Does the rule apply if a person still makes the final call?

It can. The OAIC's guidance says a decision may be in scope even where the program's output does not replace the whole process or is subject to human review. The test is whether the program does something substantially and directly related to the decision, such as ranking, scoring or recommending, and whether the person relies on it or is significantly influenced by it.

What if the software belongs to a vendor and I only use it?

The guidance says the obligation generally stays with the entity that arranged for the program to be used, even when a third party supplies it. Buying a tool does not move the disclosure to the vendor. Check what the tool does with personal information and what decisions it feeds.

Does a small firm have to do this?

The obligation sits in the Australian Privacy Principles, so it applies to organisations covered by them. Firms inside the small business exemption generally are not, although some activities, such as AML/CTF work for reporting entities, can bring a firm back in. This is general information, so confirm whether the Privacy Act covers your firm and which activities.

How detailed does the privacy policy wording need to be?

It needs to cover the kinds of personal information the program uses and the kinds of decisions it makes or substantially supports. It does not need to describe the system's inner workings. Plain, specific wording beats a vague line about using technology to improve services.

You have to disclose the robot from 10 December

What exactly has to be true for the rule to apply?

Three things, all at once, as the OAIC's APP Guidelines set them out.

Your firm has arranged for a computer program to make a decision, or to do a thing that is substantially and directly related to making one.
The decision could reasonably be expected to significantly affect the rights or interests of an individual.
Personal information about that individual is used in the program's operation.

If all three hold, the privacy policy has to describe the kinds of personal information the program uses, the kinds of decisions it makes on its own, and the kinds of decisions where it does something substantially and directly related to the decision. If any one is missing, this particular obligation does not bite.

"Computer program" is read broadly. The guidance includes rule-based processes as well as AI and machine learning, and it names generative AI tools and chatbots. A plain if-then rule in your practice management system counts as a program in the ordinary sense of the word.

Does a human signing off take you out of scope?

No, not automatically. This is the part most firms will get wrong if they skim.

The OAIC's guidance says a decision can be in scope even where the program's output does not replace the whole decision process or is subject to human review. Where a program recommends or guides a human decision-maker, the question becomes whether its contribution is real and a key factor in the decision, and directly connected to it.

The guidance lists factors to weigh. How much does the person rely on the output? How likely is it that they override it, and do they in practice? Is the output advisory or determinative? Can the decision-maker see why the program said what it said? How deeply is the tool built into the workflow?

A tool that produces a ranking nobody ever overrides is, in practice, making the decision. A tool that drafts an email a partner rewrites is not. The test is behaviour, not the org chart.

Which decisions "significantly affect" someone?

More than trivial, with the potential to considerably influence the person's circumstances. The guidance points to decisions about benefits, rights under a contract, and access to significant services or support, and it lists interests such as employment, finance, housing, health and reputation. It also says circumstances matter, so the same decision can weigh more on a vulnerable person than on someone else.

For a professional-services firm, the candidates tend to be internal and client-facing screens rather than anything exotic:

Software that screens, scores or ranks job applicants.
Automated triage that decides whether an enquiry is accepted, declined or deprioritised, where declining has real consequences for the person.
Credit-style decisions: payment plans, refund approvals, account holds.
Tools that score or flag clients for risk, including conflict checks that block an engagement.
Performance or promotion inputs generated by an AI tool the firm has directed staff to use.

Drafting a meeting summary, sorting your inbox or producing a first-pass report does not affect anyone's rights or interests in this sense. Be wary of stretching the rule to cover everything, because a policy that discloses forty things discloses nothing useful.

How do you find your qualifying decisions?

Run a short inventory. It takes an afternoon in a small firm.

List every tool that touches personal information about clients, candidates or staff, including the ones people adopted without asking. If you already ran the exercise in using AI without a system, start from that list.
For each, write one line: what does it output, and who sees the output?
Mark any output that is acted on, such as accepting, declining, ranking, flagging, pricing or scheduling, as opposed to simply read.
For those, ask the three questions above. Note how often a person actually overrides the output.
Keep the notes. If the OAIC or a client ever asks how you decided, a dated one-page record is your answer.

Most firms will end with a short list, and some will end with none. A blank result is a legitimate outcome, as long as you reached it by looking.

Who is responsible when the vendor builds the tool?

You are, generally. The guidance says the obligation typically stays with the entity that arranged for the program to be used, and it lists examples such as buying in an AI system to rank applicants or contracting a software company to approve or decline refunds on your behalf. The contract does not move the disclosure to the supplier.

It also expects entities to understand how a third-party tool is being used to make or assist decisions, during and after procurement, and to make contracts clear about who holds ultimate decision-making judgement. That sits naturally next to the questions in who actually owns your automations: what does the tool do, with whose data, and what can you see of it.

What should the privacy policy actually say?

Specific and short. For each qualifying use, state the kind of personal information involved, the kind of decision, and whether the program decides alone or supports a person who decides.

For example, a firm that screens applications with software might say that it uses a program that scores applications using the information in the candidate's CV and cover letter, and that a recruiter reviews the ranked list before anyone is shortlisted. That is wording a candidate can understand and a regulator can check against what you do.

The guidance indicates the detail is not meant to expose commercially sensitive workings of a system. You are describing the kinds of information and decisions, not publishing the model. Resist two temptations: a vague sentence about using technology to improve services, which tells the reader nothing, and a long list copied from a template, which will not match your practice.

If you have not reviewed your privacy policy lately, do that at the same time rather than patching one paragraph into an out-of-date document.

What to do next

Put 10 December in the diary and work backwards. A reasonable plan is to finish the tool inventory in October, decide in early November which decisions qualify, and have the policy wording drafted and reviewed by the end of that month, which leaves December for fixing anything the review turns up.

Check whether the Privacy Act applies to your firm at all, since firms inside the small business exemption are generally outside the Australian Privacy Principles, with exceptions such as AML/CTF work. Read the OAIC's guidance on the transparency obligation for yourself, and have your own adviser confirm the conclusions. Shift can help you map the tools and the workflows around them, but the legal view on what qualifies is for your adviser.