A credit application is routed by a rules engine. A hiring system ranks applicants before a person makes the final call. A customer portal calculates eligibility from personal information. None of these has to be a generative-AI chatbot to raise an automated-decision transparency question.
From 10 December 2026, a new Australian Privacy Principle (APP) 1 obligation requires covered entities to include information in their privacy policies about certain automated decisions. The practical challenge is finding the decisions and data pathways first. A privacy-policy writer cannot accurately describe a decision that the product, operations and data teams have never mapped.
Which decisions need a closer look?
The Office of the Australian Information Commissioner’s May 2026 issues paper sets out the enacted trigger: the entity arranges for a computer program to make a decision, or do something substantially and directly related to making it; the decision could reasonably be expected to significantly affect an individual’s rights or interests; and the program uses that individual’s personal information in doing so. The test is not simply “Do we use AI?” and a human at the end of a workflow does not automatically remove an earlier automated step from consideration.
The rule concerns APP entities, which include Australian Government agencies and many businesses covered by the Privacy Act. Whether a particular system and decision meets the trigger needs a considered legal and factual assessment. This is not a claim that every recommendation, sorting algorithm or customer-service automation must be disclosed.
Build a decision register the policy can actually describe
Start with consequential journeys: applications, approvals, eligibility, access, pricing, prioritisation and adverse outcomes. For each, record the product owner, the decision being made, its effect on the person, the personal information read, the rule/model/vendor involved, the automated step, where a person intervenes, and the path for correction or review. Trace data from collection through the program to the final decision; an API, batch job or third-party service can be part of the path even when it is invisible in the customer interface.
Then classify each journey against the three-part trigger. Give legal and privacy reviewers the actual process map, not only the vendor’s feature label. The OAIC issues paper explains that the required privacy-policy information includes the kinds of personal information used, the kinds of decisions made solely by the programs, and the kinds of decisions for which programs perform a substantially and directly related step. That distinction makes a useful test for the register: can a reviewer tell a wholly automated decision from an automated input to a later decision?
Keep the public description connected to the software
Do not treat the policy update as a one-off copywriting task. Add the decision classification to the change checklist for a new scoring feature, a rule threshold, a replacement vendor or a new data feed. When a material pathway changes, require product, engineering and privacy owners to check whether the public description still matches production. Use tests and representative scenarios to confirm what the program actually does, including exceptions and manual overrides. Keep sensitive personal data out of test fixtures and publishing notes.
This disclosure obligation does not itself settle whether an automated decision is fair, accurate or lawful, or replace any existing review rights. In a September 2026 address, the Information Commissioner said the obligation begins on 10 December and described transparency as important to contestability. Teams should assess those wider risks separately rather than mistake a published paragraph for a complete governance control. The OAIC was still developing detailed guidance when it issued its consultation paper; check its final guidance and obtain appropriate legal advice before locking wording.
Where NAITEC fits: this is a practical software integration and workflow-mapping problem as well as a policy task. NAITEC Digital can help identify decision paths in custom applications, instrument them for traceability, test changes and give privacy owners a reliable technical inventory. We do not provide a legal determination. If an automated workflow matters to your customers, talk to us about mapping it before the December deadline.