From 10 December 2026 Employers Must Disclose AI and Automated Decisions in Hiring, Rostering and Pay: APP 1.7 Explained

The Privacy and Other Legislation Amendment Act 2024 added three sub-principles to Australian Privacy Principle 1. From 10 December 2026, an organisation covered by the Privacy Act must say in its privacy policy where it has arranged for a computer program to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect the rights or interests of an individual, using that individual's personal information (APP 1.7). The policy must then describe the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds of decisions the program substantially contributes to (APP 1.8). APP 1.9 says a "decision" includes refusing or failing to decide, and that a decision counts whether it helps or harms the person.

On 30 September 2026 the Office of the Australian Information Commissioner published its final guidance: updated APP 1 Guidelines, a fact sheet and a flowchart. That leaves about ten weeks. Our July overview of workplace AI rules flagged the date; this article is about what the final guidance says it means for HR.

Broadly. The fact sheet says a computer program includes pre-programmed rule-based processes, artificial intelligence and machine learning, software, apps or word-processing tools, and generative AI including chatbots. Its first worked example is a spreadsheet formula that ranks people for service. An organisation has "arranged for" a program where it builds one, procures a third-party product, configures off-the-shelf software, authorises a program to decide, or relies on its advisory output.

The human-in-the-loop defence is narrow. A program is "substantially and directly related" to a decision where its output is a key factor in the human's decision and has a direct connection to it, "regardless of whether the nature of the output is advisory or determinative". The OAIC says machine-learning or generative-AI outputs used in significant decisions "would generally fall within scope unless subject to extensive human oversight and control". Its Example 3 describes managers who always sign off on bonuses but rely on a generative-AI report to document the reasoning: that is in scope. Only where staff interrogate the output, review the underlying data, set narrow parameters and record why they diverged might the program fall outside "substantially".

Note 1 of the fact sheet lists decisions "generally considered in scope". Two are squarely HR:

• "recruitment software used to sort through candidate profiles and make hiring decisions"; and
• "reports created by artificial intelligence used to rank employee performance, determine promotions, or decide bonus/remuneration outcomes".

Example 5 fills in the picture. A fictional engineering firm advertises on a job platform whose algorithm promotes the ad mainly to male graduates aged 21 to 30, then uses an AI screening tool that scores recorded video interviews on voiceprint, speech patterns, facial geometry, eye movement and body language and ranks applicants into a shortlist for HR to call. The OAIC's conclusion: both the ad targeting and the screening tool "significantly affect the rights or interests" of applicants because they limit access to employment, and the firm's privacy policy must disclose the screening tool even though HR makes the final call. The rights and interests limb covers "access to goods, services, or opportunities", and the guidance adds a vulnerability lens: a decision that falls harder on a vulnerable group is more likely to be significant.

Coverage. The Privacy Act binds "APP entities": organisations with annual turnover above $3 million, all health service providers, and other categories in section 6D regardless of size (for example businesses that trade in personal information or hold Commonwealth contracts). A small business operator with turnover of $3 million or less is generally outside the Act unless an exception applies.

Employee records exemption. Section 7B(3) exempts a private-sector organisation's acts that are directly related to a current or former employment relationship and an employee record. Decisions about existing staff (rostering, performance ratings, bonuses) may fall inside that exemption. Job applicants are not employees, so applicant screening never does. The OAIC lists performance and bonus tools as in-scope examples without qualifying them, and tells entities in doubt to take "a cautious approach and include information in their APP privacy policy", so the safer course is to disclose those tools as well.

Commercial-in-confidence. Trade secrets and commercially sensitive detail about how a program works are excluded. The fact that personal information is used to make a kind of decision is not, and the OAIC warns that information "that results in exposure to ridicule, embarrassment or public criticism" does not become confidential for that reason.

APP 1.8 requires three things, and the OAIC's Example 6 shows the format it expects: a heading such as "Decisions made by computer programs", a list of the kinds of personal information, then a list of the kinds of decisions. For a mid-sized employer using an applicant-tracking system with AI ranking, a compliant section could read:

Decisions made or informed by computer programs. We use applicant-screening software that uses the following kinds of personal information: identity and contact details; résumé, work history, qualifications and application answers; and skills assessment results. The output of this software is used by our recruiters as a key input when shortlisting and ranking applicants. A person makes the final decision. You can ask us how a decision about you was made and request that a person review it by contacting our privacy officer.

Group similar tools, keep the detail "meaningful to a reasonable person" without burying readers in technical specifics, and be explicit where sensitive information such as biometric templates or health information is used. The automated decision disclosure checker runs the three-limb test on each tool and produces draft wording from the kinds of information you select. Vendors should be asked for a plain description of how their product uses personal information; the OAIC expects the disclosure obligation to sit with the employer using the tool, informed by the vendor.

APP 1.7 is a transparency measure. It does not give you a right to contest an automated decision, to a human review, or to an individual notice, unlike the EU's GDPR. What it gives you is a document to read: from 10 December, an employer's privacy policy should tell you whether software scored your application or your performance, and from what information.

The rest of the law is unchanged and still does the heavy lifting. An AI screening tool that filters out candidates because of age, sex, disability, race or another protected attribute is unlawful discrimination under federal and state anti-discrimination law; see what to do if an algorithm rejected your application. Monitoring and surveillance tools are governed by state workplace surveillance laws, summarised in our AI workplace surveillance rights Q&A. Decisions about dismissal or discipline that lean on software output are tested under the Fair Work Act's unfair dismissal and general protections rules like any other decision. And an APP entity that leaves the disclosure out of its privacy policy after 10 December is in breach of APP 1, which the Information Commissioner can enforce.