New Privacy Rule: Disclose Your AI Use or Face a $330K Fine

From 10 December 2026, any Australian business covered by the Privacy Act that uses a computer program to make decisions significantly affecting individuals must disclose that use in their privacy policy. The obligation covers AI tools, algorithmic systems, and automated processes that use personal information — including features embedded in third-party platforms like Xero, MYOB, or your practice management software.

The rule comes from the Privacy and Other Legislation Amendment Act 2024, which added new provisions (APP 1.7–1.9) to the Australian Privacy Principles. It passed in December 2024 with a 24-month transition period. That period ends in six months. The OAIC can issue infringement notices of up to $330,000 for companies that fail to have a compliant privacy policy — 1,000 penalty units at the current Commonwealth rate of $330 each.

The Office of the Australian Information Commissioner opened a public consultation on the new obligation in May 2026, closing 15 June. The early signals point to a broad interpretation that will capture more businesses than most expect.

Two terms determine whether you're in scope. First: "arranged for." The OAIC's Issues Paper indicates this places responsibility on the organisation that deploys a computer program to make decisions — not necessarily the organisation that built it. If you subscribe to software that uses AI to make or assist decisions about people, you're the one who must disclose it. The fact that Xero or ServiceTitan built the feature doesn't shift the obligation.

Second: "significantly affect rights or interests." This captures decisions about whether to provide services to a customer, whether to grant a job interview, pricing or credit decisions, and access to significant services. The standard is effects-based — both adverse and beneficial outcomes count, according to the OAIC's guidance framework. For a trades business, that likely means automated quoting systems that price based on customer location or history, AI-powered job allocation, and automated customer screening. For an accounting or law firm, it captures AI-driven client risk assessments, automated AML/CTF screening, and algorithmic decisions about which clients to onboard.

For accountants, lawyers, conveyancers, and real estate agents — many of whom have operated under the $3 million turnover small business exemption — the situation is sharper. From 1 July 2026, more than 100,000 small businesses in these sectors lose their Privacy Act exemption entirely, as AML/CTF reforms pull them into the regulated entity framework. The OAIC has confirmed this number.

That means: in three weeks, these firms need a privacy policy that complies with the Australian Privacy Principles. Six months later, that privacy policy must also disclose their automated decision-making. If you've been operating without a privacy policy because you were exempt — you now have two obligations to build, on two deadlines, with penalties behind each.

We've written before about building an AI register — first as a governance tool for managing shadow AI, then as evidence for insurance renewals. The same document now has a third job: compliance with the automated decision-making transparency obligation.

First, build your AI register. Every tool in your business that uses personal information in any form of algorithmic or AI-powered decision-making. Include embedded features: your CRM's lead scoring, your HR platform's resume screening, your accounting software's AI categorisation, any automated quoting or scheduling tools. The register is the foundation — you can't disclose what you haven't mapped.

Second, for each tool on the register, ask: does this make or substantially assist in making a decision that significantly affects someone's rights or interests? The answer determines whether it goes in your privacy policy. Client risk screening: almost certainly yes. Internal bank feed categorisation: probably not. Automated quote pricing that varies by customer: likely yes. If you're unsure, err toward disclosure — over-disclosing carries no penalty.

Third, don't wait for the OAIC's final guidance. The consultation closes 15 June 2026, final guidance is expected later this year, but the obligation commences on 10 December whether the guidance is finalised or not. The businesses that start now will have a compliant policy before the deadline. The ones waiting for perfect clarity will be writing their privacy policy in November.

Key takeaways

Not sure which of your AI tools trigger the disclosure requirement?

A short call can map your current AI use against the new obligation and identify exactly what needs to go in your privacy policy before December. Book a call.