Recruiters and hiring tools are regulated through laws that already apply to them. The Government's stated approach is to build on existing legal frameworks, and several of those frameworks name recruiters directly: the federal discrimination Acts make it unlawful for an employment agency to discriminate in providing its services, and the Privacy Act's employee records exemption does not reach unsuccessful job applicants or agencies working under contract. A privacy policy disclosure for automated decisions commences on 10 December 2026. For AI at work after someone is hired, see the Workplace and HR page of this tracker.
OAICAHRCFair Work OmbudsmanAPSCMerit Protection CommissionerSafeWork NSWRCSA
Last reviewed November 2026. Every entry links to its official source.
The rules
What applies today
The Sex Discrimination Act 1984 (section 20), Disability Discrimination Act 1992 (section 21) and Age Discrimination Act 2004 (section 24) each make it unlawful for an employment agency to discriminate by refusing to provide a person with its services, in the terms on which it offers them, or in the manner in which it provides them. Each Act defines an employment agency as any person or body that, whether for payment or not, assists persons to find employment or other work or assists employers to find employees or workers. The Racial Discrimination Act 1975 (section 15(2)) makes it unlawful for a person concerned with procuring employees for an employer to treat a person seeking employment less favourably by reason of race, colour or national or ethnic origin. All three of the first group also provide that a person who causes, instructs, induces, aids or permits another person to do an unlawful act is taken to have done it too. The Disability Discrimination Act adds that an agency is not required to ensure an employer complies, but that this does not affect that liability. None of these provisions refers to the technology used, so they are not limited to decisions made by a person.
Who this affects: Recruitment, executive search and labour hire agencies, and any other person or body that assists employers to find workers.
RCSA published an article on AI in recruitment, citing Citation Legal, covering discrimination risk in AI-written job advertisements and automated screening, accountability for labour hire businesses relying on host data, and the 10 December 2026 privacy disclosure. Its five steps are to map AI use, test tools, review policies and disclosures, check host agreements and keep humans accountable.
The OAIC published its resources on the automated decision-making transparency obligation in APP 1.7 to 1.9: a fact sheet, a supplementary fact sheet for government agencies, a flowchart and an update to the APP 1 guidelines, reflecting 90 written submissions.
SafeWork NSW concluded Stage 1 consultation on the Digital Work Systems Guidelines and published an insights report. Further targeted consultation is planned for late 2026, followed by a 4 to 6 week public consultation on draft guidelines.
The Attorney-General's Department opened consultation on the exposure draft Privacy Amendment (Personal Data Protection) Bill 2026, closing 18 September 2026. The consultation paper does not mention the employee records exemption or the small business exemption.
The Australian Public Service Commission published principles for agency use of AI in recruitment, principles for candidates and a guide to managing candidate use of AI. Agencies are expected to implement the agency principles by 1 June 2026, including for recruitment providers working on their behalf.
The Government's response to the Future of Work inquiry stated that Fair Work Act adverse action protections apply irrespective of the use of AI, that adverse action can include refusing to hire a prospective employee, and that the employer bears the onus of proof.
List every tool that screens, ranks, matches, interviews or assesses candidates, including features built into your applicant tracking system, and record who is accountable for each. See the rule
2
Test each tool against the three limbs of APP 1.7 and, where it is met, add the three required lists to your privacy policy before 10 December 2026. See the rule
3
Treat candidate data as covered by the Australian Privacy Principles. The employee records exemption does not reach unsuccessful applicants or agencies working under contract. See the rule
4
If your turnover is $3 million or less, check whether supplying candidate details to clients takes you outside the small business exemption, and what consent you hold. See the rule
5
Check whether any tool collects sensitive information, including biometric information from video or voice, and whether you have consent and a destruction process for candidates who are not placed. See the rule
6
Ask each vendor what the Merit Protection Commissioner tells agencies to ask: independent evidence that the tool measures what it claims, and testing with diverse Australian cohorts. See the rule
7
Keep a person accountable for each rejection and placement decision, with reasons you can explain. The discrimination Acts apply to an agency's own services and the Fair Work Act presumes the alleged reason unless disproved. See the rule
8
If you recruit for APS agencies, be ready to explain your AI tools, your security and privacy assessments and how each tool maps to the work-related qualities assessed. See the rule
Straight answers
Questions people ask
Does discrimination law apply to a recruitment agency using AI screening?
The federal discrimination Acts apply to employment agencies in their own right. The Sex Discrimination Act, Disability Discrimination Act and Age Discrimination Act each make it unlawful for an employment agency to discriminate by refusing its services, in the terms on which it offers them, or in the manner in which it provides them, and the Racial Discrimination Act covers a person concerned with procuring employees for an employer. None of the provisions refers to the technology used. Each of the first three Acts also treats a person who causes, instructs, induces, aids or permits another person's unlawful act as having done it.
Does the Privacy Act cover candidate data held by a recruiter?
The employee records exemption does not take it out. The OAIC says the exemption does not cover future employment relationships, so it will not apply to personal information about unsuccessful job applicants, and that it is unlikely to apply to organisations providing recruitment or human resource management services under contract to an employer. Those contractors must comply with the Australian Privacy Principles, including the notice requirements in APP 5.
Is a small recruitment agency exempt from the Privacy Act?
Not automatically. A business with turnover of $3 million or less is generally a small business operator, but the Privacy Act removes that status from a business that discloses personal information about another individual to anyone else for a benefit, service or advantage, unless the disclosure is made with the individual's consent or is required or authorised by legislation. RCSA has said this may capture agencies that supply candidate details to clients.
Do recruiters have to disclose AI screening in their privacy policy?
From 10 December 2026, an APP entity must describe automated decisions in its privacy policy where it has arranged for a computer program to make a decision, or do a thing substantially and directly related to making one, the decision could reasonably be expected to significantly affect an individual's rights or interests, and the individual's personal information is used by the program. Recruiters need to test their screening, ranking, matching and assessment tools against that wording. The obligation applies to decisions made after commencement even if the tool was set up earlier.
Can AI make the final decision in Australian Public Service recruitment?
No. The Australian Public Service Commission's principles for agency use of AI in recruitment, which agencies were expected to implement by 1 June 2026, say AI tools must not make the final decision in recruitment outcomes. Agencies must tell candidates in the vacancy advertisement and candidate pack if AI will be used, and remain responsible for AI outputs whether the tool is used by the agency or by a contracted recruitment provider.
Is there an industry code for AI use by Australian recruiters?
Not a dedicated one. The RCSA Code of Professional Conduct, authorised by the ACCC on 22 May 2024, binds RCSA members and has no AI-specific clause, though its obligations on privacy and confidentiality, informed consent, grievance handling and regulatory controls apply to how members use hiring tools. APSCo Global published an AI policy guide for staffing firms in September 2025. Neither is law.
What should a client ask an AI recruitment tool vendor?
The Merit Protection Commissioner's guidance for APS agencies suggests comparing several providers, scrutinising research sponsored by the provider, asking for long-term evidence that the tool measures what it claims, asking whether it has been tested with diversity cohorts in an Australian audience including people with disability and First Nations people, and reading the provider's privacy policy. It also recommends not screening candidates out on a single AI-assisted assessment.
Certification against Australia's AI Ethics Principles is independent proof that your business uses AI responsibly, before a client, regulator or tender asks.
