Australian Privacy Principles and AI Agents: What Changes in December 2026
Last updated: August 2026.
If you run an AI agent that touches customer information, there is a date worth putting in your calendar: 10 December 2026. That is when new automated decision-making transparency obligations under the Privacy Act 1988 take effect, and they are drafted more broadly than most business owners assume.
On This Page
Written by Dr Priya Jaganathan — Go High Level Certified Admin, Certified AI Tech Stack Consultant and keynote speaker. This is an operations guide, not legal advice. Privacy obligations depend on your specific circumstances, and you should confirm your position with a qualified adviser.
What is actually changing
In 2024 the Privacy and Other Legislation Amendment Act amended the Privacy Act 1988 to add a transparency requirement around automated decision-making. It commences on 10 December 2026.
In plain terms: if your business uses personal information in an automated process that makes — or substantially helps make — a decision affecting someone's rights or interests, your privacy policy has to say so. Specifically it must set out the kinds of personal information involved, the kinds of decisions made, and how someone can request meaningful human review.
This is a disclosure obligation, not a prohibition. You are not being told to stop automating. You are being told to be transparent about it in a place customers can find.
The OAIC has indicated it intends to publish guidance on these requirements by September 2026, so expect more detail shortly. It is also worth noting the regulator has become more active generally — in January 2026 the OAIC ran its first privacy compliance sweep, covering around 60 organisations across six sectors.
Does it apply to your business?
Two questions decide it.
First, are you an APP entity? Most Australian businesses with annual turnover above $3 million are, along with health service providers of any size and certain other categories regardless of turnover. Small businesses under the threshold are often exempt — but the exemption is narrower than many owners believe, and handling health information removes it.
Second, do you use personal information in automated decision-making that could affect rights or interests? This is the question worth thinking about carefully rather than dismissing.
Commentary on the amendments notes they are broadly cast, capturing a range of technologies used to automate decisions — AI-enabled systems, rule-based tools and automated assessment technologies alike. A scoring rule in your CRM is not obviously outside this simply because no machine learning is involved.
What counts as an automated decision
This is where most businesses will need to think rather than assume. Some examples worth examining in your own setup:
An agent that qualifies enquiries and routes low scores to a nurture sequence rather than a consultation is making a decision that affects whether someone gets your service. An automated system that declines a booking based on postcode affects access. A rule that flags a customer as high risk and changes how they are handled affects their treatment.
Conversely, an agent that books an appointment into an available slot, sends a reminder, or answers a question about your opening hours is not deciding anything about the person.
The test to apply is whether the automated step changes what happens to that individual in a way they would care about — not whether the technology is sophisticated.
| Automated step | Worth reviewing? | Why |
|---|---|---|
| Booking an appointment in a free slot | Unlikely | No decision about the person |
| Sending a reminder | Unlikely | Administrative |
| Scoring and routing an enquiry | Yes | Affects access to your service |
| Declining a booking on rules | Yes | Directly affects the individual |
| Flagging a customer as high risk | Yes | Changes their treatment |
| Automated eligibility assessment | Yes, clearly | Core example of ADM |
If you want your automation mapped against this before December, book a CRM transition call — though take formal advice on your obligations.
What to do before December
1. Write down every automated step that touches a person. Most businesses have never listed these. Include CRM scoring rules and workflow conditions, not just the obvious AI agent.
2. Mark which ones affect rights or interests. Access to a service, pricing, prioritisation, risk treatment. When genuinely unsure, treat it as in scope and take advice.
3. Check whether you are an APP entity. Turnover, sector and the type of information you hold all matter, and health information changes the answer for small businesses.
4. Update your privacy policy with the three required elements. Kinds of personal information used, kinds of decisions made, and how someone requests meaningful human review.
5. Build a real human review path. A policy promising review is worthless if nobody at your business can actually reconsider a decision. Name who does it and how a request reaches them.
6. Watch for the OAIC guidance. It was expected by September 2026 and will sharpen the practical detail considerably.
The APP basics that already applied
The December change sits on top of obligations that have applied all along, and which AI deployments frequently stumble over.
Collect only what you need — an agent that asks five unnecessary questions is collecting personal information without a clear purpose. Tell people what you are collecting and why, at the point of collection. Keep it secure, including wherever your vendor stores conversation transcripts. And be able to provide or correct someone's information on request, which means knowing where your transcripts actually live.
The vendor question is the one most businesses skip: where is the data stored, who can access it, how long is it retained, and is it used to train models? Get those answers in writing before you deploy, not after a customer asks.
Related reading: our guides on AI disclosure and AI and Australian Consumer Law cover the adjacent obligations.
Frequently Asked Questions
What changes for AI under the Privacy Act in December 2026?
From 10 December 2026, APP entities using personal information in automated decision-making that could affect an individual's rights or interests must disclose in their privacy policy the kinds of personal information used, the kinds of decisions made, and how someone can request meaningful human review. It came in through the Privacy and Other Legislation Amendment Act 2024.
Does this apply to small businesses?
It applies to APP entities. Many businesses with turnover under $3 million fall outside, but the small business exemption is narrower than commonly assumed and does not apply to health service providers regardless of size. Check your status rather than assuming.
Does it only cover AI, or rule-based systems too?
Commentary on the amendments notes they are broadly cast and capture a range of automating technologies, including rule-based tools and automated assessment systems — not only AI. A longstanding scoring rule in your CRM may be in scope.
Do we have to stop using automated decisions?
No. This is a transparency obligation rather than a prohibition. You must disclose what you are doing and provide a path to meaningful human review, not cease automating.
What does "meaningful human review" require in practice?
The practical detail is expected to be clarified by OAIC guidance. As a working approach, someone at your business should be able to genuinely reconsider a decision rather than simply restate it, and customers need a clear route to ask.
Is an AI receptionist that books appointments in scope?
Booking into an available slot or sending reminders is administrative and unlikely to be an automated decision affecting rights or interests. Scoring an enquiry and routing some people away from your service is a different matter and is worth reviewing.
What should we ask our AI vendor?
Where data is stored, who can access it, how long transcripts are retained, whether conversations are used for model training, and whether they can export or delete an individual's data on request. Get these in writing before deploying.
If you're not sure which of your automations are in scope, that's worth mapping before December. Book a CRM transition call, or see how we work at Pivot 2 Thrive.
Related Articles
Services
Related guides
- AI Disclosure: What to Tell Your Customers
- AI and Australian Consumer Law
- AI Automation for Australian Law Firms
- When Not to Automate: Five Signs
More
