From 10 December 2026, any Australian business using personal information in automated or semi automated decision making has a new obligation under the Privacy Act. Most SME owners have not heard of it. That is about to become a problem.
The amendment requires APP entities to expand their privacy policy to disclose the types of personal data used in automated or semi automated decision making systems, and the categories of decisions being made. The obligation applies wherever a digital system, including AI, uses personal information to produce outcomes that significantly affect an individual.
That is a broader net than most business owners realise. If your business uses any of the following, this obligation likely applies to you.
- AI tools that score or rank leads based on personal data
- Recruitment software that filters or shortlists job applications
- Customer risk assessment tools that influence credit, access, or service decisions
- Automated systems that flag, categorise, or route individuals based on their data
This is not limited to large enterprises. Any APP entity, including small and medium businesses, is in scope if they handle personal information and use it in decision making processes that affect individuals.
The penalty framework is significant. Civil penalties apply for non-compliance, and serious or repeated interference with privacy can attract penalties of up to $50 million. The Office of the Australian Information Commissioner has indicated it will take a more active enforcement stance in 2026.
The gap between what Australian businesses are doing with AI and what their legal obligations require has been widening quietly. The new automated decision making disclosure rules are one part of a broader set of changes to the Privacy Act that took effect in stages through 2024 and 2025. Many businesses introduced AI tools during that period without updating their privacy frameworks to match.
The businesses best placed are the ones that have already started the conversation with their legal advisers and their operations teams as part of their AI readiness work. If you have introduced any AI assisted workflow that touches personal data in the last two years, now is the time to review it against these requirements.
The December 2026 deadline is specific, but the underlying obligation to handle personal data lawfully and transparently is not new. What has changed is that the law now requires you to be explicit about how AI fits into that picture.
Get in touch at www.xsiv.au/#form