The Office of the Australian Information Commissioner (OAIC) has now released guidance on the automated decision-making transparency obligations commencing on 10 December 2026. The guidance provides greater clarity regarding what organisations need to do to prepare for compliance.

With the commencement date approaching, organisations should now focus on identifying relevant systems, understanding how personal information is used in decision-making processes, updating privacy documentation and ensuring appropriate governance measures are in place. The following six steps can help organisations prepare.

Step 1: Create an inventory of relevant systems

Organisations should begin by identifying systems that use personal information to make, support or influence decisions about individuals. This review should extend beyond AI systems and include other software, algorithms and decision-support tools used across the business.

Examples of systems that may warrant review include:

• recruitment and applicant tracking platforms;
• employee performance management tools;
• customer onboarding systems;
• fraud detection and risk assessment software;
• eligibility assessment systems; and
• pricing or customer profiling tools.

The OAIC’s guidance indicates that a system may be captured even where a human ultimately makes the final decision. Organisations should not assume that a process falls outside the regime simply because a person approves the outcome. If software is used to recommend, rank, prioritise, score or otherwise meaningfully influence a decision, the new obligations may apply.

Step 2: Assess whether those systems influence significant decisions

Once relevant systems have been identified, organisations should assess the decisions those systems support.

The OAIC’s examples focus on decisions with practical consequences for individuals, including:

• recruitment and employment decisions;
• performance, promotion and remuneration decisions;
• lending and insurance decisions;
• eligibility for products, services or benefits;
• healthcare and housing decisions; and
• personalised pricing decisions.

Organisations should consider whether technology is being used to influence decisions affecting employees, job applicants, customers, members or other individuals, and whether those decisions could reasonably be expected to significantly affect an individual’s rights or interests. This is likely to be a key consideration when assessing whether the transparency obligations apply.

Step 3: Document the personal information used

The new transparency obligations require organisations to understand what personal information is being used within relevant systems.

As part of their review, organisations should identify:

• the categories of personal information used by the system;
• whether any sensitive information is used;
• how that information is used by the technology; and
• what decisions the technology assists in making.

Where systems rely on health information, biometric information or other forms of sensitive information, organisations should ensure that this is appropriately documented and reflected in their privacy practices.

Step 4: Obtain information from technology vendors

Many organisations rely on third-party software providers for recruitment, HR, compliance, customer management and other operational systems.

The OAIC has made clear that responsibility for complying with the transparency obligations will generally remain with the organisation using personal information to make or inform decisions, even where the technology is supplied by a third party.

Organisations should therefore engage with technology vendors to understand:

• what personal information is used by the system;
• how the system processes that information;
• how the system contributes to decision-making processes; and
• whether sufficient information is available to support required privacy disclosures.

Organisations may also wish to review procurement processes, vendor due diligence procedures and contractual arrangements. In practice, organisations may need additional information from software providers about how their products use personal information and contribute to decision-making processes in order to ensure adequate visibility and support compliance with the transparency obligations.

Step 5: Update privacy policies

Once relevant systems and activities have been identified, organisations should review their privacy policies.

The OAIC’s guidance indicates that privacy policies should explain:

• the kinds of personal information used by relevant computer programs;
• the kinds of decisions made by those computer programs; and
• the kinds of decisions for which those programs perform functions that are substantially and directly related to making the decision.

The OAIC’s guidance suggests that organisations can generally describe categories of personal information and categories of decisions at a high level, rather than providing detailed technical explanations of individual systems.

Importantly, organisations are not required to disclose source code, algorithms or commercially sensitive technical information. Instead, privacy policies should provide meaningful information that helps individuals understand how technology is being used in decision-making processes that affect them.

Many organisations may find it useful to include a dedicated section in their privacy policy addressing automated or computer-assisted decision-making.

Step 6: Review governance processes

The new obligations should also be incorporated into broader privacy and technology governance processes.

Organisations should consider whether their existing privacy governance frameworks, privacy impact assessment processes, AI governance frameworks, procurement procedures, and technology risk assessment processes adequately capture the new transparency requirements.

Embedding these considerations into existing governance processes can help organisations identify future compliance issues as new technologies are adopted.

Key takeaway

The OAIC’s guidance provides a practical roadmap for complying with the new automated decision-making transparency obligations that commence on 10 December 2026. Organisations should now focus on identifying relevant systems, understanding how personal information is used within those systems, engaging with technology vendors where necessary and updating privacy documentation and governance processes accordingly.

Organisations that begin this process now will be better placed to implement the required disclosures and demonstrate compliance when the new obligations take effect.

If you would like assistance assessing whether your organisation’s systems may be captured, reviewing vendor arrangements, updating privacy documentation or developing governance frameworks to support compliance, please contact HWLE’s Privacy and Data team.

This article was written by Luke Dale, Partner, and Ashlee Broadbent, Associate.