If an AI agent in your business helps decide something that materially affects a person, such as approving a claim, setting a price, screening an applicant or granting access to a service, the Privacy Act is about to ask you to say so in public. The automated decision-making transparency changes introduced by the Privacy and Other Legislation Amendment Act 2024 are scheduled to commence on 10 December 2026. That is close enough that anyone with agents in production should be looking now.

What changes

In summary: an organisation covered by the Australian Privacy Principles that uses personal information in a computer program to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests will need to describe that in its privacy policy. The description covers the kinds of personal information used and the kinds of decisions made.

Three phrases carry the weight, and each is where businesses will argue with themselves.

“Substantially and directly related to making a decision.” This is not limited to fully automated outcomes. An agent that assembles a case file and recommends an outcome a human then approves can still be in scope, depending on how much the human is relying on it.

“Significantly affect rights or interests.” Pricing, eligibility, employment, credit, insurance and access to services are the obvious territory. A scheduling assistant is probably not.

“Personal information.” Agents tend to touch more of it than the people who deployed them realise, because they read whole records and inbox threads rather than the three fields someone had in mind.

The Office of the Australian Information Commissioner is expected to publish guidance, and the detail should be checked against it and the Act itself. Treat this article as orientation.

Why this is an agent problem, not a policy-writing problem

Updating a privacy policy takes an afternoon. The hard part is that you can’t describe what your agents do with personal information if you don’t have a reliable list of where they are and what they can reach. Three things have to be true before the policy sentence is honest.

  1. You have an inventory. Every agent, what decisions it influences, and the data sources it reads. Agents that grew out of pilots or individual team initiatives are the usual gap.
  2. You know what personal information it actually used. That needs scoped access, because an agent with a broad shared credential can read far more than its job requires, and “it could see everything” is not a defensible answer about data use. See scoped identity.
  3. You can explain a specific decision. Not just in the policy, but when a person asks. Records that capture the inputs, the reasoning and the human sign-off at the time of the action make this answerable. Reconstructing it from logs later usually isn’t. See what to have ready when a regulator asks.

Retention pulls the other way

An audit trail containing personal information is itself subject to the same Act, including the obligation not to hold personal information longer than needed. The practical answer is to separate the record of the action from the personal data inside it, so you can keep the evidence and delete the content on its own schedule. We cover that in how long to keep AI agent audit records.

What to do before December

  • List every AI agent or automation that touches customer, applicant or employee data.
  • For each, decide whether it makes or substantially supports a decision with significant effect. Write the reasoning down, including the cases you decide are out of scope.
  • Check the agent’s actual access against what the decision needs.
  • Put approval gates on the consequential decisions so a human review is real and recorded.
  • Then update the privacy policy to match what you found, not what you hoped.

If you want an outside view of that list, the Security and Governance Audit is designed for exactly this: what your agents can reach, what they’ve done, and where the exposure is, ranked. Or start with the readiness check, or book a free intro call.

This is general information, not legal advice. Confirm commencement dates, thresholds and obligations against the current legislation and OAIC guidance, and take advice on your own situation.