AI Regulation

Privacy Act, from 10 December 2026

Automated decision-making disclosure examples, by sector

The law asks for three lists in plain language. Here is what those lists tend to look like in six sectors, with a human review line in each, ready to adapt rather than copy.

Responsible AI Australia • 14 Oct 2026 • 8 min read

From 10 December 2026, Australian Privacy Principle 1.8 requires a covered organisation's privacy policy to list the kinds of decisions made solely by computer programs, the kinds of decisions a program substantially and directly helps to make, and the kinds of personal information those programs use. The full guide covers the law and the checklist covers which systems belong. This piece shows the wording. Every example is illustrative, built on the kinds of systems the regulator's own examples describe, and should be rewritten around your actual systems and reviewed by your privacy adviser before it is published.

The shape every example follows

The statutory content is the three lists. Everything else in these examples is good practice rather than law. The opening sentence tells the reader what the section is for. The human review line is not required by APP 1.8, but the OAIC points to transparency practices that offer a contact point and a route to a person, and it is the practical expression of the contestability principle that Responsible AI certification assesses.

Kinds, not instances. “Whether to shortlist an applicant” is a kind of decision. A list of every role you have ever advertised is not.
The customer's words. Write “whether to approve a refund”, not “returns eligibility scoring via rules engine v4”.
No model internals. Commercial-in-confidence information about how a system works is excluded. You are not naming vendors or publishing weights.
Beneficial decisions too. Automatic approvals count as much as declines under APP 1.9.
Staff as well as customers. Decisions about employees and applicants are decisions about individuals.

Recruitment and HR

The regulator's own examples of arranging a program include procuring an AI system to screen and rank job applications, and directing staff to use an AI tool to draft performance assessments that feed promotion decisions. Both sit in the “substantially assists” list when a person makes the final call, and a fully automated knock-out question moves to the “solely” list.

Illustrative wording

Automated decision-making

We use computer programs, including artificial intelligence, to make some decisions about individuals, and to do things that are substantially and directly related to making decisions, using personal information. This section is provided in accordance with Australian Privacy Principles 1.7 to 1.9.

Decisions made solely by computer programs: whether an application proceeds past mandatory requirements such as working rights or a required licence.

Decisions a computer program substantially assists, with a person making the final decision: whether to shortlist a job applicant; whether to invite an applicant to interview; whether an employee is recommended for promotion, following a performance assessment drafted with the help of an AI tool.

Kinds of personal information used: identity and contact details; employment history, qualifications and references; responses to application questions and assessments; performance records.

Human review: Applicants and employees can ask for a person to review any decision described above by emailing people@example.com.au. We respond within ten business days.

The workplace tracker covers the Fair Work and anti-discrimination rules that sit beside the disclosure, including the employee records exemption and its limits.

Lending, insurance and payments

Credit, insurance and access to funds are the clearest examples of decisions that significantly affect a person's interests, and this sector runs more fully automated decisions than most. Fraud and transaction monitoring usually assists an analyst; an instant approval under a threshold is usually solely automated.

Illustrative wording

Automated decision-making

Decisions made solely by computer programs: whether to approve a credit limit increase below a set threshold; whether a transaction is declined or held pending review.

Decisions a computer program substantially assists, with a person making the final decision: whether to approve a loan application and on what terms; the premium offered on an insurance policy; whether a claim is referred for further assessment; whether a transaction is reported as suspicious.

Kinds of personal information used: identity and contact details; financial information such as income, assets and liabilities; credit information; transaction history; device and online identifiers.

Human review: You can ask us to have a person review any automated decision about your application, claim or account by contacting us at privacy@example.com.au or calling our customer team. Credit decisions are also subject to your rights under the credit reporting provisions of the Privacy Act.

ASIC and APRA have their own expectations of AI governance for licensees, set out in the financial services tracker and the Report 798 explainer. The disclosure is the part the OAIC enforces.

Health services

Private sector health service providers are covered regardless of turnover, which reaches clinics, allied health, gyms, child care centres and private schools. The OAIC's crisis hotline example, a spreadsheet that scores and triages callers, comes from this world. Clinical decision support that a practitioner relies on sits in the “substantially assists” list.

Illustrative wording

Automated decision-making

Decisions made solely by computer programs: whether an appointment request is accepted for an available time.

Decisions a computer program substantially assists, with a person making the final decision: how urgently an enquiry or referral is triaged; whether a patient is flagged for follow-up or recall; clinical recommendations a practitioner considers when deciding on treatment, where a decision support tool is used.

Kinds of personal information used: identity and contact details; health information, including clinical records and the information you provide when booking or seeking care; Medicare and other government identifiers.

Human review: A practitioner makes every clinical decision. If you wish to question a triage or scheduling outcome, contact the practice manager at privacy@example.com.au.

Ahpra's expectations of practitioners using AI, and where the TGA treats software as a medical device, are in the healthcare tracker.

Schools, training providers and universities

Private schools and private tertiary providers are health service providers for Privacy Act purposes where they hold health information, and most sit above the turnover threshold in any case. Admissions, scholarship ranking, academic integrity flags and enrolment nudges are the usual candidates.

Illustrative wording

Automated decision-making

Decisions made solely by computer programs: None. A person makes every decision described below.

Decisions a computer program substantially assists, with a person making the final decision: whether an application for enrolment or a scholarship is shortlisted; whether submitted work is referred to a person for an academic integrity review; whether a student is identified for additional learning or wellbeing support.

Kinds of personal information used: identity and contact details; academic records and submitted work; attendance and engagement data; wellbeing information you or a parent provide.

Human review: A member of staff makes every decision described above. Students and parents can ask for a decision to be reviewed by contacting the registrar at privacy@example.edu.au.

The education tracker covers the Australian Framework for Generative AI in Schools and TEQSA's expectations of universities.

Retail, subscriptions and customer service

The OAIC's examples include contracting a software company to approve or decline refunds automatically and a case management system that escalates particular complaints on its own. A support chatbot that only answers questions is out of scope until the day it can approve something. Targeting that changes the price a person pays for a significant good or service can qualify; ordinary product recommendations usually do not.

Illustrative wording

Automated decision-making

Decisions made solely by computer programs: whether to approve a refund or return request under our returns policy; whether a complaint is escalated to a specialist team.

Decisions a computer program substantially assists, with a person making the final decision: whether to offer a customer a retention or promotional offer; whether an order is held for verification.

Kinds of personal information used: identity and contact details; transaction and purchase history; communications with our support team; device and online identifiers.

Human review: You can ask for a person to review any refund, return or order verification decision by replying to the decision email or contacting support@example.com.au.

Government agencies

Australian Government agencies are APP entities, and the OAIC has published a supplementary fact sheet for them. The Digital Transformation Agency separately requires an AI transparency statement under its policy for responsible use of AI in government, and the issues paper points to that standard as good practice for everyone. The privacy policy section should agree with the transparency statement.

Illustrative wording

Automated decision-making

Decisions made solely by computer programs: whether a routine application is approved where all eligibility criteria are met on the information provided.

Decisions a computer program substantially assists, with a person making the final decision: whether an application or claim is selected for manual assessment or review; how enquiries and requests are prioritised.

Kinds of personal information used: identity and contact details; information in your application or claim; information held in our records about your previous dealings with us.

Human review: You can request review of any decision in accordance with the review rights set out in the relevant legislation, and you can ask us to have an officer reconsider an automated outcome by contacting privacy@agency.gov.au. Our AI transparency statement is published on our website.

The government tracker covers the DTA policy, impact assessments and the automated decision-making reform that followed Robodebt.

Five mistakes these examples avoid

Saying “we do not use AI” while a rules engine or spreadsheet scores people. The law is about computer programs, not AI.
Listing only the adverse decisions. Automatic approvals are decisions that affect a person's interests, and APP 1.9 says so.
Forgetting staff. Recruitment screening and performance tooling are decisions about individuals, and the employee records exemption does not cover job applicants.
Publishing the data dictionary. Kinds of personal information, in a handful of phrases, is the requirement. Pages of field names obscure the point.
Writing it once. The first vendor update that adds an automated feature will make the section wrong. Keep the register behind the policy and a procurement trigger that asks the question.

The free builder drafts this section from your own systems in the same layout, with the internal register alongside, in your browser and with nothing stored. Businesses that go on to Responsible AI certification answer the automated decision-making questions as part of their application, and their profile on the public register shows how their decisions can be contested.

Questions people ask

Can I copy these examples into my privacy policy?

Use them as a starting shape, not as finished text. The three lists have to describe your actual systems: the kinds of decisions they make or assist and the kinds of personal information they use. A list copied from another sector will be wrong for yours, and the OAIC's guidance emphasises meaningful, specific disclosure. Have your privacy adviser review the final wording.

Do I have to name the software or vendor?

No. The Explanatory Memorandum excludes commercial-in-confidence information about automated decision-making systems from the disclosure, and the OAIC asks for enough information to understand the use of automated decision-making without excessive detail. Describe the kinds of decisions in the customer's words rather than naming products.

Is the human review line required?

Not by APP 1.8. It is included because the OAIC points to transparency practices that give people a contact point and a route to a person, and because a way to contest a decision is one of the Australian AI Ethics Principles that Responsible AI certification assesses. It is one sentence and hard to argue against.

What if none of my decisions are fully automated?

Say so. The solely-automated list can state that a person makes every decision described, and the substantially-assists list then carries the systems that score, rank, triage, recommend or flag. That is the common position for most organisations, and it is still a disclosure the law requires.

Do these examples cover the DTA transparency statement for agencies?

No. The Digital Transformation Agency's policy for responsible use of AI in government requires a separate AI transparency statement. The privacy policy section under APP 1.8 is a different, narrower obligation, and the two should agree with each other. The OAIC has published a supplementary fact sheet for agencies.

Go deeper

Sources

This guide is general information, not legal advice. It restates official instruments and regulator guidance as they stood on 14 October 2026. How a rule applies to a particular organisation is a judgement for its own adviser.