Privacy Act automated decision rules from 10 December 2026: what Australian law firms using AI need to disclose

By The LexUnits Team · October 2026 · 10 min read

The Privacy Act's automated decision-making (ADM) transparency rule is a privacy policy obligation, set out in Australian Privacy Principles (APPs) 1.7 to 1.9. From 10 December 2026, it requires organisations covered by the Act to disclose when a computer program uses personal information to make, or substantially shape, a decision that could significantly affect an individual.

For law firms, the question is no longer whether lawyers use AI. In LexisNexis's 2025–26 Australian legal AI survey of more than 1,000 legal professionals, 69% said they use generative AI for legal work or plan to. The question is which of those tools now need a line in the firm's privacy policy.

The short answer

• The rule applies only to APP entities. Many sole practices are exempt under the small business exemption (annual turnover of $3 million or less), subject to exceptions.
• The obligation sits with the firm that uses the tool, not with the software vendor.
• A lawyer reviewing the output does not, on its own, take a tool out of scope.
• The disclosure covers kinds of personal information and kinds of decisions, in plain language. No technical detail is required.

What the new rule requires

Under APP 1.7, the new requirements apply when three things are true:

1. the entity has arranged for a computer program to make a decision, or to do something substantially and directly related to making a decision;
2. the decision could reasonably be expected to significantly affect the rights or interests of an individual; and
3. personal information about that individual is used in the operation of the program.

When all three are met, APP 1.8 requires the privacy policy to set out:

• the kinds of personal information used in the operation of those programs;
• the kinds of decisions made solely by the operation of a computer program; and
• the kinds of decisions where a program does something substantially and directly related to making the decision.

APP 1.9 gives examples of decisions that can significantly affect someone:

• a decision to grant or refuse a benefit under a law;
• a decision that affects their rights under a contract, agreement or arrangement; and
• a decision that affects their access to a significant service or support.

The Privacy and Other Legislation Amendment Act 2024 introduced these requirements. They commence on 10 December 2026, two years after the Act received Royal Assent (JWS).

How the OAIC reads it

At the end of September 2026, the Office of the Australian Information Commissioner (OAIC) published a fact sheet and flow chart and updated its APP Guidelines. Law firms have published commentary on the guidance, including Allens and Squire Patton Boggs. Four points from it matter for law practices:

• "Computer program" is broad. It covers pre-programmed rule-based processes, machine learning and generative AI tools, including chatbots.
• "Arranged for" includes third-party tools. Buying, configuring, integrating or relying on a vendor's software all count. As Allens puts it, the onus is on the user of the personal information, not on vendors in the technology supply chain.
• Human review is not a safe harbour. If a program's output is a key factor with a direct connection to the decision, it is generally captured, even where a person signs off. This applies whether the output is advisory or determinative. The relevant factors include:
  • how much staff rely on the output;
  • how often they override it; and
  • how the output is explained and built into the workflow.
• Plain language over technical detail. The OAIC does not expect algorithms to be explained. It expects categories that an ordinary person can understand, and it expects separate processes to be identified separately.

Does it apply to your firm?

Only APP entities must comply. Most businesses with an annual turnover of $3 million or less are "small business operators" and are exempt from most of the Privacy Act. The exemption does not apply if an exception does, for example:

• the business trades in personal information; or
• it is related to a larger body corporate that is covered by the Act (Warlows Legal).

Small businesses can also choose to opt in.

This matters for the profession because most law practices are small. The 2022 National Profile of Solicitors counted 16,514 private law practices in Australia. 84% of them were sole practices or had a single principal. Many of these will be exempt. Mid-sized and larger firms generally will not be.

Two cautions:

• The exemption turns on turnover, not headcount. A five-lawyer commercial firm can exceed $3 million.
• The exemption may not last. In 2023 the Government agreed in principle to remove the small business exemption. The exposure draft of the next privacy bill, released in September 2026, does not address it, but removal has not been ruled out.

Even exempt firms may decide that telling clients how they use AI is good practice.

Where AI shows up in a law practice

The test is applied tool by tool. The table below is a starting map, not a conclusion. Your answer depends on how each tool is configured and how much your staff rely on it.

Billing tools need a closer look. The decision about what to charge a client belongs to the firm. But under the OAIC's approach, a program that drafts the time entries a lawyer then relies on may be doing something "substantially and directly related" to that decision, even with review. Disclosure costs little and the analysis is finely balanced, so many firms will choose to disclose.

What to put in your privacy policy

The OAIC's guidance is not prescriptive, but the content must cover the three APP 1.8 items. The wording below is a template to adapt. Check every statement against how your firm actually uses each tool.

Automated decisions

We use software, including artificial intelligence tools, to help us run our practice. Some of these tools use personal information to produce outputs that our staff rely on when making decisions that may affect you.

• Time recording and billing. Software analyses records of work on your matter to prepare draft time entries. These records can include emails, documents, file notes and meeting recordings or transcripts. The personal information used can include your name and contact details, details of your matter, and the content of communications and documents. A lawyer reviews each draft entry before any fee is charged. The software does not issue invoices or decide what you are charged.
• [Client intake / other tool]. [Describe the kinds of personal information used and the kind of decision the tool supports.]

[We do not make decisions that significantly affect you solely by the operation of a computer program.]

If you have questions about how we use automated tools, contact [privacy contact].

Delete or amend the bracketed sentence if any decision is fully automated.

While you are updating the policy, check two existing requirements:

• Overseas disclosure. Under APP 1.4, your policy must already say whether you are likely to disclose personal information to overseas recipients and, if practicable, in which countries. Many AI services process data offshore.
• Currency. APP 1.3 requires the policy to be up to date, so an out-of-date policy is a compliance issue in itself.

Questions to ask your AI vendors

The obligation is yours, so you need the information from your suppliers. Ask each one, in writing:

1. What personal information does the tool process, and in which countries?
2. Does the tool make any decision itself, or does it only produce drafts or recommendations for our staff?
3. Is our data used to train or improve the vendor's models, or those of any sub-processor?
4. How long is our data retained, and can we delete it?
5. Can you give us a short, plain-language description of how the tool uses personal information, which we can adapt for our privacy policy?

A vendor that cannot answer these clearly is itself a risk signal.

Penalties and enforcement

The 2024 amendments gave the OAIC faster enforcement tools. It can now issue infringement notices, without going to court, for privacy policies that are out of date or missing required information (APPs 1.3 and 1.4) (Corrs, JWS):

• Infringement notice, most companies: 60 penalty units, about $19,800 at the 2024 penalty unit value.
• Infringement notice, listed companies: 200 penalty units, about $66,000.
• Court-imposed penalty for these provisions: up to $330,000 per contravention.
• Interferences with privacy that are not "serious": civil penalties of up to $3.3 million for a body corporate.

Privacy disclosure is not your only obligation

A compliant privacy policy does not change a lawyer's professional duties. In the Uniform Law jurisdictions (NSW, Victoria and Western Australia), section 172 of the Legal Profession Uniform Law requires a law practice to charge no more than fair and reasonable legal costs (LSJ). Comparable rules apply elsewhere.

If an AI tool drafts a time entry, the practice remains responsible for that entry being accurate and reasonable. The profession's own concerns point the same way: in the same LexisNexis survey, 39% of respondents named inaccurate or fabricated outputs as their biggest concern with AI. Reviewing AI output is a professional obligation, whether or not it changes the privacy analysis.

A checklist before 10 December 2026

1. Confirm whether your firm is an APP entity: check turnover, related entities and any opt-in.
2. List every tool that uses the personal information of clients or enquirers, including intake, billing, transcription, document automation, debt recovery and marketing tools.
3. Apply the three APP 1.7 conditions to each tool and record your reasoning.
4. Get written answers from your vendors to the questions above.
5. Update the privacy policy with the APP 1.8 information in plain language, and check the overseas disclosure section.
6. Document how staff review AI outputs, including when and why they override them.

Frequently asked questions

Does the 10 December 2026 automated decision rule apply to small law firms?

Only if the firm is an APP entity. Firms with an annual turnover of $3 million or less are generally exempt as small business operators, unless an exception applies or they have opted in. Check turnover across any related entities.

If a lawyer reviews every AI-drafted time entry, do we still need to disclose the tool?

Possibly. The OAIC's view is that human review does not automatically take a program out of scope. If the output is a key factor with a direct connection to the decision, the program can still be caught. For billing tools the position is arguable, so many firms will disclose.

Is the software vendor responsible for the disclosure?

No. The obligation sits with the entity that arranges for the program to be used, which is the law firm. Vendors should give you the information you need, and your contract should make clear who makes decisions.

Do we have to name the AI provider in our privacy policy?

APP 1.8 requires the kinds of personal information and the kinds of decisions, not vendor names. Separately, APP 1.4 requires you to say whether you are likely to disclose personal information to overseas recipients and, where practicable, in which countries.

What happens if our privacy policy doesn't mention automated decisions after 10 December 2026?

An incomplete or out-of-date privacy policy can now attract an OAIC infringement notice without court proceedings. It can also cause reputational harm with clients who read it.

This article is general information about the Privacy Act 1988 (Cth) as at October 2026, not legal advice. Check how each tool is used in your firm, and seek advice on your specific circumstances.

Last verified: October 2026

Sources

• OAIC: New resources on transparency for use of AI and automated decision-making
• OAIC: APP 1.7–1.9 Transparency Obligation Fact Sheet
• Allens: Mandatory automated decision-making disclosure requirements are coming
• Squire Patton Boggs: OAIC automated decision-making guidance
• JWS: Changes to Australian privacy laws now in force
• Corrs Chambers Westgarth: Changes to Australia's Privacy Act bolster enforcement and investigative powers
• Warlows Legal: Is your start-up ready for Privacy Act amendments?
• Herbert Smith Freehills Kramer: The draft Tranche 2 Privacy Act reforms
• LexisNexis: 2025–26 Australian Legal AI Survey Report
• Law Society of NSW: 2022 National Profile of Solicitors (media release)
• Law Society Journal: What should I put in a costs agreement?