On December 10th, 2026, the Australian Privacy Principles (APP) including organisation, business and government agencies overseen by Office of the Australian Information Commissioner (OAIC) will introduce a privacy reform building from the ‘privacy and other legislation amendment act 2024’.
Most businesses assume the December reforms are simple: use AI, disclose it, done.
The reality is more layered than that. Businesses are mandated to state in their privacy policies if the usage of computer programs or any types of Artificial Intelligence is used to create and/or assists in making decisions which could significantly impact an individual’s rights and interests.
We’ve taken the time to audit some common myths about the coming changes and what this means for your organisation.
Myth 1: “I don’t use AI chatbots or generative AI; the new reform doesn’t apply to us”
Clients are often surprised at how far the new legislation reaches. From 10 December 2026, changes to the Privacy Act require organisations to disclose decisions made using either AI or computer programs, it is not limited to AI. The hard part is rarely the policy wording. It is answering a simpler question:
Which of our systems are shaping decisions about people, and what data are they using?
That is where we start. ABT maps the systems and data flows across your environment, then puts governance around them through our Premium Security plan, with Priva Privacy Risk Management, compliance scoring, insider risk and data loss protection running as an ongoing function rather than an annual review.
Myth 2: “Nothing applies till December 10th”
Here at ABT we are already working with clients to prepare for December 10th. Right now, that looks like:
-
- Mapping the systems, integrations and supplier tools that shape decisions about people, so scope is known before the deadline, not after it
-
- Reviewing technical controls against the clarified security obligation, covering access, backup and monitoring rather than policy wording alone
-
- Running Essential Eight aligned baselines and ongoing security management so evidence of reasonable steps exists on paper and in practice
-
- Drafting the privacy policy disclosures now, ready to publish rather than scramble
The reform did not start in December 2026. It started in late 2024, which is why ABT has already been putting these systems in place for clients. The Australian Information Commissioner already holds the power to issue infringement and compliance notices. December 2026 is not the whole reform arriving at once. It is the next scheduled phase of a rollout.
Did you know this? If not how up to date are your policy’s?
Myth 3: “We are a small business; this does not apply to us”
Under the Privacy and Other Legislation Amendment Act 2024, a $3 million turnover exemption is still active but there are still other criteria in place that does not exempt several small businesses. Business with an annual turnover of $3 million or less are formally exempt from standard APP legislation however specific industry criteria applies.
Any business handling anti-money laundering data loses exemption. Businesses specialised within the health service provided and holding commonwealth contracts sit outside of the small business exemption. Although exemptions are in place for small business this does not mean future legislation won’t come into play with the Australian government agreeing to remove exemptions entirely within upcoming privacy rollouts, however the turnover threshold abolishment has not yet been confirmed.
Myth 4: “As long a human review and/or signs off on our decisions, we are exempt”
Not quite. The OAIC’s own Automated Decision-Making Transparency Issues Paper says the obligation applies where a computer program “recommends a decision to a human decision maker or guides a human decision maker”. Not only where the computer makes the final call.
Currently, ABT already helps our clients’ trace which systems feed recommendations into human decisions, what personal information those systems use, and how much weight the output carries. From there we tighten the controls around that data through our security and compliance plans, including Priva Privacy Risk Management and ongoing governance.
Human oversight is good practice. It is not an exemption!
Myth 5: “If we are not ready by December 10th, nothing really happens to us straight away”
ABT is client ready. We are helping clients map systems making or shaping decisions about people, tighten the controls around the data behind them, and draft the disclosures so they’re live before the deadline.
Although no penalty fires on the date itself, exposure builds quietly instead with the longer your business waits to comply the more severe penalties could be. Business can face:
-
- Complaints. Someone challenges a decision about them. You can’t explain how it was reached. That’s when the regulator arrives.
-
- Sweeps. The OAIC is reviewing privacy policies proactively through 2026. An incomplete disclosure can get flagged without anyone complaining.
-
- Procurement. Enterprise and government buyers already ask for automated decision-making documentation at tender stage. No documentation, no shortlist. You lose the work and never hear why.
10 December is close. Let’s talk now, not in November.
Still Have Questions?
Every business uses automated tools differently, and working out what falls inside scope is rarely straightforward. If you would like clarity on where your obligations sit before 10 December 2026, our team is happy to help.
Contact us to discuss your requirements further.
Read more about making privacy a priority in your business.
This article provides general information only and should not be considered legal advice. Organisations should obtain advice appropriate to their circumstances and monitor guidance from the Office of the Australian Information Commissioner.
