computer programs; and
3. the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs.

Three readings from the OAIC's APP 1 guidelines make the clause easier to apply. First, computer program takes its ordinary meaning, and the definition is broad: a wide range of technologies is likely to fall within it, including commonly used software, apps or word-processing tools, and generative AI tools used to generate text, images, videos, code or synthesis, including chatbots and other types of AI, fall within it for the purpose of the APP 1.7-1.9 transparency obligation.

Second, significantly has a working test. Significantly means the impact of the decision or thing must be more than trivial and must have the potential to considerably influence the circumstances or outcomes for the individual concerned.

Third, arranged for places the duty on the right party. The words clarify that it is the entity responsible for arranging the computer program to make, or do a thing that is substantially and directly related to making, a decision, which must meet the requirements in APP 1.7, and the OAIC generally expects that the APP 1.7-1.9 transparency obligation typically remains with the APP entity who is using personal information to make a decision or do a thing that significantly affects the rights or interests of an individual.

One limit is stated as well: the obligation does not require APP entities to include information in APP 1 privacy policies that is commercially sensitive, or that would expose trade secrets.

How this date arrived

The Privacy Act has been changing in stages, and this obligation is one stage of that work. In order:

1. 10 June 2025The OAIC records the date for this change: changes to the Privacy Act which introduced a statutory tort for serious invasions of privacy commenced.
2. 21 October 2025The Department of Industry, Science and Resources published the Guidance for AI Adoption, which sets out six practices for safe and responsible AI governance, as updated and simplified guidance for industry that evolves the Voluntary AI Safety Standard.
3. 10 December 2026The OAIC states the date: on 10 December 2026, APP entities must include information in their privacy policy where they have arranged for a computer program to make or inform decisions that significantly affect individuals' rights or interests.

The adoption guidance gives the premise the whole area works from: AI systems can make automated decisions that can significantly affect people, communities and businesses.

The government’s own hiring example

One example, given as an example and never as advice on any decision. The adoption guidance uses hiring: an AI system used for shortlisting that has a bias problem could unfairly reject hundreds of qualified candidates before anyone notices.

The OAIC's guidance carries the companion duty for a business that does use AI to assist with recruitment: if you do use AI to assist with recruitment, you must implement controls to ensure that outputs are accurate and not biased and that the risk of any inaccuracy is considered. Put beside the hiring example, the two lines read as one instruction: the program may support the decision, and the controls, and the accountability, stay with the business.

Who the duty binds

The duty binds APP entities only. This guide does not say whether your business is one.

And the parenthesis the OAIC adds to its definition of an organisation is the one a private user needs: generally, the Privacy Act doesn't apply to an individual acting in a personal capacity. So the duty described in this guide is an entity's duty, not a household's. A person using an AI assistant in a personal capacity is, on the OAIC's own qualification, generally outside the Act's reach.

When to get advice

The guidance's own line closes this guide: where legal obligations around AI systems are unclear, the National AI Centre's advice is to seek legal advice, starting with the organisation's own legal team.

The 10 December 2026 date is not a reason to wait until December 2026. The policy work starts with the same two questions this guide opened with: which of the business's programs make, or substantially and directly relate to making, decisions about people, and what kinds of personal information do they use.