On 10 December 2026, a quiet clause in Australian privacy law switches on, and it will touch almost every organisation that uses software to make judgements about people. I want to be precise about what it is, because a lot of the commentary online either overstates it or dismisses it. Neither is useful to a board, a CTO or a veteran advocate trying to get their house in order.
What is actually changing
The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. Most of its measures started straight away. One was given a two year runway: a new automated decision making transparency obligation inside Australian Privacy Principle 1. That runway ends on 10 December 2026.
From that date, an APP entity must include information in its privacy policy where three conditions are met. First, the organisation has arranged for a computer program to make a decision, or to do something substantially and directly related to making a decision. Second, that decision could reasonably be expected to significantly affect the rights or interests of an individual. Third, personal information about that individual is used in the process.
Where those conditions are met, the privacy policy must describe the kinds of personal information used by those programs, the kinds of decisions made solely by a computer program, and the kinds of decisions where a computer program does something substantially and directly related to the decision.
So, is this an AI notification law?
Yes and no. It is a disclosure obligation, and AI is squarely inside it, but it is broader than AI. The Office of the Australian Information Commissioner released an Issues Paper on 18 May 2026 and signalled that "computer program" should be read broadly. That includes AI systems, generative AI tools and chatbots, but also ordinary software, rules engines and workflow tools. A spreadsheet with a scoring formula that decides who gets a callback can be in scope.
It is also important to be honest about what the obligation does not do. It does not create a right to a human review. It does not create a right to contest the decision. It does not require an individual notice to each person at the moment a decision is made. The duty sits in the privacy policy. That is lighter than Article 22 of the GDPR, but it is enforceable, and failure to maintain a compliant APP 1 policy sits inside the civil penalty framework that the same Act strengthened.
Human in the loop is not a get out of jail card
This is the part most organisations get wrong. The obligation captures decisions that are substantially and directly assisted by a program, even when a person signs off. If a model ranks claims, triages applications, flags fraud risk or pre fills an eligibility outcome, and a staff member usually accepts it, that is in scope. Rubber stamping does not remove the program from the decision.
What counts as a significant effect
The Explanatory Memorandum and the OAIC point to decisions about benefits and entitlements, access to services, contractual rights, employment, housing, insurance, credit and health care. In the veteran ecosystem that list reads like a daily workload: claims preparation, needs assessments, service eligibility, triage and referral. If you touch those decisions with software, you should assume you are covered until your legal advice says otherwise.
The other December milestones
The same Act required the OAIC to develop a Children's Online Privacy Code within two years of commencement, so December 2026 is also the deadline point for that code, which will apply to online services likely to be accessed by children. It sits alongside reforms already live: the statutory tort for serious invasions of privacy, the higher penalty tiers, OAIC infringement notices, and the criminal offences for doxxing. December 2026 is not a standalone event. It is the point where transparency catches up with enforcement powers the regulator already has.
What I would do between now and 10 December
1. Build an inventory of every system that touches a decision about a person. Include AI tools, vendor platforms, rules engines, macros and spreadsheets. Shadow AI counts.
2. For each system, trace the data. What personal information goes in, what comes out, and who acts on it.
3. Classify the decision. Is it solely automated, substantially assisted, or merely informational? Record the reasoning so you can defend it.
4. Test for significant effect. Be conservative. If a person could lose access to a service, an entitlement or an opportunity, treat it as significant.
5. Rewrite the privacy policy in plain English. Name the kinds of decisions and the kinds of data. Avoid vague language like "we may use technology to improve our services". The OAIC has made it clear that it expects clarity.
6. Put vendor contracts on notice. If a supplier's model is shaping your decisions, you need to know what it does, where it runs, and what data it sees.
7. Govern it continuously. A policy that is accurate on 10 December and stale by March is not compliant. Tie model changes and new tools to a change control step that triggers a policy review.
Why this matters to people who hold sensitive data
At Keytech Intelligence we build ingestion and decision support for the veteran ecosystem through Valour Keystone. Veteran medical and service records are some of the most sensitive data in the country. Our position has always been that if software helps shape an outcome for a veteran, that veteran deserves to know. We design for that from the ground up: every model assisted step is logged, the data used is classified at intake, and a qualified human owns the final call. The law is now moving toward the standard we already hold ourselves to, and that is a good thing.
The bigger point is trust. Australians are increasingly comfortable with automation when it is visible and accountable, and deeply uncomfortable when it is hidden. Transparency is not a compliance cost. It is the price of being allowed to use these tools on people at all.
Related reading on Deep Tech Australia
How veteran medical data should be protected, and what to ask your advocate: https://ausdeeptech.org/insights/veteran-medical-data-protection-what-to-ask-your-advocate
Veteran data is not test data: lessons from the GoTo Health breach: https://ausdeeptech.org/insights/goto-health-breach-veteran-data-sovereign-governance
Ingestion intelligence and Valour Keystone: https://ausdeeptech.org/insights/ingestion-intelligence-valour-keystone-sovereign-data
A reference architecture for MSPs in the veteran space: https://ausdeeptech.org/insights/msp-reference-architecture-veteran-data-sovereignty
Building governable AI systems: https://ausdeeptech.org/insights/building-governable-ai-systems
The seven pillars of responsible AI: https://ausdeeptech.org/insights/seven-pillars-responsible-ai
Sovereign AI: why Australia must lead: https://ausdeeptech.org/insights/sovereign-ai-australia-must-lead
Primary and authoritative sources
OAIC, Privacy Act reforms overview: https://www.oaic.gov.au/privacy/privacy-legislation/privacy-act-reforms
OAIC, Australian Privacy Principles: https://www.oaic.gov.au/privacy/australian-privacy-principles
OAIC, Guidance on privacy and the use of commercially available AI products: https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products
OAIC, Children's Online Privacy Code: https://www.oaic.gov.au/privacy/privacy-registers/privacy-codes/childrens-online-privacy-code
Privacy and Other Legislation Amendment Act 2024 (Cth), Federal Register of Legislation: https://www.legislation.gov.au/C2024A00128/latest/text
Attorney-General's Department, Privacy Act Review: https://www.ag.gov.au/rights-and-protections/privacy
Department of Industry, Science and Resources, Australia's AI Ethics Principles: https://www.industry.gov.au/publications/australias-artificial-intelligence-ethics-principles
Department of Industry, Science and Resources, Voluntary AI Safety Standard: https://www.industry.gov.au/publications/voluntary-ai-safety-standard
Digital Transformation Agency, Policy for the responsible use of AI in government: https://www.digital.gov.au/policy/ai/policy
Australian Cyber Security Centre, Essential Eight: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight
Legal analysis
Bird and Bird on the OAIC Issues Paper: https://www.twobirds.com/en/insights/2026/australia/australias-new-adm-transparency-obligation-oaic-signals-a-broad-reading-ahead-of-december-2026
Norton Rose Fulbright on the ADM obligation: https://www.nortonrosefulbright.com/en/knowledge/publications/a2769c39/oaic-consults-on-the-new-automated-decision-making-transparency-obligation
Hamilton Locke on preparing before December 2026: https://hamiltonlocke.com.au/transparency-in-automated-decision-making-what-regulated-entities-need-to-know-and-do-before-december-2026/
HWL Ebsworth on the new ADM disclosure rules: https://hwlebsworth.com.au/can-i-speak-with-a-human-please-preparing-for-the-new-automated-decision-making-disclosure-requirements/
About the author
Shaune Irving is CTO of Keytech Intelligence and the engineering lead behind Valour Keystone. Author profile: https://ausdeeptech.org/author/shaune-irving
Keytech Intelligence: https://keytechintelligence.com.au
Valour Keystone: https://valourkeystone.com.au
Shaune Irving on LinkedIn: https://www.linkedin.com/in/shaune-irving
This article is general information and not legal advice. Disclosure: Shaune Irving is CTO of Keytech Intelligence, which builds Valour Keystone.
