From 10 December, some businesses have to write down what their software decides about people. Every business should know the answer anyway.

Ask a business owner whether software makes decisions about their customers and the answer is usually no — maybe one day, once they get around to AI. Then ask a narrower question. Is there anything in your systems that automatically refuses a booking, puts an account on hold, asks one customer for payment up front but not another, or filters out a job applicant before anyone reads the application? That answer is usually yes, and nobody can quite remember who set it up.

Those are decisions. They were made by a rule, the rule runs on information about a person, and the person on the receiving end generally has no idea a rule was involved. From 10 December 2026, for a meaningful slice of Australian businesses, that stops being a private matter.

What actually changes

The Privacy Act amendments passed in late 2024 added a transparency obligation to the first Australian Privacy Principle, and it commences on 10 December this year. In plain terms, it bites when three things are all true.

• You have arranged for a computer program to make a decision, or to do something substantially and directly related to making one.
• That decision could reasonably be expected to significantly affect an individual's rights or interests.
• Personal information about that individual is used in running the program.

When all three hold, your privacy policy has to say so: the kinds of personal information those programs use, the kinds of decisions made solely by a program, and the kinds of decisions where a program does something substantially and directly related to the decision. It is a disclosure obligation, not a ban — nothing in it stops you automating. It stops you automating quietly.

Two details in that wording are worth slowing down on, because they are where most people's assumptions go wrong.

The first is that it says computer program, not artificial intelligence. A formula in a booking system that declines anyone outside a postcode list is a computer program. So is a payment-terms rule someone wrote in 2021. The obligation does not care how clever the software is.

The second is that a person being somewhere in the loop does not automatically take you outside it. The phrase covers programs that do something substantially and directly related to a decision, which is aimed squarely at the recommendation a human approves without really checking. In its consultation earlier this year, the privacy regulator flagged the factors it is weighing — how much the decision relies on the program's output, whether a human can override it, how likely it is that they actually do.

Who it covers — the honest version

This is the part most of the articles now circulating skip, so it is worth being direct. The obligation applies to entities covered by the Australian Privacy Principles. For private businesses that generally means an annual turnover above $3 million, plus some smaller businesses that are covered regardless of size — health service providers and businesses that trade in personal information are the usual examples.

Which means a lot of owner-operated service businesses reading this are not caught by it, and anyone selling you a compliance package on the basis that you are should be asked to show their working. If you are unsure which side of the line you sit on, that is a question for your accountant or adviser, not a blog post.

Why it is still worth an afternoon if you are exempt

There are three reasons, and none of them are about fear of the regulator.

• Your clients may be covered even if you are not. Facility managers, strata managers, builders and anyone on a government panel are frequently well over the threshold. When their own privacy policies have to describe automated decisions, the supplier questionnaire gains a question about yours, and “we have never thought about it” is the answer that loses contracts.
• You grow into it. The threshold is a number, and a business that is doing well crosses numbers. Working out what your systems decide is far easier when there are four rules than after a few years of new tools have each added their own.
• It is the right question regardless. A customer turned away by a rule nobody remembers writing has been treated unfairly by nobody in particular. That is a bad outcome whether or not a regulator ever hears about it.

What plausibly counts as a significant decision

The examples in the legislative material lean towards the serious end — refusing access to a service, affecting someone's rights under a contract, pricing that effectively shuts someone out. An automatic appointment reminder is not that. The regulator has said it intends to publish guidance before the start date, and it is worth checking whether it has, because that guidance will draw the line better than anyone's summary can.

In the meantime, for a typical service business, these are the ones worth putting on the list — not because each is definitely caught, but because each is the kind of thing that could be.

• Rules that refuse or cap service automatically: outside the service area, below a minimum, flagged as a previous no-show.
• Rules that change terms for a person based on their history: requiring prepayment, suspending an account, withdrawing a payment plan.
• Pricing that varies per customer based on information about them, rather than on the job itself.
• Anything that screens job applicants before a human reads the application — a keyword filter counts, not only an AI one.
• AI that triages enquiries and decides which ones get a callback, a quote, or nothing.

The useful test is not whether the software is AI. It is whether a person could end up with a worse outcome, without anyone at your business having looked at their case.

The afternoon version

• List every system that holds customer, staff or applicant information. The same list from any data-handling review works as a starting point.
• For each one, write down anything it does automatically that changes what happens to a person — not what it records, what it does.
• Mark each item as decides, recommends, or drafts. Decides is a rule acting on its own. Recommends is output a person usually follows. Drafts is output a person genuinely reviews and changes. Be honest about the middle column; that is where most things really sit.
• Ask of anything in the first two columns: could this plausibly count as significant for the person? If yes, note what information it uses.
• If you are over the threshold, that list is the raw material for your privacy policy update. If you are not, it is the answer you give when a client asks — and the list of rules you might want to switch off.

One caveat that matters: this is the operational shape of the change, not legal advice. The OAIC's own material on the automated decision-making obligation is the source worth reading, and whether it applies to you is a question for someone who knows your business.

Our side of it

We build software that puts AI close to customer conversations, so the decides-versus-drafts distinction is not theoretical for us. In Dispatch, the AI drafts replies to enquiries from your own price list and a person still presses send. That was a design choice about supervision long before this obligation existed, and it does not by itself put anyone outside the rules — a draft that gets sent unread is a recommendation wearing a costume. But it does mean the question “what does your software decide on its own?” has a short answer, and that is the property worth asking every vendor about. The data-handling half of the same conversation is in the AI you never chose to buy.

The obligation will affect a minority of small businesses directly. The question behind it affects all of them. Software has been quietly making small decisions about people for years, mostly by rules someone set up once and never revisited — and the businesses that can say exactly what those rules are will find December, and the supplier questionnaire after it, a much shorter conversation.