From 10 December 2026, Australian Privacy Principle 1.7 requires an APP entity to disclose its use of automated decision-making in its privacy policy. The obligation applies where three conditions are met: the entity has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision; the decision could reasonably be expected to significantly affect an individual's rights or interests; and the individual's personal information is used in the operation of the program. The obligation was inserted by the Privacy and Other Legislation Amendment Act 2024. The disclosure is a few lines in a privacy policy. The evidence behind it is not.
01 · What it requires
Australian Privacy Principle 1.7 is a disclosure obligation, not a design standard. It does not restrict which automated decisions a company can make. It requires an APP entity to disclose its use of automated decision-making where three conditions are met: the entity has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision; the decision could reasonably be expected to significantly affect an individual's rights or interests; and personal information about the individual is used in the operation of the computer program.
APP 1.7 commences alongside APPs 1.8 and 1.9. APP 1.7 is the trigger; APP 1.8 sets out what the privacy policy must contain, including the kinds of personal information used and the kinds of decisions made. The Office of the Australian Information Commissioner administers the obligation and publishes the primary guidance at the OAIC's APP 1 guidelines.
| Condition | What it means in practice |
|---|---|
| The entity has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision | Covers fully automated decisions and computer programs whose output feeds directly into a decision. The boundary of "substantially and directly related" is a focus of the OAIC's current consultation. |
| The decision could reasonably be expected to significantly affect an individual's rights or interests | Directed at decisions with real consequence for the individual, such as credit, insurance, employment or access to services, rather than trivial or internal operations. |
| Personal information about the individual is used in the operation of the computer program | The privacy limb. If no personal information is used in the program's operation, APP 1.7 is not triggered. |
02 · When it commences
APP 1.7 commences 10 December 2026. As at publication of this page, the obligation has not yet commenced. It applies to qualifying automated decisions made from that date, not retrospectively.
On 18 May 2026, the OAIC released an Issues Paper seeking submissions on how it should interpret the obligation. Submissions closed 15 June 2026. The OAIC intends to publish its detailed guidance by September 2026, ahead of the December commencement. This page will be updated once that guidance lands.
03 · The evidence layer
The disclosure names the automated decisions. It does not, by itself, prove which systems are making them, who is accountable for them, or what oversight exists. That is a separate body of evidence, and it is the evidence a regulator or a customer's lawyer will ask for if the disclosure is challenged.
An AI Accountability Audit produces that evidence independently of the company being audited. It examines what automated systems are in production, who is accountable for them, and what governance and oversight applies, then issues the result as a signed Statement a company can hold on file before it is asked to produce it.
This is not legal advice on whether a specific decision falls within APP 1.7's scope. That determination stays with the company's counsel. The audit produces the evidentiary record; it does not interpret the statute.
| The disclosure | The evidence behind it | |
|---|---|---|
| What it is | A few lines in the privacy policy naming qualifying automated decision-making | The record of which systems make decisions, who is accountable, and what oversight applies |
| Who produces it | The company, usually with counsel | Independently produced and issued, or assembled internally |
| When it is needed | By 10 December 2026 | Before anyone asks the disclosure to be proven |
| Where it lives | The public privacy policy | On file, held against the day it is requested |
04 · Where a Statement sits
A Statement issued for a company covers automated decision-making as one line of evidence within the six dimensions the audit measures, not as a standalone compliance product. Companies preparing for APP 1.7 typically hold this evidence alongside their existing privacy policy disclosure, so the disclosure and the evidence behind it are both on file.
The full methodology is published at kn0w.co/methodology. A sample of the issued Statement is available at kn0w.co/sample-statement.
05 · Frequently asked questions
Not until 10 December 2026. Before that date there is no APP 1.7 obligation to disclose against, though the Act inserting it was already passed in 2024.
Yes. The obligation applies to qualifying decisions made from 10 December 2026, regardless of whether the arrangement for the computer program was made before or after that date. Legacy systems are in scope if they make qualifying decisions after commencement.
APP 1.7 itself requires disclosure only. It does not mandate an audit. An independent audit is one way a company produces evidence that its disclosure is accurate and complete. A first read of where a company stands is available at the AI Accountability Gap.
That is a legal determination and sits with the company's own counsel. This page describes the obligation and the evidence layer around it; it does not provide legal advice on scope.
The primary sources are the OAIC's APP 1 guidelines and the OAIC's Automated Decision-Making Issues Paper.
Published 24 August 2026. Verified against OAIC primary sources on 24 August 2026.