OAIC seeking input on incoming automated decision-making obligation

The Office of the Australian Information Commissioner (OAIC) has announced it is seeking information and views to inform the development of guidance on the automated decision-making (ADM) transparency obligation coming into effect later this year.

The ADM obligation, which commences on 10 December 2026, introduces requirements that companies must include information in privacy policies about the kinds of personal information used in, and types of decisions made by, computer programs that use personal information to make decisions that could reasonably be expected to significantly affect the rights or interests of an individual.

The types of ADM that require disclosure in privacy policies are those that meet the following criteria:

1. the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; and
2. the decision could reasonably be expected to significantly affect the rights or interests of an individual; and
3. personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.

As such, the OAIC stated it wants feedback from industry around the meaning of wording in the obligation - specifically, 'computer program', 'substantially and directly related to making a
decision', 'significantly affect rights or interests of an individual', 'making a decision' and 'arranged for'.

The OAIC said that a wide range of technologies are likely to fall within the definition of 'computer program', including commonly-used software, apps, or word-processing tools. Generative AI tools used to generate text, images, videos, code or synthesis, including chatbots, also fall within the definition of computer program for the purpose of the ADM obligation.

With the usage of 'arranged for', the OAIC stated that companies must consider whether they arranged for ADM or simply operate ADM.

"The OAIC is also seeking feedback on the extent of disclosure required around ADM tools to ensure compliance, stating disclosure "will require a balance between providing enough meaningful information for individuals to understand the use of ADM and avoiding excessive detail that obscures the purpose of transparency and clear communication".

The OAIC’s research has found that 89% of Australians believe they should have the right to know when their personal information is used in ADM if it could affect them and 86% believe government should publicly report on any technology used to inform decision making.

"As Australian businesses and government agencies increase their adoption of AI, the ADM obligation will provide an important protection for the Australian community, which will
be better equipped to know and understand how their lives are impacted by AI and ADM," the OAIC said.

"The ADM obligation will improve integrity, accountability and trust at a moment of widespread technological change in the Australian economy and society. Businesses will be better able to build the trust and confidence of consumers and customers with greater openness and transparency, while in the public sector trust in government service delivery will be enhanced."

The OAIC intends to release its guidance by September 2026, prior to the commencement date for this new ADM obligation.

The closing date for submissions is 15 June 2026.