Your Privacy Policy Now Has to Name the Decisions

From 10 December 2026 your privacy policy describes the decisions.

Schedule 1 Part 15 of the Privacy and Other Legislation Amendment Act 2024, No. 128, 2024, inserts Australian Privacy Principles (APP) 1.7, 1.8 and 1.9 into the Privacy Act 1988. Under s 2 of that Act, as made, those items commence the day after the end of 24 months beginning on Royal Assent, and the date column in the commencement table reads 10 December 2026. That is 55 days after this article publishes on 16 October 2026.

From that day an APP entity that has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision that "could reasonably be expected to significantly affect the rights or interests of an individual" has to carry three kinds of information in the policy on its website. That is not a naming duty. Australian Privacy Principle 1.8 asks for kinds of personal information and kinds of decisions, not the identity of a product.

The consequence for the Comcare scheme is narrower and harder than it sounds. The duty does not stop at decisions a machine makes alone. It reaches the assistive layer behind a s 14 liability determination, a s 19 incapacity calculation and a s 62 reconsideration. A register of decision points and the programs touching them produces the policy paragraph, and it has to exist before commencement, because the policy has to be accurate on the day.

What the new clauses actually say

Three clauses do three different jobs, and conflating them is the first error.

Australian Privacy Principle 1.7 sets the trigger, in three limbs that operate together: the entity has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision; the decision could reasonably be expected to significantly affect the rights or interests of an individual; and personal information about that individual is used in the operation of the program to make the decision or do the thing.

Australian Privacy Principle 1.8 sets the contents. The Office of the Australian Information Commissioner (OAIC) APP guidelines, Chapter 1 records that "From 10 December 2026, there will be additional obligations for APP entities to include information in an APP Privacy Policy (APP 1.7)" and lists three kinds of information the policy has to carry:

• the kinds of personal information used in the operation of those computer programs;
• the kinds of decisions made solely by the operation of computer programs; and
• the kinds of decisions for which a thing substantially and directly related to making the decision is done by the operation of such computer programs.

Australian Privacy Principle 1.9 extends the word decision. On the text as made, "making a decision includes refusing or failing to make a decision". A refusal to accept liability is a decision, and a determination that is never made is also a decision for this purpose.

Nothing requires this today. Australian Privacy Principle 1.4 sets out what a privacy policy has to contain and says nothing about computer programs, so a policy silent on automated decision making is compliant as at 26 September 2026 and, for an entity with a caught arrangement, is not compliant on 10 December 2026. The new clauses are also not in the compiled Act. The Privacy Act 1988 at Compilation No. 104, compilation date 4 June 2026, runs only to Australian Privacy Principle 1.6, because Schedule 1 Part 15 has not commenced, so anyone checking the text before December reads the amending Act as made. Both compilation numbers were current on 26 September 2026 and either may be superseded, so confirm both on the Federal Register before relying on either.

Which SRC Act decisions does this reach?

Start with the decisions, not the systems.

The Safety, Rehabilitation and Compensation Act 1988, at Compilation No. 82 with a compilation date of 1 July 2026, defines the field. Under s 14(1), Comcare is liable to pay compensation in respect of an injury suffered by an employee if the injury results in death, incapacity for work, or impairment. The incapacity formula sits in s 19(2), where "AE is the greater of the following amounts" and "NWE is the amount of the employee's normal weekly earnings". A determining authority is, under s 60, the person who made the determination. Under s 62(1) that authority may reconsider a determination on its own motion, and s 62(4) provides that on receipt of a request it reconsiders the determination itself or causes it to be reconsidered by a delegate other than a person who made, or was involved in the making of, the determination.

Each of those decisions clears the significance threshold in Australian Privacy Principle 1.7, which the OAIC APP guidelines illustrate with examples. A liability determination decides whether a person has a claim. An incapacity calculation decides what is paid weekly. A reconsideration decides whether the first answer stands.

What is out of scope matters too. A diary reminder, a room booking, a spelling check on correspondence: none of these makes or substantially shapes a determination. A register built from every system in the claims environment has no natural boundary. One built from statutory decision points does, because the Act supplies the list.

The general obligation, and how it lands across a regulated organisation, is covered in the companion piece on the December 2026 transparency obligation.

How do you classify a program against the two limbs?

This test decides whether a line goes into the policy.

Comcare scheme guidance on best-practice decision making under the SRC Act states that "A decision must be made under legal authority by an authorised person". A determination is made by a delegate holding an instrument of delegation, so almost nothing in a compliant claims operation lands in the solely-made limb. The exposure sits in the other one.

The OAIC reads the term computer program widely. Its May 2026 Automated Decision-Making Transparency Obligation Issues Paper states that "Generative AI tools used to generate text, images, videos, code or synthesis, including chatbots, all fall within the definition of computer program for the purpose of the ADM obligation". A spreadsheet is a computer program, and so is a triage tool, a calculator behind an incapacity figure, and a model that drafts a summary of medical evidence.

In the same paper the regulator quotes the explanatory memorandum to the amending Bill for the two words. Substantially means the program is a key factor in facilitating the decision, and directly means it has a direct connection with making the decision. A footnote to its triage example gives the counterweight: on the memorandum's wording a spreadsheet used only to add numbers may be directly related but not substantially related. Both limbs have to be satisfied.

Run that against the scheme and three shapes appear. A model that summarises a medical report before a s 14 determination is a key factor in facilitating it where the delegate relies on the summary rather than reading the file, and the register records which is true. A calculator producing the AE and NWE inputs for a s 19 figure has a direct connection with that decision, and whether it is also substantially related depends on how much of the figure it settles. A tool that ranks reconsideration requests for allocation under s 62 is closer to the triage example than to the arithmetic one. None of those is a ruling. Each is a test the entity applies to its own facts.

Licensee or agency: who publishes what?

The scheme has two sides under the Privacy Act, and the split decides who drafts.

Under s 6(1) of the Privacy Act, an APP entity means an agency or organisation. Comcare sits on the agency side. Its privacy page already publishes a policy and states that Comcare "must maintain a register of all Privacy Impact Assessments completed, in accordance with s15(1) of the Australian Government Agencies Privacy Code".

A self-insured licensee is on the other side. Comcare guidance on self-insured licensees records that the SRC Act "grants eligible corporations and Commonwealth authorities a licence to self-insure their workers' compensation liabilities and/or claims management", and under s 108A(1), where a licensee is authorised to accept liability and the injury, loss, damage or death occurs, the licensee is liable to pay compensation and other amounts under the Act. A licensee that is a trading corporation is an organisation under the Privacy Act unless it is a small business operator, and the threshold in s 6D(1) is annual turnover of $3,000,000 or less for the previous financial year, as at 26 September 2026. That threshold puts the exemption out of reach for the trading corporations holding these licences, and each entity confirms its own position from its own accounts. The Safety, Rehabilitation and Compensation Commission list of current and former self-insurers showed 40 current self-insured licensees in Table 1 when it was read on 26 September 2026, and that table mixes trading corporations, Commonwealth authorities and a Territory, so the classification is done entity by entity.

Each entity describes its own arrangements, because Australian Privacy Principle 1.7 attaches to the entity that has arranged for the program. Two organisations using the same vendor tool on the same statutory decision write two separate policy statements.

The contracted claims manager is the sharpest trap

Under s 108B(3) of the SRC Act a licensee "may at any time enter into a contract with another person for the management, on the licensee's behalf, of the claims that the licensee is authorised to manage". Under s 108C(1) the licensee must still determine any particular claim it is authorised to manage in accordance with the scope of its licence.

So the statute separates managing from determining, and the privacy clause attaches to neither word. It attaches to the entity that has arranged for the computer program. Where a claims manager brings its own triage engine, summarisation tool and calculators to a licensee's portfolio, who arranged for the program is a contractual and legal question the available sources do not answer.

Take it to the provider. Three questions do the work:

1. Which computer programs does the provider operate on this portfolio?
2. Which statutory decision points do those programs touch?
3. Which entity does the provider say has arranged for their use?

Get the answers in writing, record the date, and put both in the register.

The register the policy text comes from

TheAICommand works to the Verified Draft Method: de-identify the inputs, ground the model in your own source material, keep a person at the decision point, verify against the primary source, and log what happened.

That method is the register work. The inputs are the instrument of delegation, the claims management procedure and the vendor documentation, none of which needs a claimant record. The delegate approving each classification is the decision point, the amending Act is the verification, and the register is the log.

The first prompt builds the rows from the entity's own documents, with the sentence that supports each classification.

Help me build an automated decision making register for [LICENSEE], a self-insured licensee under the Safety, Rehabilitation and Compensation Act 1988. Use only the documents I have attached: the instrument of delegation, the claims management procedure, and the vendor documentation for each system named in that procedure. Do not use outside knowledge and do not infer a capability the attached documents do not describe.

For every decision point in the attached procedure, return one block, with each field on its own labelled line: the decision; the SRC Act section; the program or system that touches it; what that program does in one sentence taken from the attached document; the kinds of personal information used in the program's operation; the classification; the exact sentence in the attached documents that supports that classification; the entity that has arranged for the program; the source and date of that answer, being the contract clause or the provider's written confirmation; the delegate role that signs; a confidence of high, medium or low; and the review date, which the owner sets on approval, so write to be set.

The classification takes one of four values: made solely by the operation of the program; substantially and directly related to making the decision; touches the decision but not substantially and directly related; or no program. Use the third value where a program touches the decision point but is not both a key factor in facilitating it and directly connected to making it, and quote the sentence showing what the program does.

Where no program touches a decision point, write none against the program and classify it as no program. Where the attached documents do not settle a field, write unresolved against that field, name the document that would settle it, and quote the closest sentence. Do not guess.

Use role titles and placeholders only, such as [DELEGATE], [CLAIMS_MANAGER] and [VENDOR_TOOL]. Do not output any claimant name, claim number or date of birth. If a claimant identifier appears in an attached document, replace it with [CLAIMANT_NAME], [CLAIM_NUMBER] or [DATE_OF_BIRTH].

End with one summary table carrying only the decision, the section, the program and the classification, and nothing else.

What to check: open the supporting sentence for every row and confirm the quoted words exist in the attached document, because a fabricated supporting sentence is the failure mode that matters most here. Confirm every decision point produced a block, including the ones with no program, since a missing row reads as a clean result. Take any row classified as solely made to the delegate, because a determination here is made by an authorised person and that classification needs explaining. Confirm no claimant identifier is in the output.

The second prompt turns approved rows into policy language, and runs only after a person has signed off.

Use only the attached register rows, which [DELEGATE] has approved, and the attached current published privacy policy of [LICENSEE]. Do not add a program, a decision or a kind of personal information that is not in the attached rows.

Draft three lists in plain language for the privacy policy: first, the kinds of personal information used in the operation of the computer programs named in the rows; second, the kinds of decisions made solely by the operation of those programs; third, the kinds of decisions for which a thing substantially and directly related to making the decision is done by the operation of those programs.

Use only rows where the entity that has arranged for the program is [LICENSEE]. Put any row arranged by another entity, and any row where that field is unresolved, in the For legal review section below with the arranging entity and the source given for it.

Where no approved row supports a list, keep its heading and write under it exactly these words and nothing else: no decision of this kind is made, or substantially and directly shaped, by the operation of a computer program.

Write at the reading level of the existing policy and in its existing headings and terminology. Describe kinds of decisions, not individual systems, and do not name a vendor product unless the attached policy already names it.

For any row marked unresolved or low confidence, keep it out of the three lists. Put it in a separate section headed For legal review, with the row, the competing classifications, and the sentence from the register that is in tension.

Use placeholders for every person and do not output any claimant identifier.

What to check: map every sentence of the draft back to a register row, and delete any sentence with no row behind it. Confirm the second list carries the nil sentence where no row was classified as solely made, because a nil is accurate and a populated list is an unverified claim. Confirm no list describes a program the register attributes to [CLAIMS_MANAGER]. Read the three lists against Australian Privacy Principle 1.8 in the amending Act, not a summary of it.

The third prompt is the gap test, run against what is published today.

Compare the attached approved register for [LICENSEE] against the attached published privacy policy, as it appeared on [DATE_CHECKED]. Use only those two documents.

Return only the register rows whose program is not described anywhere in the published policy, with the row, its classification, and the reason no existing sentence covers it. Where a row is arguably covered by a general sentence, quote that sentence and mark the row as arguably covered.

If every row is described in the published policy, return exactly these words and nothing further except the count line: no gap identified.

End the output with one count line giving the total register rows, the rows described in the policy, the rows arguably covered, and the rows not described. Those four numbers must reconcile.

Do not suggest new policy wording. Do not give a view on whether the policy complies with any law. Do not output any claimant identifier; use [CLAIMANT_NAME], [CLAIM_NUMBER] and [DATE_OF_BIRTH] if one appears.

What to check: run the prompt once against a register row known to be absent from the published policy and confirm the tool returns it, because a gap test that never returns a gap is not a test. Then confirm the count line's total equals the rows in the register you attached, because a dropped row shows as a short total, not as broken arithmetic. Take any row marked arguably covered to [DELEGATE].

What is not settled as at 26 September 2026?

Two things are open, and writing them into the register is better than waiting for them.

Detailed regulator guidance is the first. The OAIC consultation on guidance for transparency in automated decision making, published 18 May 2026, closed on 15 June 2026, and the Issues Paper records an intention to release guidance by September 2026. None had been published when those pages were checked on 26 September 2026, and the OAIC APP 1 guidelines page states only that the guidance will be published in 2026, so check both before the policy text is finalised.

The classification of any particular tool is the second. Nothing in the sources rules a named system in or out. The entity applies the substantially and directly test to its own arrangement, and the register records the reasoning.

Enforcement is not open, and it is the reason the first two matter. A maximum pecuniary penalty that "must not exceed 200 penalty units" attaches to the provisions listed in s 13K of the Privacy Act, which already carries Australian Privacy Principle 1.4, the contents of an APP privacy policy. Item 87 of Schedule 1 Part 15 adds Australian Privacy Principle 1.7 to that list on commencement, as at 26 September 2026. Item 89 then provides that the amendment "applies in relation to decisions made after the commencement of this item", and the OAIC confirms it attaches to decisions made from that date whatever the age of the arrangement.

Do this Monday

Build the automated decision making register, one row per statutory decision point, and put a role against it.

The artefact is a register with twelve columns, shown here against a s 19 incapacity calculation:

1. The decision, a s 19 incapacity calculation.
2. The SRC Act section, s 19.
3. The program that touches it, [VENDOR_TOOL].
4. What that program does, in one sentence from a document the entity holds.
5. The kinds of personal information used in its operation, here employment and earnings information.
6. The classification: solely made, substantially and directly related, touches but not caught, or no program.
7. The evidence sentence, quoted from the claims management procedure.
8. The entity that has arranged for the program, [LICENSEE] or [CLAIMS_MANAGER].
9. The source and date of that answer, a contract clause or a written confirmation.
10. The delegate role that signs, [DELEGATE].
11. The confidence, high, medium or low.
12. The review date, set by the owner on approval.

The owner is the privacy officer where the entity has one, and the claims and compliance manager where it does not, with the delegate approving each classification.

The first hour needs only the instrument of delegation and the claims management procedure, with the vendor documentation if the entity holds it. Attach them, run the first prompt, and keep three rows: a s 14 liability determination, a s 19 incapacity calculation and a s 62 reconsideration. Each block the prompt returns is one register row, its labelled lines the twelve columns above. Expect unresolved against columns 4, 5, 8 and 9 wherever a program is named, because the vendor documentation and the provider's written confirmation are the next action against the same owner. No claim file is opened and no claimant data is used.

The check that proves it worked has four parts:

• Every row names a program or is marked no program, so there is no blank.
• Every classification carries a quoted sentence from a document held by the entity.
• Each of the three kinds Australian Privacy Principle 1.8 requires can be written out of the resolved rows with no fact invented, or recorded as nil with the rows that establish the nil.
• Every row carrying unresolved in column 4, 5 or 6 records its kind as not yet established and names the outstanding document, which is the expected result of the first hour.

The bottom line

On 10 December 2026, Australian Privacy Principles 1.7, 1.8 and 1.9 commence under Schedule 1 Part 15 of the Privacy and Other Legislation Amendment Act 2024, and an APP entity's privacy policy has to carry the kinds of personal information its computer programs use and the kinds of decisions those programs make or shape, as at 26 September 2026. In the Comcare scheme a delegate signs every determination, so the exposure is the assistive layer of calculators, triage tools and summarisers behind s 14, s 19 and s 62 decisions. Comcare carries the duty as an agency and each licensee separately as an organisation, so no scheme-level description covers anyone else. Build the register. Then draft the paragraph.

This article is general information and education only. It is not legal, compliance, financial or professional advice.