What the December 2026 Privacy Act changes mean for small firms using AI

From 10 December 2026, new transparency rules added to the Privacy Act by the Privacy and Other Legislation Amendment Act 2024 (Cth) start to apply to organisations covered by the Australian Privacy Principles. If your firm uses a computer program, including AI, to make or substantially help make decisions that could significantly affect someone's rights or interests, your privacy policy will need to say so.

Who does this apply to?

The Privacy Act generally applies to businesses with an annual turnover above A$3 million, and to some smaller ones, such as health service providers and businesses that trade in personal information. Many small firms are exempt today, but the small business exemption is under review, and clients increasingly expect the same standard anyway.

What will you need to explain?

In broad terms, if a computer program makes, or substantially and directly helps make, decisions that could significantly affect someone's rights or interests, your privacy policy will need to describe:

• the kinds of personal information used by those automated systems
• the kinds of decisions made solely by the system
• the kinds of decisions where the system substantially helps a person decide

What this means in practice

1. Know where AI touches decisions. Intake triage, conflict checks and fee estimates can all count.
2. Keep a person in the loop for significant decisions, and record who reviewed what.
3. Write it down. A one-page description of each system makes updating your privacy policy straightforward.

This is how we build every system anyway: we document what each one decides, what it reads, and where a person reviews it.

This article is general information, not legal advice. Check the current OAIC guidance and talk to your lawyer about how the changes apply to your firm.