From December, Your AI Pricing Tool May Have to Own Up

You have just over 100 days. From 10 December 2026, a new transparency rule in the Privacy Act can require you to disclose, in writing, when software makes an automated decision that significantly affects a customer — and a personalised price set from that customer's own data is exactly the kind of decision the regulator has in its sights. That obligation lands on top of one you already carry: under the Australian Consumer Law, a personalised price that misleads is a Section 18 breach, with a maximum company penalty of the greater of $100 million, three times the benefit, or 30% of turnover.

So the AI quoting or pricing tool sitting inside your software now touches two regulators at once. One asks whether the price is honest. The other, from December, asks whether you've told the customer a machine is deciding it. Most owners have thought about neither.

The new rule sits in Australian Privacy Principle 1. From 10 December, an APP entity that uses personal information in an automated decision which "could reasonably be expected to significantly affect the rights or interests of an individual" must update its privacy policy to spell out the kinds of personal information used and the kinds of decisions made. The OAIC's final guidance is due this month, and its consultation has already signalled a broad reading — "significantly affect" is meant to catch more-than-trivial impacts on a person's financial circumstances and their rights under a contract. A price is the core term of a contract. Read that way, a fully automated personalised price is squarely in frame.

It doesn't arrive in isolation. On 20 July the federal government named "retail surveillance pricing" one of five AI consumer-safety priorities it will examine under the Consumer Law, and the ACCC's standing position is already clear: dynamic and personalised pricing isn't illegal in itself, but you "must be clear about the price consumers will pay and must not make false or misleading pricing claims." We covered where that Consumer Law line falls in detail; December adds a second, separate duty — not whether the price is fair, but whether you've disclosed how it's set.

Want to know what this means for your business? We'll map it in one call.

Here's the honest scoping, because it decides whether the December rule touches you at all. The Privacy Act's automated-decision duty applies to APP entities — generally businesses turning over more than $3 million a year. Under that line, most sole traders and small firms sit outside it. Two exceptions bite regardless of size: health service providers (an AI-scribing clinic, a physio practice) and any business that trades in personal information are covered whatever their turnover.

But the Consumer Law has no turnover gate. Every business, from a solo sparky to a 40-person firm, already carries the misleading-pricing exposure — so no reader is off the hook, only differently exposed. If you're over $3 million and your quoting tool personalises, you have both duties. If you're under it, you have one. Either way the practical question is the same, and it's one most owners can't yet answer: does the software set a customer's price from who they are, rather than what the job is?

That's the trap worth naming. Trades and professional-services owners rarely built the pricing engine — it came bundled in the quoting, booking or CRM platform they renew every month, and it may already flex a number by postcode, device or past spend without anyone switching it on deliberately. The vendor's tool doesn't inherit the liability — you do. If you can't yet explain how your software lands on a number, that's the conversation to have before December, not after.

You don't need to rip out AI pricing. You need to be able to answer three questions. First, ask your vendor plainly: does this tool use a customer's personal information — postcode, device, history — to set or adjust a price? Second, if it does, make sure the reason you'd give a customer is about the job, not about them: complexity, urgency, an after-hours callout is defensible; "your suburb says you'll pay it" is the part that carries the risk. Third, if you're over the $3 million line and the answer to the first question is yes, update your privacy policy before 10 December to name the personal information used and the kinds of decisions it drives — the plain-language disclosure the new rule requires. Keep a human able to justify any quote the system produces. Book a call and we'll map your pricing tool against both obligations while you still have runway.

Key takeaways

Common questions

Related notes

Not sure what your pricing tool actually does?

Book a call and we'll map how your quoting or pricing software sets a number — against both the Consumer Law and the new December disclosure rule — so you know what to fix before the deadline.