Do You Have to Tell Customers You Use AI? From December, Yes

Half of the Australian businesses using AI check its output before it reaches a customer. Far fewer tell the customer AI was involved at all. From 10 December 2026, that second number is the one that carries a penalty.

That split comes from the government's own data. The National AI Centre's SME AI Pulse — a monthly survey run by Fifth Quadrant, polling at least 400 small and medium business owners and decision-makers each wave — found 43% of Australian SMEs reported using AI in some form over the December-to-February quarter, easing from 45% the quarter before and rebounding to 44% by February. Adoption has plateaued around the same line for months. What has changed is what businesses do once the tools are in.

Among current users, the most common safeguard the Centre found was checking AI outputs before they affect a customer — roughly half of AI users have that in place. Sensible. Nobody wants a hallucinated quote or a wrong invoice going out the door.

But the practices that face the customer lag well behind. Telling customers when AI is used, and giving them a clear way to raise a concern about an automated decision, are far less common. The Centre's own framing is blunt: there is a gap between internal operational safeguards and outward-facing governance. Businesses trust AI enough to run it. They have not yet told the people it is being run on.

Want to know what this means for your business? We'll map it in one call.

Two rules close that gap, and one has a date on it. From 10 December 2026, the Privacy Act's new automated decision-making transparency obligation requires any covered business to disclose in its privacy policy where a computer program uses personal information to make — or substantially help make — a decision that could significantly affect someone. We have covered exactly which of your tools trip that three-limb test; the short version is that AI phone agents, lead-scoring CRMs, and automated quoting all can. The OAIC's final guidance is due by September, and the regulator started sweeping privacy policies back in January.

The second rule has no date and no size limit. The Australian Consumer Law's ban on misleading or deceptive conduct carries no turnover threshold — so even a small business exempt from the Privacy Act is caught the moment it overstates what its AI does, or lets a chatbot tell a customer something untrue. We wrote about who wears it when an AI chatbot misleads a customer: the business does, every time. If you are not sure where your stack sits against either rule, we can map it with you.

This is an admin leverage problem, and it is a one-off fix that keeps paying. Map every tool that touches customer data and influences a decision — the phone agent, the CRM scoring, the quoting engine, the chatbot. For each, note what personal information it uses and what it decides. Update your privacy policy to disclose the automated decisions that significantly affect people, add one plain-English line telling customers when AI is involved, and give them a channel to query it. That last step is the cheap half the government's data says almost nobody has done — and it is the half that turns a compliance obligation into something customers read as trustworthy. Do it once, build it to update as you add tools, and December is a non-event.

Key takeaways

Common questions

Related notes

Not sure your AI is visible to customers the way December needs it to be?

Book a call and we will map your tools against both the Privacy Act deadline and the Consumer Law, work out what needs disclosing, and help you add the customer-facing line and complaint channel the government's data says almost no one has.