Why this matters for your practice
From 10 December 2026, a health practice whose privacy policy omits the automated decision-making information APP 1.7 requires is exposed to a civil penalty under section 13K of the Privacy Act: up to 200 penalty units, or 1,000 for a body corporate. At $364 a unit that is a maximum of $72,800 or $364,000, figures we have calculated, not published by the OAIC. Every health practice is caught whatever its turnover, because under s 6D(4)(b) an entity that provides a health service and holds health information is not a small business operator. A system installed years ago does not escape either: item 89 of the amending Act applies the duty to decisions made after 10 December 2026 whenever the arrangement was made and whenever the personal information was collected. What to write, and by when, is in the 10 December 2026 ADM deadline for practices; this page is the definition itself.
What is automated decision-making under the Privacy Act?
Automated decision-making, for the purposes of APP 1.7, is an arrangement where an entity "has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision", where that decision "could reasonably be expected to significantly affect the rights or interests of an individual", and where "personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision." All three limbs, (a) to (c), must be met, since the subclause joins them with "and". APP 1.7 sits in Schedule 1 to the Privacy Act 1988, inserted by item 88 of Schedule 1, Part 15 of the Privacy and Other Legislation Amendment Act 2024, under the Act's own heading "Automated decisions". "Computer program" is read widely: the OAIC's ADM Issues Paper says generative AI tools, including chatbots, "all fall within the definition of computer program for the purpose of the ADM obligation", as does commonly used software, including word-processing tools.
What does "substantially and directly related" mean?
A computer program does not have to make the final call. Paragraph 337 of the Explanatory Memorandum, quoted in the OAIC's ADM Issues Paper, explains that the phrase "reflects that a computer program may be used to recommend a decision to a human decision-maker, or guide a human decision-maker", where "substantially means where it is a key factor in facilitating the human's decision making" and "directly means where the thing has a direct connection with making the decision."
The OAIC's own example shows how low the bar sits: "if a pre-programmed formula in Microsoft Excel was used to score and triage people calling a domestic violence crisis hotline, which was a key factor in a human decision-maker making a decision of what order to attend a person's call, this would be considered 'directly related' and 'substantially related' to making a decision." By contrast, a formula used "to only arrive at an age in years from a date of birth" may be directly related but would not be substantially related, because it is not a key factor in making the decision.
The practical consequence: a human reviewing or signing off on the program's output does not by itself take the system outside the definition. The question is whether the output is a key factor with a direct connection to the decision, not whether a human touched it last.
Which decisions "significantly affect" a patient?
APP 1.9 spells out the scope: "making a decision includes refusing or failing to make a decision", "doing a thing includes refusing or failing to do a thing", and "a decision may affect the rights or interests of an individual, whether the rights or interests of the individual are adversely or beneficially affected." It then gives three examples: "(i) a decision made under a provision of an Act or a legislative instrument to grant, or to refuse to grant, a benefit to the individual; (ii) a decision that affects the individual's rights under a contract, agreement or arrangement; (iii) a decision that affects the individual's access to a significant service or support." The OAIC's APP Guidelines put that third example in patient terms: "such as access to healthcare services." A practice system that decides who gets an appointment first, or at all, sits squarely in territory the OAIC has flagged.
The table below is our reading of the statutory text, not OAIC guidance. The OAIC had not published its ADM guidance at 24 September 2026, and the line for "significantly affect" has not yet been drawn.
| System | What it does | Limb that could catch it | Status |
|---|---|---|---|
| Online booking or triage logic | Sorts urgency or decides who is offered an appointment | 1.9(d)(iii), access to a significant service or support | Likely candidate, OAIC guidance pending |
| AI phone receptionist | Routes or prioritises callers | 1.9(d)(iii) | Likely candidate, guidance pending |
| Recall or risk ranking | Decides which patients are contacted first | 1.9(d)(iii) | Candidate, guidance pending |
| MBS item suggestion tool | Proposes items the practice bills | Unclear | Not addressed by the OAIC |
| AI scribe that proposes a diagnosis or treatment | Suggests something the clinician adopts | 1.7(a), "a thing that is substantially and directly related" | Candidate, guidance pending |
| AI scribe that only transcribes and summarises | Records what was said | None obvious | Less likely: makes no decision |
What must the privacy policy say?
APP 1.8 sets out the required content: "the kinds of personal information used in the operation of such computer programs", "the kinds of such decisions made solely by the operation of such computer programs", and "the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs."
In plain English, three things: the kinds of personal information the programs use, the kinds of decisions made solely by the program, and the kinds of decisions where a program does something substantially and directly related to making them, such as recommending or guiding a human decision-maker. "Kinds of" is the statutory unit: the subclause asks for categories, not a list of every system. How much detail "kinds of" requires is one of the questions the OAIC's pending guidance is expected to answer; at 24 September 2026 it had not. Example wording and the drafting walkthrough are in the ADM deadline post and our privacy policy template.
What the regulator or assessor expects
The OAIC opened consultation on 18 May 2026 on an Issues Paper for its "Guidance for Transparency in Automated Decision Making", closing submissions on 15 June 2026. The consultation page states: "From 10 December 2026, APP entities that use personal information in ADM with the potential to affect rights or interests will be required to provide information in their privacy policies about the kinds of personal information used and the kinds of decisions made using ADM." Its APP Guidelines hold the line that detailed guidance is coming "in 2026", and Commissioner Elizabeth Tydd told the Law Council of Australia on 15 September 2026: "We are on the verge of releasing our guidance for the ADM transparency obligation, having carried out consultation earlier this year." At 24 September 2026 nothing had been published.
The enforcement hook is real. Item 87 inserts "Australian Privacy Principle 1.7 (contents of APP privacy policy, automated decisions)" into s 13K(1)(b), a civil penalty provision carrying infringement or compliance notices. The maximum under s 13K(4) is 200 penalty units, or 1,000 for a body corporate under the Regulatory Powers (Standard Provisions) Act 2014 s 82(5) (five times the base amount). At $364 a unit that is $72,800 and $364,000, both figures calculated by us, not published by the OAIC.
Separately, RACGP 6th edition criterion F11 is an accreditation obligation, not a Privacy Act one: it applies only where a practice uses AI, and is not yet being assessed because accreditation still runs on the 5th edition. This all sits within the broader healthcare privacy compliance pillar.
Common mistakes
Assuming a human sign-off takes the system out. Paragraph 337 of the Explanatory Memorandum is explicit that programs used "to recommend a decision to a human decision-maker, or guide a human decision-maker" are captured where the thing is substantially and directly related to making the decision. The test is whether the output is a key factor with a direct connection, not whether a person clicked approve.
Waiting for tranche 2. The duty is in the Privacy and Other Legislation Amendment Act 2024, already law, and it starts on 10 December 2026. The Privacy Amendment (Personal Data Protection) Bill 2026 exposure draft, on which the Attorney-General's Department consulted from 31 August to 18 September 2026, is a separate consultation draft and is not law. Nothing about it changes your APP 1.7 deadline.
Treating it as the AI acceptable use policy. An AI acceptable use policy is an internal staff rulebook about which AI tools staff may use and how. APP 1.7 is content that must appear in the practice's public privacy policy. Two different documents, two different audiences, and only one carries a penalty.
Assuming an old system is exempt. Item 89 applies the duty to decisions made after 10 December 2026 whether the arrangement for the program was made before or after that date, and whether the personal information was acquired before or after it. A spreadsheet built in 2019 still counts if it meets the three limbs.
Frequently asked questions
When does the automated decision-making disclosure start?
10 December 2026. Section 2 of the 2024 Act, table item 7, brings Schedule 1, Part 15 into force the day after 24 months from Royal Assent, given on 10 December 2024. The duty applies to decisions made from that date, whenever the system was set up.
Does it apply to a small medical practice?
Yes. Under Privacy Act s 6D(4)(b), an entity that provides a health service to another individual and holds any health information, except in an employee record, is not a small business operator. The small business exemption never reaches a health practice that holds patient records, so the Australian Privacy Principles, including APP 1.7, apply regardless of turnover.
Does an AI scribe count as automated decision-making?
No, not if it only transcribes and summarises what was said, because it makes no decision. A scribe that proposes a diagnosis, test or treatment the clinician then adopts may count, as "a thing that is substantially and directly related to making" a clinical decision. That is our reading; the OAIC has not addressed scribes specifically, and its guidance is pending. See our AI scribe glossary entry.
Do I have to tell patients about every algorithm?
No. APP 1.8 asks for "the kinds of personal information used" and "the kinds of such decisions", not a list of every system. The duty only arises where all three limbs of APP 1.7 are met: a program making or substantially helping make a decision, that could significantly affect rights or interests, using personal information.
What must the privacy policy actually say?
Three things, from APP 1.8: the kinds of personal information used in the operation of the computer programs, the kinds of decisions made solely by those programs, and the kinds of decisions for which a program does something substantially and directly related to making the decision.
What is the penalty for not disclosing?
A civil penalty under s 13K: a maximum of 200 penalty units, or 1,000 for a body corporate. At $364 a unit that is $72,800 and $364,000, figures we have calculated. Infringement or compliance notices are also available under s 13K.
Has the OAIC published guidance on automated decision-making?
No, not at 24 September 2026. The OAIC released its issues paper in May 2026, closed submissions on 15 June 2026, and Commissioner Tydd said on 15 September 2026 that guidance was "on the verge" of release.
Related terms
Go deeper
Last reviewed