Artificial intelligence is becoming part of everyday business operations, often in ways that business owners may not have fully considered.
Recruitment platforms help assess job applications. Financial systems evaluate customer information. Software can recommend whether someone qualifies for a particular service, while other applications automatically process requests that once required a person to review them.
These capabilities can make businesses considerably more efficient. They reduce administration, help teams handle larger volumes of work and allow organisations to make better use of their information.
But as technology takes on a greater role in decision-making, businesses also need to understand what responsibilities come with it.
From 10 December 2026, new Australian privacy transparency requirements will apply to certain organisations using computer programs to make or substantially inform decisions that significantly affect individuals.
The changes are part of amendments to the Australian Privacy Principles and represent an important development in how organisations are expected to communicate their use of automated decision-making.
For businesses already exploring AI and automation, now is a good time to understand what these changes mean and whether they apply to the systems you’re using.
What is actually changing?
Under the new requirements, organisations covered by the Australian Privacy Principles, known as APP entities, must include additional information in their privacy policies when certain conditions are met.
The requirements apply where an organisation has arranged for a computer program to use personal information to make a decision, or perform something substantially and directly related to making that decision, and the decision could reasonably be expected to significantly affect an individual’s rights or interests.
The key distinction is that this is a transparency requirement. It does not automatically prohibit automated decisions or mean every business using AI needs to change its privacy policy.
It does mean that covered organisations need to be open about certain uses of automated decision-making.
The information required includes the kinds of personal information used by those programs and the kinds of decisions involved.
An important point is that the rules are not limited to technologies marketed as artificial intelligence.
A traditional software system that automatically assesses an application may be relevant, even if the business has never described it as an AI tool.
That means the review needs to extend beyond ChatGPT, Microsoft Copilot and other familiar AI platforms.
Businesses need to understand what their existing software is already doing.
Your organisation may already be using automated decisions
One of the challenges with modern business software is that automation can become part of everyday operations without receiving much attention.
A company might purchase a recruitment platform because it makes hiring easier. The system may rank candidates, filter applications or recommend which people should move through to the next stage.
A financial services business may use software that evaluates information supplied by customers and determines whether particular conditions have been met.
A healthcare provider may use technology to help determine access to particular services or support.
These systems can be valuable, but depending on how they operate, the personal information involved and the significance of the resulting decisions, they may require additional consideration under the new rules.
Not every automated task will qualify. Scheduling appointments, sorting emails or generating routine reports will not automatically trigger the requirements.
The important question is whether a computer program is materially involved in a decision that could significantly affect a person.
For example, an automated system used to organise customer enquiries is very different from one used to determine whether someone receives access to an essential service.
The second situation carries much greater implications for the individual.
Why this matters beyond legal compliance
It’s tempting to view privacy requirements as another administrative obligation.
A policy needs updating, someone reviews the wording and the business moves on.
However, the broader issue is about understanding how technology is being used within an organisation.
If a business cannot clearly explain which systems are involved in important decisions, what information those systems use and who is responsible for their outcomes, that suggests a wider governance problem.
Automated decisions can influence people’s employment opportunities, finances and access to services.
They may also rely on information that is incomplete, outdated or inaccurate.
Even where the technology works as intended, the business needs to consider whether the process is appropriate and whether the people affected understand how their information is being used.
These are important questions for any organisation seeking to use AI responsibly.
Good governance doesn’t need to prevent innovation. In fact, it can make businesses more confident about introducing new capabilities because they understand the risks and have appropriate controls in place.
The information behind the decision matters
An automated system is only as useful as the information and processes supporting it.
Imagine a business using software to evaluate customer applications.
If the underlying data is inaccurate or incomplete, the outcome may be wrong, even if the software operates exactly as designed.
The same challenge can arise when information is stored across several systems, access permissions are unclear or employees do not understand how automated recommendations are generated.
Before expanding the use of automated decision-making, businesses should consider how personal information is collected, stored and maintained.
They should also understand which employees and systems can access that information.
This becomes particularly important as organisations begin connecting AI tools to internal systems.
A platform may have access to more information than its users realise. An automation may be acting on data that was originally collected for a different purpose.
Understanding those connections helps organisations identify privacy and security risks before they become serious problems.
Why human oversight still matters
Automation can dramatically reduce the time required to complete certain tasks, but speed should not be the only measure of success.
Decisions that have a meaningful effect on someone’s circumstances deserve appropriate scrutiny.
In some situations, a computer program may be suitable for gathering information or recommending an outcome, while a person remains responsible for reviewing the result.
In other circumstances, the business may have legitimate reasons to allow a system to make a decision automatically.
The appropriate approach will depend on the type of decision, its consequences and the organisation’s legal responsibilities.
Having a person somewhere in the process does not necessarily remove the new transparency obligations. The rules can also apply when software performs something substantially and directly related to making a decision.
That makes it important to understand the actual workflow rather than simply asking whether a human presses the final approval button.
A well-designed process should make clear where the technology is being used, how results are checked and who is accountable for decisions.
What should businesses do before 10 December?
For organisations that may be affected, the starting point should be a review of existing systems and business processes.
A useful first step is to identify where computer programs use personal information to make or substantially contribute to decisions about individuals.
This may require conversations with departments beyond IT, particularly human resources, finance, operations and customer service.
The next step is to understand the significance of those decisions. A system that automates a routine administrative task is not necessarily subject to the same requirements as one that influences access to employment, financial assistance or essential services.
Businesses should then review what personal information is used, whether the relevant organisation is covered by the Australian Privacy Principles and what disclosures may need to appear in its privacy policy.
The Office of the Australian Information Commissioner has published guidance explaining the new obligations and the circumstances in which they may apply.
Where the application of the rules is unclear, obtaining appropriate privacy or legal advice is sensible.
The technology team can help identify systems, information flows and permissions, while legal and privacy specialists can help determine the organisation’s obligations.
A good opportunity to review your AI strategy
Even businesses that are not directly affected by the new requirements can benefit from reviewing how automated tools are being introduced.
AI capabilities are appearing inside software products that organisations already own.
Employees may be using external platforms without formal approval.
Departments may be experimenting with automation independently, without considering how those decisions affect the wider business.
A review can help establish which tools are being used, what information they access and whether appropriate safeguards are in place.
It may also reveal opportunities to make the technology more useful.
When information is organised properly and processes are clearly defined, AI and automation are more likely to deliver consistent results.
Good oversight should support the business’s ability to innovate, rather than becoming something considered only after a problem occurs.
Why this matters to us
At eManaged, we believe technology should help organisations work more efficiently without creating risks they don’t understand.
Artificial intelligence and automation offer genuine opportunities for businesses of all sizes. We regularly see how better systems can reduce administration, improve productivity and give employees more time to focus on their customers.
But those benefits need to be supported by appropriate security, data management and governance.
The new privacy requirements are a useful reminder that adopting technology involves more than choosing a product and switching it on.
Businesses need to understand how their systems work, what information they use and how those systems affect the people who rely on them.
At eManaged, we help organisations build that understanding by reviewing their technology environments, identifying potential risks and developing practical plans for secure, well-managed technology.
With the new requirements commencing on 10 December 2026, this is a timely opportunity for business owners and leadership teams to examine their existing systems and ensure they are prepared.
If your business is using AI or automated software to make important decisions, now is the time to understand how those systems operate and whether additional safeguards or disclosures may be required.
Talk to eManaged about reviewing your technology environment and preparing your business for responsible AI adoption.
Visit https://emanaged.com.au/ or call 1300 363 308 to start the conversation.