The Office of the Australian Information Commissioner (OAIC) published its 'Automated Decision-Making Issues Paper' (Issues Paper) on 18 May 2026. The Issues Paper seeks public feedback in relation to the development of guidance on the automated decision-making obligation (ADM Obligation). The ADM Obligation commences on 10 December 2026 for agencies and organisations regulated by the Privacy Act 1988 (Cth) (APP entities). To support compliance, the OAIC will publish guidance by September 2026 following the conclusion of this consultation on the 15 June 2026.

This article summarises the key elements of the Issues Paper and provides early guidance about which decisions may be captured.

1. Background

1.1 The Privacy and Other Legislation Amendment Bill 2024 (Cth) (Amendment Bill) received Royal Assent on 10 December 2024 and introduced Tranche 1 of the long-anticipated amendments to the Australian Privacy Laws. The Amendment Bill included a new transparency obligation for APP entities to disclose certain information about their use of 'automated decision-making systems' (ADM Systems) in Privacy Policies. 

1.2 The Amendment Bill's Explanatory Memorandum (Explanatory Memorandum) provides that this obligation is intended to provide individuals with greater transparency about how an entity handles their Personal Information and for what purposes, and 'allows them to take further action if there has been a breach of their personal privacy'. The OAIC considers the ADM Obligation works synergistically with other legislation and supports individuals with appropriate exercise of their information access rights, including under the Freedom of Information Act 1982 (Cth).

2. How will ADM transparency improve access to privacy and justice in the digital era?

2.1 The ADM Obligation gives individuals visibility over how APP entities use Personal Information in ADM Systems and the kinds of decisions made using these systems. This will enable individuals to access appropriate review pathways under the relevant legislative frameworks, such as:

• inappropriate handling of Personal Information in ADM Systems (e.g. without consent) could trigger complaints to the OAIC and recourse under the Privacy Act 1988 (Cth);
• use of ADM Systems in ways that result in discrimination on the basis of age, disability, or sex, could trigger review under various anti-discrimination laws; and
• use of ADM Systems in administrative decision-making could be challenged through merits review or judicial review. 

2.2 ADM transparency will enable individuals to raise concerns in a more informed and efficient way.

3. How do the transparency obligations apply to artificial intelligence?

3.1 The ADM transparency requirements apply where computer programs are used to do things 'substantially and directly related to' making a relevant decision. This means decisions made or impacted by artificial intelligence (AI), such as generative AI and machine learning, are captured. However, the obligations also apply to non-AI computer programs. 

3.2 The term, 'computer program' has its ordinary meaning under APP 1.7(a) and encompasses 'a broad range of matters, including pre-programmed rule-based processes, artificial intelligence and machine learning processes' (Explanatory Memorandum).

4. The ADM Obligation – a quick summary

4.1 The Explanatory Memorandum provides that:

• the insertion of APP 1.7 will require APP entities to update their Privacy Policies to include the specific information set out in APP 1.8 about use of ADM Systems if:   
  1. the APP entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making a decision (APP 1.7(a)); and
  2. the decision could reasonably be expected to significantly affect the rights or interests of an individual (APP 1.7(b)); and
  3. Personal Information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision (APP 1.7(c)).
• Under APP 1.8, APP entities will be required to include information in their Privacy Policies including:
  1. the kinds of Personal Information used in the operation of such computer programs; and
  2. the kinds of decisions made solely by the operation of such computer programs; and
  3. the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs.
• The new APP 1.9 provides that for the purposes of APP 1.7 and 1.8:
  1. ‘making a decision’ includes refusing or failing to make a decision; and
  2. ‘doing a thing’ includes refusing or failing to do a thing; and
  3. a decision may affect the rights or interests of an individual, whether the rights or interests of the individual are adversely or beneficially affected. 

4.2 The new obligations in APP 1 will apply broadly, regardless of whether the arrangement for a computer program to make the decision was made before or after commencement of the Amendment Act, and regardless of whether the Personal Information in the operation of the computer program was acquired before or after the commencement of the Amendment Act (Explanatory Memorandum, para [344]).

5. Issues Paper – emerging guidance and areas for consultation 

5.1 In the Issues Paper, the OAIC provides preliminary guidance and key edge cases, to seek feedback about whether they should be captured. We have summarised the preliminary commentary and edge cases in the below table.