Australia's AI disclosure deadline: what to do before 10 December.

01What the law requires

The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. It added three subclauses to Australian Privacy Principle 1, which governs privacy policies. The OAIC's updated guidelines, published on 30 September 2026, confirm they apply from 10 December 2026.

APP 1.7 sets the trigger. All three conditions have to be met.

1. The organisation has arranged for a computer program to make a decision, or to do a thing that is substantially and directly related to making a decision.
2. The decision could reasonably be expected to significantly affect the rights or interests of an individual.
3. Personal information about that individual is used in the operation of the program.

APP 1.8 says what the privacy policy must then contain. It must list the kinds of personal information used in those programs and the kinds of decisions made solely by them. It must also list the kinds of decisions where they do something substantially and directly related to making the decision.

APP 1.9 fills in the terms. Making a decision includes refusing or failing to make one. An effect counts whether it helps or harms the person. Its examples include a decision about a benefit under an Act, a decision that affects someone's rights under a contract, and a decision that affects their access to a significant service or support.

02Who it covers

The obligation applies to APP entities: Australian Government agencies, and organisations with an annual turnover above $3 million. Some smaller businesses are covered whatever their turnover, including health service providers and businesses that trade in personal information. Most small businesses under the threshold are outside it.

03Why AI agents are in scope

The OAIC's fact sheet on the obligation, published in September 2026, says a computer program includes rule-based processes, artificial intelligence and machine learning, and generative AI used to produce text, images or code, including chatbots.

Three points in the guidance matter for anyone running agents.

• Human review does not take a decision out of scope by itself. A decision can be covered even where the program's output is reviewed by a person, or does not replace the whole decision.
• Advice counts. The OAIC reads substantially as a key factor in facilitating the human's decision. An agent that scores, ranks, triages or recommends can meet that test.
• Buying it counts. Arranging for a program includes procuring a third-party one and relying on its outputs, and the transparency duty generally stays with the organisation using the personal information, not the vendor.

The OAIC considers machine learning and generative AI outputs used to make decisions that significantly affect people would generally fall within scope, unless subject to extensive human oversight. Where it is unclear, its advice is to take a cautious approach and include the information.

04A checklist before 10 December

1. List every system and AI agent that uses personal information, with an owner for each.
2. Include what you buy. Third-party programs, and AI features inside licensed software, count when you rely on their outputs.
3. For each, write down the decisions it makes or helps make about individuals, and how a person reviews the outcome.
4. Mark the decisions that could reasonably be expected to significantly affect someone's rights or interests.
5. Record the kinds of personal information each of those systems uses.
6. Draft the privacy policy wording with your privacy officer and lawyer, in the categories APP 1.8 sets out. Commercial-in-confidence detail about the program itself is not required.
7. Set a review trigger, so a new agent or a changed one is checked against the policy before it runs.
8. Brief the board on what was found, what the policy now says, and who owns keeping it true.

05For APRA-regulated entities

Banks, insurers and superannuation trustees have a second reason to keep the list. APRA's letter to industry on AI, sent on 30 April 2026, asks regulated entities to establish an inventory of AI tooling and AI use cases with ownership and accountability across the AI lifecycle. It also asks them to keep visibility over the AI supply chain.

06After 10 December

The policy is a statement about what your systems do. It stays true only if every new agent, and every change to an existing one, is checked against it. That makes the agent inventory the control that keeps the disclosure accurate, and the approval path the place the check happens.