Do I Need to Disclose AI Decision-Making to Customers?
What counts as ADM, what the 10 December 2026 deadline requires, and the free tools to find your exposure.
Yes, from 10 December 2026, if you're a covered entity using a system that makes or substantially assists a decision affecting an individual — such as AI-assisted loan approvals, automated job screening, or personalised pricing. APP 1.3 requires a dedicated disclosure section in your privacy policy.
Last updated: 2 July 2026
Quick reference
| Governing principle | APP 1.3 — automated decision-making disclosure |
| Deadline | 10 December 2026 |
| What must be disclosed | Each ADM system, decisions it affects, how to seek human review |
| Related right | Individuals can separately request an explanation of a specific decision |
What businesses tend to miss
"AI" is a narrower trigger than most businesses assume, and a broader one than they expect in other ways. A simple rules-based scoring spreadsheet that substantially assists a decision about a customer can qualify just as much as a large language model — the test is the effect on the individual, not the sophistication of the technology.
A second common gap: businesses correctly identify that they're covered by the Privacy Act generally, but treat ADM disclosure as optional or "future proofing" rather than a hard deadline. From 10 December 2026, a covered entity using a qualifying system without a disclosure section is non-compliant with APP 1.3.
Relevant free tools
Identify which of your systems count as automated decision-making that needs disclosure.
Analyse your existing privacy policy against APP 1 requirements.
Generate a compliant response letter for an access, correction or ADM explanation request.
Related Privacy Act questions
When to check your ADM exposure
- — You use AI or automated tools anywhere in your customer, applicant, or staff decisions
- — You're not sure whether a scoring or ranking system counts as ADM
- — Your privacy policy hasn't been updated to include an ADM disclosure section
- — You don't have a documented process for a person to request human review of a decision
- — The 10 December 2026 deadline is approaching and you haven't run an inventory of your systems
Frequently asked questions
Do I need to disclose AI decision-making to customers?
Yes, from 10 December 2026, if you're a covered entity using a system that makes or substantially assists a decision affecting an individual — such as AI-assisted loan approvals, automated job screening, or personalised pricing. APP 1.3 requires a dedicated disclosure section in your privacy policy.
What counts as automated decision-making?
Any system that makes or substantially assists a decision that could reasonably be expected to significantly affect an individual's rights or interests, using their personal information — including AI chatbots handling complaints, automated credit scoring, or algorithmic candidate screening.
What must the ADM disclosure section include?
A list of each automated decision-making system in use, the kinds of decisions it makes or assists, and how an individual can seek human review of a decision made about them. This is separate from the general privacy policy content required under APP 1.
Do I still need to disclose if people can request an explanation?
Yes — both requirements can apply together. From 10 December 2026, APP 1.3 requires proactive disclosure in your privacy policy, and individuals can separately request an explanation of a specific automated decision made about them.
Run the free ADM discovery tool to identify which of your systems need disclosure before 10 December 2026.
Check my ADM exposure →