Five questions to ask before the 10th of December
On 10 December 2026, changes to Australia’s Privacy Act take effect that may require many organisations to update their privacy policies to disclose when automated decision-making is being used.
While AI regulation is increasingly on the agenda for governments, regulators and boards, not every new obligation will arrive through legislation labelled “AI”. One of the first practical changes Australian organisations will face comes through existing privacy legislation.
From 10 December 2026, organisations covered by the Privacy Act may need to update their privacy policies where a computer program uses personal information to make, or play a substantial and direct role in making, a decision that could significantly affect an individual’s rights or interests.
This is not limited to generative AI. It may include rules-based automation, predictive models and decision support capabilities embedded within recruitment, customer service, workforce management, finance and other enterprise systems. The change is about transparency rather than restricting the use of AI, but its impact may be broader than many organisations realise.
The difficult part is unlikely to be updating the privacy policy itself. The real challenge is identifying where these automated decisions are already taking place across your technology environment, particularly where new capabilities have been introduced through vendor updates, configuration changes or features enabled by default.
Before 10 December, or before your next vendor renewal or system review, ask these five questions:
Before your next vendor renewal or system review, ask:
1. Where does this product use personal information to make or substantially support decisions about individuals?
2. Which decisions are made automatically, and which recommendations become key inputs into a human decision?
3. What personal, sensitive or inferred information is used to generate those outcomes?
4. Can we identify what the system recommended, whether it was overridden and who made the final decision?
5. What automation or AI capabilities are planned for the next 12 months, and could any be enabled by default?
That final question matters. A capability introduced through a routine product release could create a new privacy disclosure requirement without passing through a conventional procurement, project approval or governance process.
The lesson extends beyond the December deadline: organisations need visibility not only over the AI tools they deliberately purchase, but also over the automated decision-making capabilities already embedded within their existing systems.
About the Author
Roger Molina
Roger Molina has more than 13 years of experience in enterprise system strategy, business process improvement and change management. His career spans change management, business analysis and leadership of SMC’s Strategy & Roadmap practice, with more than 400 projects delivered across mining, utilities, oil and gas, logistics, manufacturing and healthcare. He now serves as Director of AI & Innovations at SMC, helping organisations apply AI, automation and emerging technologies to improve the way they work. Roger’s research into leadership, motivation, structure and data quality has been published in the Reliability Engineering Journal.
Platforms series.
Get more insights from Solution Minds Consulting in Google Search.