What changes for Australian businesses on 10 December 2026?

Privacy Act amendments commence requiring APP entities to disclose in their privacy policies automated decision-making that uses personal information in decisions significantly affecting individuals, including the kinds of information and decisions involved. AI-enabled and rule-based systems are both captured.

Does Australia have a dedicated AI law?

No. The National AI Plan (December 2025) confirmed reliance on existing technology-neutral law, supported by the Guidance for AI Adoption. Existing privacy, consumer and sector obligations already apply to AI use.

Is an AI policy legally required in Australia?

Not as a standalone obligation, but existing obligations, privacy, confidentiality, consumer protection, professional duties, apply to AI use, and the December 2026 disclosure obligations require specific privacy policy content where automated decision-making is in scope. A written policy is how organisations evidence meeting duties that already exist. Specific applications warrant legal advice.

How long does building the paper trail take?

For a mid-sized business, the five documents are typically drafted inside two weeks, with the tool inventory the longest item. Keeping them current afterwards is a quarterly review, not a project.

Steal our ideas

The AI Governance Paper Trail Australian Businesses Now Need

Australian AI governance has quietly become a documentation question. Regulators, insurers, enterprise clients and courts all ask the same thing in different words: show us what you decided, when, and who was responsible. A business with five short documents can answer in an afternoon. A business with none is reconstructing its own conduct from memory, in the worst possible week.

There is now also a date attached. From 10 December 2026, amendments to the Privacy Act require APP entities to disclose, in their privacy policy, automated decision-making that uses personal information to make decisions significantly affecting individuals.

The AI governance paper trail (n.): the small set of written artefacts that evidence an organisation governs its AI use: a usage policy, a data boundary list, an owner's charter, a tool register with due-diligence records, and an incident path. Five documents, none longer than two pages, kept current.

The five documents

The usage policy. One page, plain language: what is fine, what is never fine, what needs a check first. Written for the people doing the work.
The data boundary list. Data classes mapped to sanctioned and prohibited destinations. This is the document that prevents the most common incident, confidential data entering a consumer-tier tool.
The owner's charter. One named individual, what they are accountable for, and the cadence they run. Governance without a named owner decays in a quarter.
The tool register. Every sanctioned tool, its tier, and the completed due-diligence record for each. This is what an insurer or enterprise client asks for first.
The incident path. Who is told, within what time, who decides on notification, who speaks. Rehearsed once, so the first real incident is not the first rehearsal.

The December 2026 clock

The Privacy Act amendments commencing 10 December 2026 add transparency obligations for automated decision-making: privacy policies must disclose when computer programs, including AI-enabled systems, use personal information in decisions that significantly affect individuals, what kinds of information are involved, and what kinds of decisions are made. The obligation is technology-neutral and captures rule-based tools as well as AI.

Whether a specific process is caught is a legal question on the facts of that process, and businesses should take advice on their own systems. The operational preparation, though, is the same in every case: an inventory of automated and AI-assisted processes touching personal information, an assessment of which ones significantly affect individuals, and privacy policy updates before the commencement date. The inventory is the part that takes time, which is why the clock matters now rather than in November.

Australia's broader settings reinforce the direction: the government's Guidance for AI Adoption (October 2025) sets out six practices for responsible use, and the National AI Plan (December 2025) confirmed reliance on existing technology-neutral law rather than a standalone AI act. Translation: existing obligations already apply to AI use, and the paper trail is how you evidence meeting them.

Why the paper trail pays for itself commercially

The same five documents that satisfy a regulator are what unlock enterprise sales. Security reviews at large clients increasingly include AI questions, and the supplier who answers with documents closes weeks faster than the supplier who answers with meetings. Cyber insurers are moving the same way. Governance built once is sold many times.

Questions people actually ask

What changes for Australian businesses on 10 December 2026?: Privacy Act amendments commence requiring APP entities to disclose in their privacy policies automated decision-making that uses personal information in decisions significantly affecting individuals, including the kinds of information and decisions involved. AI-enabled and rule-based systems are both captured.
Does Australia have a dedicated AI law?: No. The National AI Plan (December 2025) confirmed reliance on existing technology-neutral law, supported by the Guidance for AI Adoption. Existing privacy, consumer and sector obligations already apply to AI use.
What documents evidence AI governance?: Five short artefacts: a usage policy, a data boundary list, a named owner's charter, a tool register with due-diligence records, and an incident path. Together they answer regulators, insurers and enterprise security reviews.
Is an AI policy legally required in Australia?: Not as a standalone obligation, but existing obligations, privacy, confidentiality, consumer protection, professional duties, apply to AI use, and the December 2026 disclosure obligations require specific privacy policy content where automated decision-making is in scope. A written policy is how organisations evidence meeting duties that already exist. Specific applications warrant legal advice.
How long does building the paper trail take?: For a mid-sized business, the five documents are typically drafted inside two weeks, with the tool inventory the longest item. Keeping them current afterwards is a quarterly review, not a project.

Keep reading