Artificial intelligence is moving into customer service, recruitment, fraud checks, marketing and other business workflows. When software makes or informs an important decision, the business needs to understand what information is used, what the system does and how a person can question the result.
Why the December change matters
The OAIC says that from 10 December 2026, relevant APP entities must include information in their privacy policies when they have arranged for a computer program to make, or substantially contribute to, decisions that may significantly affect an individual’s rights or interests using personal information. This is a transparency obligation, not a requirement to abandon useful automation.
Build an AI decision inventory
List tools that score, rank, approve, reject, recommend or route people. Include systems supplied by vendors, features hidden inside larger software platforms and workflows where a staff member relies heavily on an automated result. Record the data used, the business purpose, the supplier, the human checkpoint and the people affected.
Check the privacy policy and records
For each relevant process, identify the kinds of personal information used and the kinds of decisions made solely by the program or substantially related to it. Keep a current vendor register and a short explanation of how the process works. Ask suppliers where data is stored, how it is protected, whether it is used for training and how changes are communicated.
Keep meaningful human review
Human review should be more than clicking approve. Give staff enough information to challenge an output, correct inaccurate data, record the reason for an override and escalate unusual cases. Test the workflow with normal, incomplete and misleading inputs before it affects real customers or applicants.
Start with one practical review
Choose one workflow that influences a customer, employee or applicant. Map it, check its privacy wording, test the human hand-off and assign an owner for the next review. A small, documented improvement is a better starting point than an untracked AI register that nobody uses.
Sources
- OAIC: New resources on transparency for AI and automated decision-making
- OAIC: APP 1 Open and transparent management of personal information
Leave a comment