From December, If AI Helps Decide, Your Privacy Policy Has to Say So

A quiet thing has happened in a lot of small businesses over the past year. Software started making the call. Which job applicant gets shortlisted, which customer sees the discount, whether an account gets approved, what price shows up on the screen. You may have wired an AI tool into one of these without ever thinking of it as a decision the business now hands to a machine. From 10 December 2026, the law does think of it that way, and it will expect you to be open about it.

The change comes from the Privacy and Other Legislation Amendment Act 2024, the biggest overhaul of Australian privacy law in decades. Buried inside it is a new transparency rule for automated decision-making that starts on 10 December 2026. In plain terms: if a computer program uses someone's personal information to make, or substantially help make, a decision that could reasonably be expected to significantly affect them, your privacy policy has to say so. The Office of the Australian Information Commissioner, the OAIC, is the regulator that will hold businesses to it.

You might be thinking your business is too small to be caught by any of this. For now that may be true: the Privacy Act has long exempted many businesses turning over under three million dollars a year. But that exemption is being wound back, not widened. The Government has said it intends to remove it in the next round of reforms, and separate money-laundering rules are already pulling tens of thousands of small businesses under the Act from July 2026. The direction of travel is one way, and adopting AI is exactly what puts you in its path.

What actually changes on 10 December

Not every automated step counts, and it is worth being clear about that so nobody panics over a spreadsheet formula. The rule is about decisions with real weight behind them, the kind that could reasonably be expected to significantly affect a person's rights or interests, made with their personal information in the mix. Think automated credit or payment-plan approvals, insurance-style eligibility and pricing, screening rental or job applicants, or deciding who is approved for an account or a service and who is turned away.

When a computer program makes or meaningfully contributes to a call like that, your privacy policy has to spell out that it happens, the kinds of personal information the system uses, and the kinds of decisions it makes. It is a written, upfront disclosure, not a pop-up on every transaction. And it has teeth: the OAIC can back the new rules with compliance and infringement notices, with reported penalties running into the tens of thousands of dollars per breach for a policy that does not measure up. This is not a box you want to be discovering in January.

Why this lands hardest on the businesses moving fastest

Here is the awkward part. The businesses this rule finds first are the ones doing exactly what the smart money says to do: leaning into AI and automation to do more with a small team. Every time you let a tool decide something instead of merely suggesting it, you may be creating an obligation you did not know you had. We have written before about treating AI as a system rather than a one-off tool, and this is the same lesson wearing a compliance hat. The advantage goes to the businesses that build it deliberately, not the ones that bolt tools together and hope.

None of this is an argument to slow down on AI. The savings are real and the businesses using it well are pulling ahead. It is an argument for setting it up so it holds up: knowing which of your automations actually make decisions that matter, and being able to say so plainly. That is quiet, unglamorous work, and it is precisely the sort of thing that gets skipped when an owner is already doing three jobs.

What good looks like from here

You do not need to become a privacy lawyer. You need your automation set up so the honest answer is easy to give. When it is handled properly, this is what you get:

• A clear map of which tools in your business actually make decisions that count, and which are harmless behind-the-scenes helpers.
• A privacy policy that is honest about where a computer sits in the loop, so customers read it as confidence rather than something to be suspicious of.
• Automations that are documented, so if a customer or the regulator ever asks how a decision was made, you have a straight answer ready.
• The full speed and cost saving of automation, without the blind spot that turns into a fine or a broken bit of trust down the track.

The rule is simple to say and fiddly to meet: if a machine helps decide something that matters to a person, you have to be honest that it does.

The businesses that come out ahead will treat December as a setup date, not a scramble. Whether your business is captured today depends on the detail, your turnover, your industry, and what customer information you hold, so it is worth confirming your own position with the OAIC's guidance or your adviser rather than guessing. The rules keep moving, and the safe assumption is that the net gets wider, not narrower.

This is the exact seam NextAura works in: building the AI and automation that make a small business faster, and building it so it stands up to scrutiny. Transparent, documented, and on the right side of rules like this one, from the start rather than patched in later. If software is already making calls about your customers, get in touch, and we will set it up so it saves you time and keeps you out of trouble, while you get back to running the business.