Nothing Enters HR Until It Clears the Gate

The purchase was never the control.

Artificial intelligence (AI) is arriving inside human resources (HR) systems that were bought years ago. It arrives in a release note, a default setting, a renewed licence and a module the vendor switched on. Nobody ran a tender for it, and there may be no record that it is running at all.

Australian privacy law puts the consequence on the employer deploying the tool. A vendor may carry obligations of its own, and none of them discharge the employer's. The standing obligation is Australian Privacy Principle (APP) 1.2, which is about systems rather than purchases. From 10 December 2026 a further obligation attaches to what an APP privacy policy says about computer programs that make significant decisions, and it reaches arrangements entered into long before that date. As at 25 September 2026 it has not commenced.

The practitioner answer is a standing register, owned by an HR role, with one row for every AI feature that touches employee or candidate information, naming the intended use, the human decision point and a review date. It opens first for what is already live.

Why the gate sits at renewal rather than at purchase

The regulator has already named the failure. The Office of the Australian Information Commissioner (OAIC) guidance Privacy and the use of commercially available AI products, published 21 October 2024 and updated 17 January 2025, states that "Due diligence for AI products should not amount to a 'set and forget' approach."

The AI systems register template published by the National AI Centre, AI systems register, published 22 April 2026, makes the same point about scope: "The register should capture all AI systems, including AI features embedded in common software packages." That material is Australian Government guidance rather than legislation, so it is a design reference rather than a legal requirement.

Microsoft's page Data, Privacy, and Security for Microsoft Copilot on Microsoft Learn, which carried a last updated date of 18 August 2026 when it was read on 25 September 2026, states that "Admins have full control to select which agents are allowed in their organization."

Three things follow.

1. The capability reached HR through a productivity licence, not an HR procurement.
2. The control surface is an administrator setting, so the row names the role that holds it.
3. A vendor statement is evidence with a date on it: the same page notes a product renaming and the use of third party models.

What does Australian privacy law require of an employer today?

The current obligation is short and about systems. APP 1.2 provides that an APP entity "must take such steps as are reasonable in the circumstances to implement practices, procedures and systems" relating to its functions or activities. That is the in force text at the Privacy Act 1988 compilation on the Federal Register of Legislation, Compilation No. 104 dated 4 June 2026, as at 25 September 2026 and capable of being superseded.

That is the clause a register discharges. Practices, procedures and systems, evidenced.

APP 1.3 requires a clearly expressed and up-to-date APP privacy policy, and APP 1.4 requires that policy to contain "the purposes for which the entity collects, holds, uses and discloses personal information". A feature that infers something about a candidate from a video interview, or scores an internal applicant against a role profile, is a use. If nobody can name it, the policy cannot describe it.

Section 13K of the same compilation makes a breach of certain principles a civil penalty provision for which an infringement notice or compliance notice can be issued. APP 1.2 is not on that list. APP 1.3 and APP 1.4 are, and under section 13K(4) the penalty for a contravention of subsection (1) or (2) must not exceed 200 penalty units, as at 25 September 2026.

On the point that decides whether a register row is a control or a list, the OAIC guidance recommends rather than requires. It recommends "establishing clear processes for human oversight and verification of AI outputs, particularly where the outputs contain personal information or are relied on to make decisions in relation to a person". That is why the register carries a human decision point column.

What changes on 10 December 2026?

An APP privacy policy acquires a new content requirement, and nobody can meet it without an inventory behind it.

The Privacy and Other Legislation Amendment Act 2024, No. 128 of 2024, as made, inserts new subclauses 1.7, 1.8 and 1.9 into APP 1. New APP 1.7 applies where an entity "has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision", that decision "could reasonably be expected to significantly affect the rights or interests of an individual", and personal information about that individual is used in the operation of the program. New APP 1.8 covers, among other things, "the kinds of personal information used in the operation of such computer programs". New APP 1.9 makes clear that "making a decision includes refusing or failing to make a decision".

The commencement is fixed by the Act's own table, which sets the day as "The day after the end of the period of 24 months beginning on the day this Act receives the Royal Assent." Assent was given on 10 December 2024, so the date is 10 December 2026. From commencement, item 87 of the same Part also adds APP 1.7 to the principles listed in section 13K(1)(b).

As at 25 September 2026 these subclauses are not in force, and that is verifiable: in Compilation No. 104, clause 1 of Schedule 1 ends at subclause 1.6. The OAIC APP guidelines Chapter 1: APP 1 Open and transparent management of personal information, version 1.2 updated 3 October 2025, state that "The OAIC will be publishing detailed guidance about these new APP 1 obligations for automated decisions in 2026."

Two limits matter. The enacted text requires information in a privacy policy about kinds of information and kinds of decisions. It creates no right to an explanation of an individual decision and no right to human review.

The amending Act applies the new obligation to decisions made after commencement whether the arrangement for the computer program was made before or after that commencement. A system bought in 2019 and renewed without discussion in 2024 is inside the requirement if it now makes, or does a thing substantially and directly related to making, a decision of that kind.

The AI in HR register, in full

Ten of the eleven columns below come from a published source, cited in the last column. Status is the gate's own decision, and it exists so the register can refuse. The implementation guidance published by the National AI Centre, Guidance for AI adoption: implementation guidance, download published 5 May 2026, recommends organisations "Create and maintain an up-to-date, organisation-wide inventory of each AI model and system".

One row is one AI feature, not one contract and not one vendor.

A populated row looks like this.

A register showing nothing missing on its first pass has not been filled honestly.

The template also names what a register is not: "An AI register is about transparency and documentation. It should not replace more in-depth governance activities such as impact assessments and risk management."

Does the employee records exemption cover recruitment AI?

No. The exemption turns on a current or former employment relationship, and an applicant is in neither.

Section 7B(3) of the Privacy Act 1988 exempts an employer's act or practice only where it is directly related to a current or former employment relationship and to an employee record. Two conditions, both of which have to hold. The exemption is available to a private sector employer, so a public sector employer cannot rely on it.

The OAIC page on the Employee records exemption, publication date December 2015, states that "The exemption does not cover future employment relationships." An unsuccessful applicant is not a current or former employee, so screening, ranking and video interview analysis of candidates sit outside the exemption.

The same page states that "the employee records exemption is unlikely to apply to organisations that provide recruitment, human resource management services, or medical, training or superannuation services under contract to an employer". A vendor running an assessment platform on an employer's behalf may carry its own APP obligations, which the register row records.

The OAIC page also records that pre-employment check records become exempt once the person is employed. The exemption turns on a relationship, at a point in time, for a record.

That boundary is why the gate belongs to HR rather than information technology (IT). The Australian Human Rights Commission resource page for the AI and recruitment compliance checklist states that the checklist "helps organisations assess whether their use of AI in hiring respects human rights and meets legal obligations". It was developed by LexisNexis in collaboration with the Commission, so it is a resource, not an Australian legal standard. Fairness and transparency, and digital robustness and safety, are the two of its four areas only HR can answer for a hiring use case.

The gate itself, from trigger to status

Five stages, beginning with an event rather than a meeting.

1. Trigger: a renewal, a release note, a model change, a new setting or a request to enable a module. Anything that changes what the system does with personal information opens a row.
2. Intended use and the significant decision test, written in HR language by the HR owner.
3. Human decision point, named by role, with what that person can change or overturn recorded beside it.
4. Evidence placed on file, which is where a threshold assessment earns its keep.
5. Status and date, set by the HR owner: permitted, restricted or prohibited, and a date, never a frequency.

The OAIC Guide to undertaking privacy impact assessments, publication date 2 September 2021, describes a privacy impact assessment (PIA) as "a systematic assessment of a project that identifies the impact that the project might have on the privacy of individuals" and says a PIA should be revisited and updated where developments in a project create new privacy impacts. A material change to the product reopens the assessment, which is the trigger a review date serves.

Filling the register from the vendor's own documents

TheAICommand works to the Verified Draft Method: de-identify the inputs, ground the model in your own source material, keep a person at the decision point, verify against the primary source, and log what happened.

Applied here, the model reads the vendor's own documentation and fills nothing it cannot point to.

You are helping to complete an internal AI register row for [HR_SYSTEM] by [VENDOR].

Use only the attached documents. Do not use any other knowledge about this product,
this vendor or products like it. Do not infer. If the documents do not answer a
column, say so.

The attached documents are the vendor's AI, privacy, security or trust pages, each
with the date it was last updated shown on the page.

Fill only the register columns listed below. The owner completes the rest by hand.
For each column, return: the proposed entry, the exact sentence from the attached
documents that supports it, the document name, and the last updated date of that
document.

Columns: system and feature; personal information handled (input, output, inferred);
does the feature make a decision, or do a thing substantially and directly related to
making a decision, about a person; human oversight and what a reviewer can change;
where the data goes (developer access, subprocessors, storage region, retention);
administrator settings that switch the feature on or off; stated limitations.

File the administrator setting against the human decision point column. Carry the
stated limitations into the next prompt as part of the feature description, because
the intended use cell is written by the HR owner.

Then return a second list headed OPEN QUESTIONS FOR [VENDOR], containing every column
the attached documents do not answer, written as a question that names the document
or setting that would answer it.

Use placeholders for any person. Do not include candidate or employee names.

What to check: find each quoted sentence in the attached document yourself, because a cell whose quotation does not appear is the failure this prompt exists to catch. Then read the open questions list. If it is empty, the model has filled gaps from training data, and the row is not evidence. Open columns are the renewal conversation, and the intended use cell stays empty until the HR owner writes it.

Intended use, and the decision that is not yours to delegate

The significant decision test can be answered too widely or too narrowly, and both answers make the register useless for allocating attention. The model helps only if it is forbidden from reaching a conclusion.

The extract comes from Schedule 1, Part 15 of the amending Act linked above.

Use only the feature description below and the attached extract of new APP 1.7 to
1.9, as inserted by Schedule 1, Part 15 of the Privacy and Other Legislation
Amendment Act 2024.

Feature description, written by the HR owner: [FEATURE_DESCRIPTION]. The system is
[HR_SYSTEM]. Affected people are [AFFECTED_GROUP]. Use placeholders only, no names.

Task one: draft three candidate one sentence intended use statements, in plain
operational language, each naming what the feature does and what it does not do.

Task two: set out the arguments both ways on whether this feature makes a decision,
or does a thing that is substantially and directly related to making a decision,
that could reasonably be expected to significantly affect the rights or interests of
an affected person.

Put the adverse reading first and state it at its strongest. Then state the benign
reading at its strongest. For each argument, name the fact in the feature description
it rests on.

Task three: list the facts that are not in the feature description and that would
change the analysis if known.

Do not reach a conclusion. Do not recommend a status. Do not describe anything as
low risk or compliant.

What to check: confirm the model has not decided the question, because a closing recommendation means the output cannot be filed as reasoning. Read the adverse case and satisfy yourself it is argued as hard as the benign one. Take the task three list to the system owner: a missing fact that changes the analysis is why a status stays restricted.

The renewal conversation, prepared in advance

A renewal notice arrives with a date and an implicit default. The register row turns it into a conversation. Replace any vendor contact name in the row with [VENDOR_CONTACT] before attaching it.

Use only the attached register row for [HR_SYSTEM] and the attached vendor
documentation.

Use placeholders for every person. Do not include candidate, employee or vendor
contact names.

Draft a renewal challenge pack for [HR_OWNER] to send to [VENDOR] before
[RENEWAL_DATE].

For every column in the register row that is blank, dated more than twelve months
ago, or supported only by marketing language, produce:
- the question, written so it can be answered with a document or a setting
- the specific artefact requested (a named page, a report, a configuration export,
  a subprocessor list, a model card, a test result)
- what an inadequate answer would look like

Group the questions under: intended use and limitations; decisions about people and
human oversight; data location, access and retention; change notification; evidence
to retain.

Do not ask for reassurance. Do not ask whether the product is compliant. Do not
accept a policy link as an answer to a configuration question.

What to check: every question must name the document or setting that would answer it, so delete any a vendor could close with reassurance. Confirm no name survived from the register row into the pack. Confirm the change notification group exists, because that commitment is what keeps the register true between reviews.

This is general information for practitioners, not legal advice, and an organisation takes its own advice on its own facts.

Do this Monday

The artefact is the AI in HR register, the eleven columns above, in whatever tool the team already uses. The ai.gov.au register page linked above offers a downloadable template to start from, to which the significant decision test and human decision point columns are added.

The owner is the HR systems or operations lead. IT holds the settings and cannot state the intended use of a hiring feature. The vendor's governance covers its product, not the employer's obligations.

The first step fits in an hour:

1. List every AI feature already switched on in the tools HR uses today, from vendor release notes and whatever the HR console itself shows, and open a row for each one.
2. Send one message per tool to the system administrator asking which AI features are enabled and who can switch them off, then add or correct rows as the answers return.
3. For each row open at the end of the hour, fill system and feature, personal information handled and the human decision point, then write one sentence of intended use. Where that sentence cannot be written, mark the status restricted.
4. Set a review date on every row, twelve months out or the next renewal date, whichever is sooner. Leave any evidence cell with nothing behind it visibly blank.

The check that it worked is threefold:

1. Every live feature has a named human decision point by role.
2. Every row carries a review date no more than twelve months away.
3. Every row where the intended use sentence could not be written is marked restricted. If there is such a row it is the finding of the hour. If there is not, the register says so on its face and the hour still worked.

The bottom line

The decision point for AI in HR has moved from procurement to renewal, release note and configuration change, and the OAIC has said that due diligence for AI products should not amount to a set and forget approach. APP 1.2 already requires practices, procedures and systems, and from 10 December 2026 an APP privacy policy also has to describe the kinds of personal information used in computer programs that make significant decisions, including under arrangements made years earlier. As at 25 September 2026 subclauses 1.7 to 1.9 have not commenced. A standing register owned by an HR role, one row per feature, answers both. Open it for what is live, not for what is next.