Where the rule came from
The obligation was created by the Privacy and Other Legislation Amendment Act 2024, the first tranche of privacy reform, and inserted into the Australian Privacy Principles. It commences on 10 December 2026. It is not a proposal, not a code, and not voluntary, which already separates it from most of what gets called AI regulation in Australia.
We have written before that Australia already regulates generative AI through instruments that predate the current debate, and that the government’s five AI safety priorities carry no published dates. This one is the counter-example. It has a date.
The three limbs, and why all three matter
The Issues Paper sets out the test. All three limbs have to be met before the obligation bites.
| Limb | What it requires |
|---|---|
| 1 | The entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision. |
| 2 | The decision could reasonably be expected to significantly affect the rights or interests of an individual. |
| 3 | Personal information about the individual is used in the operation of the computer program to make the decision, or do the thing substantially and directly related to making it. |
Two details in the paper are easy to miss and both widen the net. Making a decision or doing a thing includes refusing or failing to make or do it, so an automated rejection counts. And a decision may affect rights or interests whether the individual is adversely or beneficially affected, so an approval counts as much as a refusal.
What actually has to be published
Where the test is met, the privacy policy has to disclose three things.
| Item | Disclosure |
|---|---|
| 1 | The kinds of personal information used in the operation of such computer programs. |
| 2 | The kinds of decisions made solely by the operation of such computer programs. |
| 3 | The kinds of decisions for which a thing substantially and directly related to making the decision is done by such computer programs. |
Note what the third item covers. It is not only decisions a machine makes on its own. It reaches systems that do something substantial on the way to a decision a human then signs off, which is how a great deal of AI is actually deployed.
The phrase the whole thing turns on
Limb two is the gate, and its wording is could reasonably be expected to significantly
affect the rights or interests of an individual
. The Privacy Act gives categories rather
than a definition. The paper lists them: a decision under an Act or legislative instrument
to grant or refuse a benefit; a decision affecting a person’s rights under a contract,
agreement or arrangement; and a decision affecting access to a significant service or
support.
The worked examples in the paper, drawn from the Explanatory Memorandum, are granting admission to a country, entitlement to a housing benefit, a contract for a life insurance policy, and access to healthcare services. Then comes the one that should interest anyone running a recommendation or targeting system: using computer programs to target individuals with content and advertisements may have a significant effect if, for example, it results in differential pricing for significant goods or services, or limits access to employment opportunities.
Our reading, offered as a view. That last example is where the obligation stops being a government-agency rule and starts touching ordinary commercial machine learning. A pricing model and a job-ad targeting model are not usually described by the people running them as making decisions about anyone’s rights. On the Explanatory Memorandum’s own example, they can be. The paper offers this as an illustration and not as a boundary, which is precisely the problem it went to consultation to solve.
What the OAIC asked, and where it has got to
The Issues Paper, dated 18 May 2026, asks for views on scope, and devotes
a section to the meaning of significantly affect the rights or interests
including how
the equivalent idea works in other frameworks. It notes that Article 22 of the EU and UK
General Data Protection Regulation is worded to capture automated decision-making producing
legal or similarly significant effects, and refers to UK Information Commissioner’s
Office guidance on how that is judged.
It also places the obligation beside things it does not replace: anti-discrimination law, administrative law, the FOI Act and the General Insurance Code of Practice, along with the Attorney-General’s Department consultation on government use of ADM and Western Australia’s own ADM principle under the Privacy and Responsible Information Sharing Act 2024.
Submissions closed on 15 June 2026. As at 18 August 2026 we could not find published guidance through the OAIC’s consultation index, its site search or its privacy guidance hub. The consultation page still describes the Issues Paper as the current material. The page is also explicit that this consultation was not a statutory requirement and that the OAIC chose to run it.
What that leaves for anyone covered
Roughly four months before commencement, the position is that the date is fixed, the disclosure requirements are known and specific, and the test for whether they apply to a given system is the part still being worked through. An entity cannot wait for the guidance and then start, because the obligation commences whether or not the guidance is out.
What is worth doing regardless, and this is a view rather than legal advice: the three disclosure items are answerable now. Which systems use personal information to make or materially contribute to decisions, what kinds of personal information they use, and which of those decisions are made solely by the machine. That inventory is required for the privacy policy no matter how the scope question resolves, and it is the slow part.
How we did this
Every quoted phrase and every element of the test comes from the OAIC’s Automated Decision-Making Transparency Obligation (APP 1) Issues Paper, dated 18 May 2026, downloaded from the OAIC and read in full on 18 August 2026, together with the consultation page that carries the publication and closing dates. The commencement date, the three limbs and the three disclosure items are as the paper states them.
On the guidance. We report that we could not find published guidance through the OAIC’s consultation index, its site search or its privacy guidance hub on 18 August 2026. That is a statement about those routes, not proof that nothing exists anywhere. The search does return a result titled after the obligation, and it resolves to the Issues Paper itself rather than to separate guidance.
What this is not. This is a reading of a regulator’s consultation paper, not legal advice, and the paper is not the legislation. Anyone deciding whether a particular system is caught should read the Act and take their own advice. We have not contacted the OAIC, and we would publish a response.
Sources
- OAIC, Automated Decision-Making Transparency Obligation (APP 1), Issues Paper (PDF, 18 May 2026, downloaded and read 18 August 2026): the 10 December 2026 commencement; the three limbs of the test; that making or doing includes refusing or failing to; that rights or interests may be affected adversely or beneficially; the three disclosure items under APP 1.8; the APP 1.9(d) categories; the Explanatory Memorandum examples including differential pricing and access to employment opportunities; the GDPR Article 22 and UK ICO comparison; and the discussion of anti-discrimination law, administrative law, the FOI Act, the General Insurance Code of Practice, the AGD consultation and the Western Australian ADM principle.
- OAIC, Consultation on Guidance for Transparency in Automated Decision Making (read 18 August 2026): published 18 May 2026, closing date for submissions Monday 15 June 2026, the summary of the obligation, and the statement that the consultation is not a statutory requirement.
- AI Geek, What replaced the mandatory AI guardrails: five priorities, five ministers, no dates (31 July 2026): the automated decision-making strand of the government’s AI safety priorities and the absence of published dates elsewhere.
Spotted an error? Tell us and we will check it against the sources and log the outcome here.