On 10 December 2026, a change to the Privacy Act commences that most SMEs have not read yet. It is short. It is specific. And it asks a question many businesses cannot currently answer: where does software, including AI, make or shape decisions about people?
This is not a new AI law. It is a disclosure rule inside the Privacy Act. Here is what it says, who it reaches, and what being ready looks like in practice.
What changes on 10 December 2026
The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. Most of it started straight away. The automated decision-making transparency provisions were given 2 years' lead time. That time runs out on 10 December 2026.
From that date, if the Privacy Act applies to your organisation, your privacy policy has to disclose where you use computer programs to make decisions, or to do things substantially and directly related to making them, where those decisions could reasonably be expected to significantly affect an individual's rights or interests.
"Computer program" is deliberately broad. It covers AI tools. It also covers rules-based software that was never called AI.
What disclosure actually requires
The privacy policy has to describe 3 things:
- The kinds of personal information used in the operation of those programs.
- The kinds of decisions made solely by a program.
- The kinds of decisions where a program does something substantially and directly related to the decision.
Note the word "kinds". You are not publishing a list of every decision. You are describing categories, accurately.
Note also what counts as significant. The legislation points to decisions that affect a person's rights under a contract or law, or their access to a significant service or support. Think credit and payment terms, tenancy applications, recruitment screening, claims, eligibility, pricing that differs person to person.
A few examples of where SMEs are likely to be in scope:
- A recruitment tool that ranks applicants before a human reads them.
- An AI assistant that scores tenancy applications for a property manager.
- A credit or payment-terms decision driven by a model.
- A client onboarding workflow where AI flags risk and a person mostly follows the flag.
That last one matters. A human in the loop does not automatically take you out of scope. If the program does something substantially and directly related to the decision, it is in.
Who it reaches
The provisions apply to APP entities, which means organisations covered by the Privacy Act. That includes businesses with annual turnover over $3 million, and some smaller businesses that are covered for other reasons, such as health service providers.
It also includes AUSTRAC reporting entities for the personal information they handle for AML purposes. From 1 July 2026, lawyers, accountants, conveyancers, real estate agents and trust and company service providers providing designated services became reporting entities. If that is you, the Privacy Act now applies to that information even if your turnover is under $3 million.
If you are unsure whether the Act applies to you, that is the first question to put to your lawyer. It is a short conversation.
The gap between a policy and the practice
Here is where most businesses will come unstuck. Not on the wording. On the facts behind it.
To write an accurate disclosure, you need to know which programs are being used on personal information, and for what. That sounds simple. It usually is not.
Ask any team of 20 which AI tools they use and you get a short list. Ask them anonymously and the list gets longer. Tools get signed up to on a personal card. Browser extensions summarise emails. A staff member uses a free chatbot to draft a tenancy recommendation because it saves 20 minutes. None of it is malicious. All of it is invisible to the person signing off the privacy policy.
That is the gap. A policy says what should happen. Disclosure has to reflect what does happen. And if a regulator, a client or a complainant ever asks, the question will not be "do you have a policy?" It will be "show me."
Being able to show it comes down to 3 things.
You can see it. A current register of the AI tools in use, including the ones nobody approved, with a clear rule about which kinds of data each tool can touch.
You authorised it. The tools, and the prompts, skills and templates your team uses inside them, were approved by a named person. Not assumed. Approved.
You can prove it. A record of what was produced, with which approved version, and when. An evidence pack you can hand over on an ordinary Tuesday, not one you assemble the week before someone asks.
What to do between now and December
The date is 10 December 2026. There is enough time if you start with the facts rather than the wording.
- Find out what is actually in use. Run a no-blame survey. Expect surprises.
- Map the decisions. For each tool, ask whether it makes or substantially shapes a decision that significantly affects a person. Most will not. Some will.
- Set the rules. Decide which tools can be used with which kinds of data. Write it down in a form your team can check in seconds, not a PDF they will never open.
- Update the privacy policy. Describe the kinds of information and decisions accurately. Get your lawyer to review it.
- Keep the record. From here on, keep evidence of what was approved and what was produced. Disclosure is a statement. The record is what backs it.
None of this requires a large program of work. It requires knowing what your business does with AI, and being able to show it.
Where to start
If you do not have an AI policy yet, start there. Our free AI Policy Builder asks 12 questions about your business and produces a tailored draft your lawyer can review. It takes about 5 minutes.
If you have a policy and need the register, the approvals and the record behind it, that is what Howll Govern is for. It comes with every embedded engagement from day one, or you can take it on its own. It will not write your disclosure for you and it will not make you compliant. It gives you the controls, the records and the evidence to stand behind what your policy says.
The rules don't govern your AI. You do. The job before 10 December is being able to show it.
This article is general information, not legal advice. For advice on how the Privacy Act applies to your business, speak to a lawyer.