Automated Decision-Making (ADM) Discovery
What counts as ADM under the Privacy Act, the four-tier decision classification hierarchy, and how to identify which of your systems trigger the 10 December 2026 disclosure obligation.
Automated decision-making (ADM) is a process where a computer program uses an individual's personal information to make, or to substantially and directly assist in making, a decision that affects that individual's rights, interests, or circumstances, with little or no direct human involvement in the specific decision. Under the Privacy Act 1988 (Cth), the APP 1.3 amendment requires covered entities to disclose their use of ADM in their privacy policy — specifying the kinds of decisions, the personal information involved, and how an individual can seek human review — from 10 December 2026.
Last updated: 1 July 2026
What counts as ADM
| Category | Discloseable as ADM? | Example |
|---|---|---|
| Fully automated decision using personal information | Included | Instant credit or buy-now-pay-later approval with no manual review |
| AI-assisted decision, human rubber-stamps output | Included | Resume-screening score staff almost always follow without independent review |
| Personalised pricing or eligibility scoring | Included | Dynamic discount or premium calculated from a customer's personal data |
| Advisory recommendation with genuine independent human review | Partial | Underwriter uses a risk score as one documented input among several |
| Automation on non-personal or aggregate data | Excluded | Automated inventory reordering, aggregate website analytics |
How this is interpreted in practice
The trigger for ADM disclosure is not "is a computer involved" — it is whether personal information is used to make or substantially assist a decision affecting a specific individual's rights or interests. That excludes internal, aggregate, or non-personal automation, and includes any system whose output a human "reviews" in name only.
"Substantial assistance" is the concept businesses most often misjudge. Having a human formally click "approve" does not exempt a system from ADM if that human's decision is, in practice, determined by the automated score or recommendation. Regulators and courts examining ADM look at outcome patterns — if a human override rate is near zero, the human step is not a genuine safeguard, and the decision is treated as automated for disclosure purposes.
A second common gap: businesses correctly identify ADM in a core product feature (loan scoring, tenant screening) but miss it in supporting functions such as complaint triage, marketing eligibility, or HR performance flagging — all of which can independently trigger the disclosure obligation if personal information drives an automated or AI-assisted decision.
Decision classification hierarchy
| Tier | Human involvement | APP 1.3 disclosure |
|---|---|---|
| Fully automated | None in the specific decision | Required |
| AI-assisted | Formal sign-off, output substantially shapes outcome | Required |
| Advisory | Recommendation only, documented independent judgement | Assess case by case |
| Manual | No automated system involved | Not applicable |
ADM exposure scanner
Answer four questions about one system, tool, or process. Get an instant classification against the four-tier hierarchy above, plus a disclosure requirement flag and draft policy wording — at a shareable URL for each system you check.
"[System name] uses [personal information type] to assist decisions about [affected group]. A staff member reviews the output before it takes effect. Individuals may request an explanation or human review by contacting [contact details]."
Plus your tier classification and the reasoning behind it — generated from your four answers below.
When you need ADM discovery
- — You use any system that scores, ranks, approves, or prices based on personal information
- — You're preparing your privacy policy for the 10 December 2026 ADM disclosure deadline
- — You've recently added or upgraded a recruitment, credit, insurance, or pricing tool
- — An individual has asked how a decision about them was made
- — You're not sure whether "a human clicks approve" is enough to avoid ADM disclosure
- — You're responding to an OAIC inquiry or enterprise vendor questionnaire about automated decisions
Frequently asked questions
What is automated decision-making (ADM) under the Australian Privacy Act?
A process where a computer program uses personal information to make, or substantially and directly assist in making, a decision affecting an individual's rights, interests, or circumstances, with little or no direct human involvement. APP 1.3 requires disclosure of ADM use from 10 December 2026.
What does "substantial assistance" mean in the context of ADM?
It means the automated output materially shapes the outcome even where a human formally makes the final call — for example, a loan score staff almost always approve as recommended. Substantial assistance is treated as equivalent to a fully automated decision for disclosure purposes.
Does ADM require personal information to apply?
Yes. The APP 1.3 obligation applies to decisions made using personal information that affect an individual's rights or interests. Automated systems processing only aggregate or de-identified data don't trigger the disclosure requirement.
What are the four categories in the ADM decision classification hierarchy?
Fully automated, AI-assisted, advisory, and manual. Only fully automated and AI-assisted are treated as ADM requiring disclosure; advisory decisions with genuine independent human review are assessed case by case.
What is the ADM disclosure deadline in Australia?
10 December 2026. From that date, covered entities using ADM must disclose it in their privacy policy under the amended APP 1.3, describing the kinds of decisions, the personal information used, and how to seek human review.
Which business functions commonly involve ADM?
Credit and loan approval, insurance underwriting, recruitment screening, tenant selection, personalised pricing, fraud scoring, complaint triage, and eligibility screening are the functions most frequently found to involve ADM in AU SMEs.
How does ADM disclosure connect to my privacy policy?
It's a required section within the existing APP 1 privacy policy, not a separate document. It must stay current — an outdated disclosure that omits a live ADM system is itself a gap an OAIC inquiry would identify.
Does a spam filter or basic automation count as ADM?
Generally no. The test is whether personal information is used to make or substantially assist a decision affecting a specific person's rights or interests — not whether a process is automated in a general sense.
What happens if a business fails to disclose its ADM use?
It's a breach of the Australian Privacy Principles. Penalties for serious or repeated interferences with privacy under the Privacy Act 1988 (Cth) can reach $50 million, three times the benefit obtained, or 30% of adjusted turnover. Non-serious per-contravention penalties can reach $66,000.
Run the free ADM exposure scanner to find out which of your systems need a privacy policy disclosure before 10 December 2026.
Get my ADM classification →