08 October 2026
5 min read
#Australian Government, #Corporate & Commercial Law, #Data & Privacy
Published by:
Government agencies have until 10 December 2026 to ensure their privacy policies explain relevant uses of automated decision-making (ADM). On 30 September 2026, the Office of the Australian Information Commissioner (OAIC) released updated APP 1 Guidelines, clarifying how agencies should assess computer-assisted decisions and describe them publicly.
Our earlier article examined ADM reporting under the Freedom of Information Act 1982 (Cth). The new guidance explains the privacy-policy disclosures required, including where an officer makes the final decision, a vendor supplies the software, or several programs contribute to one outcome.
The Privacy and Other Legislation Amendment Act 2024 (Cth) inserted APPs 1.7-1.9 into the Australian Privacy Principles. From 10 December 2026, under APP 1.7, additional privacy-policy information is required where:
Schedule 1, item 89 of the amending Act applies the obligation to decisions made after commencement, even where the program arrangements, use of personal information or acquisition of that information occurred earlier. Agencies must therefore assess existing systems.
For APP 1.7(a), the OAIC has provided guidance regarding whether an entity has arranged for a computer to make a decision or do a thing ‘substantially and directly’ related to making a decision. The OAIC guidance indicates that ‘substantially’ denotes a key factor in facilitating human decision-making, and ‘directly’ requires a direct connection with the decision. Advisory outputs can satisfy both requirements.
The OAIC considers machine learning and generative AI outputs used in decisions that significantly affect individuals will generally be captured, unless those outputs are subject to extensive human oversight and control.
For example, AI-generated remuneration recommendations remain within scope where managers rely on them, despite human resources oversight and director approval. Interrogating outputs, independently examining underlying evidence and documenting reasons for departing from recommendations may indicate a less than substantial contribution. A formal capacity to override an output does not, by itself, resolve how substantially it influences the decision.
Conversely, software used merely to record an independently made decision is outside the scope described in the guidance.
The term ‘computer program’ extends to rule-based processes and everyday software. The OAIC illustrates this with spreadsheet formulas that score individuals using personal and health information, then rank them for health or aged-care support. Using those rankings to decide whom to contact, or whom not to offer support, brings the process within scope.
Procuring, configuring or relying on third-party software may constitute having ‘arranged for’ a computer program to make a decision. The OAIC guidance provides a housing-allocation example which confirms that an entity need not control or customise the program’s decision parameters to attract the obligation.
Responsibility generally remains with the entity using personal information to make the relevant decision. Agencies should obtain sufficient information from suppliers about the personal information processed and decisions supported.
Under APP 1.9, for the purposes of APP 1.7, ‘making a decision’ covers beneficial and adverse effects and refusing or failing to make a decision or do a thing. Approving a benefit or excluding someone from consideration may therefore be captured.
‘Significance’ requires more than a trivial effect, with the potential to considerably influence the individual’s circumstances or outcomes. Vulnerability and dependence on essential services matter when assessing that impact.
The OAIC has provided supplementary guidance for government agencies. For administrative decisions, the OAIC draws attention to section 4 of the Administrative Review Tribunal Act 2024 (Cth), which includes licence refusals, approval decisions and imposed conditions within ‘decision’. It considers most automated decisions within that definition likely to significantly affect individuals.
From commencement of the provisions, APP 1.8 will require disclosure of:
Categories may be grouped, but the explanation must remain meaningful to a reasonable person. A single platform or report may combine several programs and decision stages; agencies should examine those underlying processes when preparing disclosures.
The OAIC guidance provides an indication of the level of detail expected. The guidance sets out a border-processing example which lists identity, travel and criminal-record information used for visa and entry decisions. These are separately listed to the use of photographs and facial-recognition templates for border access and watchlist matching.
The OAIC also distinguishes commercially sensitive technical details, such as proprietary data weightings, from disclosable information about the personal information used and decisions made.
Part 13 of the FOI Guidelines now expressly addresses ADM and generative AI. Agencies should cross-link relevant Information Publication Scheme disclosures with their privacy policies, while ensuring the required personal-information and decision categories are explained.
An AI transparency statement under the Policy for the responsible use of AI in government may not contain sufficient detail to support APP compliance. The OAIC guidance notes that for example, “decision-making and administrative action” and a brief overview, may be sufficient for the AI statement, however this should be expanded for an agencies’ privacy policy to identify eligibility decisions for government support payments and the personal information involved. Non-AI programs may also require privacy disclosure.
Before commencement, agencies should:
Agencies should also monitor further guidance as the Attorney-General’s Department develops a whole-of-government ADM framework.
If you have any questions or thoughts on the new requirements relating to ADM, please contact us here.
Disclaimer
The information in this article is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, we do not guarantee that the information in this article is accurate at the date it is received or that it will continue to be accurate in the future.
Published by:
