The OAIC has now published the practical transparency resources organisations will need to support the privacy policy obligations that apply where computer programs are used to make or inform decisions that can significantly affect an individual’s rights or interests.
Published on 30 September 2026, the release sits squarely on the path to the 10 December 2026 commencement date for the new transparency obligation under APP 1.
It affects APP entities, and in practice it will matter most to organisations using AI, automated decisioning or closely related tools in customer, member, credit, claims, service or workforce decisions.
The Board-Level Take
The OAIC is confirming that this obligation should be treated as an operational governance issue, not just a privacy-policy edit.
If your organisation uses personal information in automated or AI-supported decisioning, the question is no longer whether the technology exists — it is whether you can clearly explain it, evidence it, and keep that disclosure current.
The immediate risk is inconsistency: technology teams know how the model works, privacy teams own the policy, and business owners own the process. That gap is exactly where transparency obligations slip.
What’s Actually Changing — and Why It Matters
Transparency now has to be specific, not generic
The published material points to a more detailed privacy policy obligation under APP 1.8 than many organisations have historically used.
The policy must cover the kinds of personal information used in the relevant computer programs, the kinds of decisions made solely by those programs, and the kinds of decisions where a thing substantially and directly related to the decision is done by the program.
That matters because generic statements about “using technology” will not be enough if they do not reflect the actual decisioning pathway. Boards should expect a need to move from broad policy language to precise, defensible disclosure.
AI governance and privacy governance are now converging
The OAIC’s resources make it harder to treat AI governance as a separate project from privacy compliance. If a system uses personal information to support decisioning, the privacy policy obligation will depend on understanding the business process, the data inputs, and the role of the computer program in the decision chain.
For executives, that means privacy, digital, risk and legal teams need a common inventory of use cases. For boards, it means asking whether the organisation has a reliable register of automated decisioning and whether anyone is accountable for keeping it current.
The consultation feedback signals this is a live supervisory issue
The OAIC says the published resources reflect feedback from 90 written submissions across academia, civil society, government, industry and industry bodies. That tells you the issue has already been tested in consultation and the regulator is now moving to practical implementation support.
In practical terms, that usually means organisations should not wait for the last minute. If the regulator has already translated consultation feedback into fact sheets, flowcharts and updated guidelines, it is a strong cue to assess readiness now and document the basis for any in-scope or out-of-scope judgments.
Questions Your Board Should Be Asking Now
- Which of our processes use computer programs to make or materially inform decisions that could significantly affect individuals’ rights or interests?
- Do we have a current inventory of those use cases, and who owns it?
- What personal information is used in each in-scope decisioning process, and can we explain that clearly in our privacy policy?
- Are our privacy, technology and business teams aligned on which systems are captured by APP 1.7 and APP 1.8?
- What evidence would we produce if asked to show how we determined that a decisioning process is in or out of scope?
- Are our change-management and model-governance processes strong enough to keep the privacy policy current as systems change?
The Implementation Window
The key date is close enough to require active work now. Even where the obligation is not yet live, the practical tasks — discovery, classification, disclosure drafting, approvals and control testing — take time. Organisations that leave this until the deadline will probably find themselves documenting decisions under pressure rather than designing them properly.
The smart move is to treat this as a board-and-management readiness exercise: identify the systems, test the disclosure, confirm ownership and establish a review cycle that keeps pace with technology change.
Turning Regulatory Change Into Readiness
The Innovation of Risk Reading Room tracks OAIC, APRA, ASIC and other regulatory developments as they move from consultation to operational reality.
If your board or risk team wants a structured way to map the impact of AI, privacy and automated decision-making obligations across your existing governance framework, that is the place to start. AI Signal BoxTM provides an excellent tool to manage AI governance.
Source: Review the original update
LinkedIn-ready version
OAIC has published new transparency resources for AI and automated decision-making, alongside updated APP 1 guidance. For boards and executive teams, the message is straightforward: if personal information is being used in computer programs that make or inform decisions affecting rights or interests, privacy governance now needs to be specific, evidenced and current. With the 10 December 2026 obligation date approaching, organisations should be mapping in-scope use cases, reviewing privacy policy disclosures and confirming ownership across privacy, tech, legal and risk. #privacy #AIgovernance #automateddecisionmaking #riskmanagement #governance
This post is a draft generated by the Regulatory Change Monitor using ChatGPT. Review source material and obtain professional advice where required before publishing.