From 10 December 2026, an agency that uses a computer program to make significant decisions about people has to say so in its privacy policy.
The rule is short. The drafting is hard. In most agencies the result will be unreadable, because somebody will write it as a legal clause rather than as public information.
This is a content design problem dressed as a legal drafting task. Treat it as the second one and a privacy officer signs off something the person affected by the decision cannot use.
The same disclosure, written two ways
Here is the version that gets drafted by default, beside a version a person can act on.
Decisions that could reasonably be expected to significantly affect the rights or interests of individuals may be made solely by the operation of computer programs that use personal information held by the entity. The kinds of personal information used in such operations include information collected in the course of administering relevant programs.
Decisions we make using a computer program
We use computer programs to make some decisions about you. This section explains which decisions, and what information the programs use.
Decisions a computer makes on its own
A computer program decides whether you qualify for [payment name]. No staff member reviews it first.
Decisions a computer helps with
A computer program works out your [payment name] rate. A staff member checks the rate before we tell you.
What information the programs use
The programs use what you tell us in your application. They also use income data we receive from the Australian Taxation Office, and your past payment records.
If you disagree with a decision
You can ask us to review the decision. A staff member, not a computer, makes the review decision.
Those labels are real headings, not bold paragraphs styled to look like them. Web Content Accessibility Guidelines (WCAG) 2.2 asks for that under Info and Relationships, 1.3.1, Level A. It is the first thing to get right.
The second version still meets the law. It names the kinds of decisions a program makes on its own. It names the kinds where a program does something substantially related. It names the personal information used. Those are the 3 things you have to publish.
It then adds the thing a reader needs, which the law does not ask for and which costs you nothing.
This is not creative writing. It is the standard content design move: remove the abstraction, add the user task.
What the law actually asks for
The obligations sit in the Privacy Act 1988 as Australian Privacy Principles (APP) 1.7, 1.8 and 1.9. They arrived with the Privacy and Other Legislation Amendment Act 2024, which received Royal Assent on 10 December 2024. That gave everyone 2 years.
It helps to name the 3 parts by what they do.
The test (1.7)
It applies where all 3 of these are true:
your entity has arranged for a computer program to make a decision, or to do something substantially and directly related to making one
the decision could reasonably be expected to significantly affect a person's rights or interests
personal information about that person is used in the operation of the program
What you have to publish (1.8)
Where the test is met, the privacy policy has to set out 3 things. The kinds of personal information the program uses. The kinds of decisions made solely by the program. And the kinds where the program does something substantially and directly related to the decision.
What also counts (1.9)
Refusing or failing to make a decision counts as making one. A decision counts whether it helps a person or harms them.
The Act gives examples. Granting or refusing a benefit under legislation. Affecting rights under a contract. Affecting access to a significant service or support.
The rule is not about artificial intelligence. A computer program here covers rule-based systems, spreadsheets and ordinary business software just as much as a model. Scope this as an AI exercise and you will miss most of what you have.
Four things people get wrong
It is a transparency rule and nothing more
It carries no right to an explanation. No right to ask about a specific decision. No duty to notify a person. And no right to human review.
The Office of the Australian Information Commissioner says so directly in its issues paper. If your organisation is calling this Australia's answer to the European right to contest automated decisions, that is wrong.
Old systems are caught straight away
The obligation applies to decisions made after 10 December 2026, whatever the age of the system making them. Nothing grandfathers a rules engine built in 2011.
Commonwealth agencies are in, most state agencies are not
The Privacy Act 1988 binds Commonwealth agencies on the same terms as businesses. State and territory agencies sit outside it, apart from the ACT and Norfolk Island.
If you work in a state jurisdiction, check your own privacy legislation rather than assuming this applies. Western Australia's regime started on 1 July 2026. It is stricter, and it does include notification and a right to ask for human intervention.
Guidance is close, not distant
The Office of the Australian Information Commissioner released an issues paper on 18 May 2026, and submissions closed on 15 June. It intends to publish guidance by September 2026. Draft against the Act now and check your work when the guidance lands.
Why the boilerplate version keeps happening
Three failure modes follow from how privacy policies get written.
Lifted definitions
The drafter copies the statutory language wholesale. A reader then cannot tell whether their licence renewal, debt notice or benefit assessment is one of those decisions.
The hidden agent
The disclosure says a decision is made, or the system determines. It never names who decides, what the program is, or what the person is being decided about.
Passive voice and nominalisation are the standard tools of policy writing. In this disclosure they are fatal.
The missing user task
The drafter assumes the reader wants to understand the system. The reader wants 3 things. Did a computer decide something about me. What did it decide. What can I do about it.
A disclosure that meets the law and defeats the reader has met the obligation and failed the person.
The other tests it has to pass
This is public-facing content, so it carries the same obligations as any other page.
Reading level. The usable version above tests at Flesch-Kincaid grade 6.6, with sentences averaging 8.7 words. That sits inside the Australian Government Style Manual target of year 7. The boilerplate tests at grade 18.6, with sentences averaging 26 words. Run the test before you publish, not after.
Link text. "Ask us to review the decision" works out of context. "Click here" and "read more" do not, which is Link Purpose, 2.4.4, Level A.
Real text. Publish it as text on a webpage. Not an image, and not a PDF as the only version, which fails almost everything at once.
Sentence length. Keep the average at 15 words and the ceiling at 25. That is the Style Manual's guidance, and it is the single change that moves reading level fastest.
What to do now
Map your automated decision surface
Work with the people who run the systems. List the decisions and the information used. For each one, note whether the program decides on its own or does something substantially related. Include the rules engines and the spreadsheets.
That list is the input for the disclosure. It is also the input for every conversation that follows with legal, privacy and risk.
Draft it once, with the right people in the room
Get a content designer in the room with the privacy officer before the draft hardens. Do the plain language work on the first pass. Retrofitting it to a legal draft is harder and gives you a weaker result.
Treat the disclosure as part of the service
Link from the decision letter to the disclosure, and from the disclosure to the review pathway. The law does not ask for that. The person holding the letter does.
What it costs to get wrong
APP 1.7 becomes a civil penalty provision when it starts. A court can order up to 200 penalty units for an individual and 1,000 for a body corporate. A Commonwealth penalty unit is $364 for conduct on or after 1 July 2026, which makes the maximums $72,800 and $364,000.
Check the unit value before you repeat a figure. Pages published before the July 2026 indexation still quote the old $330 unit.
What good looks like
Your disclosure names the payment, permit or service by the name the reader knows it by.
A reader can tell which decisions a computer makes alone and which a person checks.
The disclosure says what to do if you disagree, and names a person as the reviewer.
Your list of automated decisions includes at least one spreadsheet or rules engine.
The decision letter links to the disclosure, and the disclosure links to the review pathway.
Look at your draft disclosure. A person has just received an automated decision about them. Can they use it to work out what happened, and what to do next?
If not, you have until 10 December.
Photo by Google DeepMind on Unsplash.