The 10 December 2026 privacy deadline for firms using AI decision support

The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. Most of its amendments commenced immediately, and the statutory tort for serious invasions of privacy commenced on 10 June 2025.

The automated decision-making transparency provisions — new APP 1.7 to 1.9 — were given a two-year lead time and commence on 10 December 2026.

The obligation is a privacy policy disclosure. Where an entity uses a computer program to make, or to do something substantially and directly related to making, a relevant decision, the privacy policy must set out:

The provisions apply to decisions that could reasonably be expected to significantly affect the rights or interests of an individual. The effect must be more than trivial, and the provisions capture beneficial effects as well as adverse ones.

Whether an AI-assisted tax strategy recommendation crosses that threshold is genuinely unsettled. It is arguable in both directions, and the boundaries have not been tested. The OAIC has signalled a broad reading, and its guidance is expected around September 2026 — which is the point at which firms will be able to assess their position with more confidence.

We are not going to tell you where your firm lands on that question. What we can say is that it is a question worth asking before December rather than after.

The most common misreading is that having a human make the final call takes a system outside the rules. It does not, necessarily.

The second limb captures programs that do something substantially and directly related to making the decision. As Allens has noted in its analysis, a program that recommends a decision or guides a human decision-maker can still meet that description where the recommendation is a key factor in the outcome.

For a tax practice, that is precisely the shape of most AI use: the tool surfaces or recommends, the practitioner decides. The existence of professional review does not, on its own, resolve the question.

It is worth being clear about the limits, because some commentary imports concepts from European law that do not apply here.

This is a transparency measure. It does not create a right for an individual to contest an automated decision, and it does not require notifying individuals when such a decision is made about them. It requires the privacy policy to describe the practice. That is a materially lighter obligation than Article 22 of the GDPR, and content that equates the two overstates it.

Firms often ask what Australian AI law requires of them. The accurate answer for a private practice is that there is no AI-specific statute.

After the September 2024 proposals paper on mandatory guardrails for high-risk AI and more than 300 submissions, the Government declined to proceed at that time and released a National AI Plan in December 2025. The approach relies on existing technology-neutral law — the Privacy Act, Australian Consumer Law, the Copyright Act and sectoral regulation — with gap analysis to identify deficiencies. The Voluntary AI Safety Standard's guardrails were consolidated by the National AI Centre into six essential practices.

Mandatory AI requirements that took effect on 15 June 2026 apply to Commonwealth agencies, not to private firms. This is a frequent source of confusion in circulating content.

So for an Australian accounting practice, the binding obligations when using AI are the TPB's Code as explained in TPB(GS) 55/2026, and the Privacy Act — including this new APP 1 disclosure from 10 December 2026.

The OAIC's notifiable data breaches figures for the 2025 calendar year, released on 6 July 2026, recorded 1,205 notifications — the highest in a year since the scheme commenced in 2018, and 8% above 2024. Malicious or criminal attacks accounted for 716, or 59%.

Legal, accounting and management services appeared among the top six sectors by notifications, at 81. Whatever a firm concludes about the automated decision-making provisions, the underlying data handling question is not hypothetical.

A practical sequence:

This is a disclosure obligation with a fixed date and an unsettled boundary. The sensible response is to do the inventory now, form a documented view, and revisit it when the OAIC guidance lands — rather than to assume either that professional review exempts you or that the rules obviously bite.

This article is general information for registered practitioners and is not legal advice. Firms should obtain their own advice on the application of the Privacy Act to their circumstances.