Using AI in your business? Your privacy policy may need an update
By Jasmin Gabrielli
Another new policy for Australian businesses to be across?
Yes. And this one goes beyond AI.
At a glance
Start date: 10 December 2026 (OAIC, 2026).
Who it applies to: Businesses covered by the Privacy Act. Generally, those turning over more than $3 million a year, plus some smaller ones such as health service providers (Privacy Act, 1988).
What it covers: AI tools, chatbots, rule-based systems and even spreadsheets, where their use meets the disclosure requirements (OAIC, 2026).
What you need to do: Update your privacy policy to explain relevant decisions made or supported by software using personal information.
Using someone else’s platform? That does not automatically transfer your disclosure obligations to the provider (OAIC, 2026).
What is changing?
From 10 December 2026, new provisions in the Australian Privacy Principles, APP 1.7–1.9, require businesses covered by the rules to explain certain uses of automated decision-making in their privacy policies (OAIC, 2026).
The requirement applies where software uses personal information to make, or perform a task substantially and directly related to making, a decision that could reasonably be expected to significantly affect someone’s rights or interests (OAIC, 2026).
For processes within scope, your privacy policy will need to explain:
The types of personal information used.
The kinds of decisions made entirely by software.
The kinds of decisions where software performs a substantially and directly related task.
This is a transparency requirement. These provisions do not themselves create a right to contest a decision or require a separate notification to each person affected (Allens, 2026). Other legal obligations and review rights may still apply.
Think this is just for banks and big tech? Think again.
The Office of the Australian Information Commissioner’s (OAIC) guidance extends beyond sophisticated AI. Everyday software can also fall within scope. What matters is how the tool is used, not whether it is marketed as “AI” (OAIC, 2026).
Processes worth reviewing include:
Screening or ranking job applicants.
Assessing whether someone qualifies for credit or a significant service.
Using personal information to set personalised prices for significant goods or services.
Not every use of software triggers disclosure. The role it plays in the decision and the potential impact on the individual are central to the assessment (OAIC, 2026).
A few points worth knowing:
A human making the final call does not automatically take a tool out of scope.
Software can still be captured where its recommendation or assessment is a key factor directly connected to the decision, even when someone reviews the output (OAIC, 2026).
Using a third-party platform does not make the responsibility disappear.
You may need to ask suppliers how their software uses personal information and contributes to decisions, including through built-in features (OAIC, 2026).
Clear explanations matter more than technical detail.
Similar decisions can be grouped into meaningful categories. Where sensitive information, such as health or biometric information, is used, that should be clearly explained (OAIC, 2026).
Your checklist before 10 December
Map your tools. Identify software used to make or support decisions about people, including third-party platforms and built-in features.
Check what falls within scope. Assess the personal information used, the software’s role and the potential impact on the individual.
Ask your suppliers. Get the information needed to understand and accurately describe relevant processes.
Update your privacy policy. Work with your legal adviser to prepare and publish the required disclosures before the deadline.
Set clear staff guidelines. Define approved AI tools, what personal information staff can enter and when human checking is required.
Review your cyber cover. Check how your policy responds to privacy incidents, including those involving third-party providers.
The staff guidelines and insurance review are broader risk-management steps, rather than new disclosure requirements under APP 1.7–1.9.
So where does cyber insurance fit?
Using personal information across more tools and providers can create additional opportunities for it to be mishandled. Knowing where that information goes, who can access it and how it is used is an important part of managing the risk.
Cyber insurance may help with costs arising from a covered privacy incident, including legal advice, forensic investigation, notification expenses and certain regulatory investigations. The response depends on the policy wording and the circumstances.
As part of your review, check how your policy addresses incidents involving AI tools or third-party platforms, including relevant exclusions, limits and notification requirements. Do not assume an AI-related error or a failure to update your privacy policy will automatically be covered.
Insurance is not a substitute for meeting your privacy obligations. The practical starting point is understanding your tools, your data and how your cover would respond before an incident occurs.
Jasmin Gabrielli
Director & General Manager, Sage Insurance
Jasmin is an experienced insurance professional with over 11 years of general broking expertise across a diverse range of general and hard-to-place specialty lines specifically in commercial applications.
Further reading
More from the OAIC:
https://www.oaic.gov.au/privacy/australian-privacy-principles
A plain English summary from Allens:
https://www.allens.com.au/insights-news/insights/2026/10/mandatory-automated-decision-making-disclosure-requirements-are-coming-key-takeaways-from-the-oaic-guidance/
This article provides general information only, not legal or personal financial advice. Speak to your legal adviser about your privacy obligations. Insurance cover is subject to the terms, conditions, limits and exclusions of the relevant policy.
