Australia's AI Rules Are Changing in December 2026 — Here's What Your Business Needs to Do

The Privacy Act 1988 amendments take effect on December 10, 2026. Here is what matters for businesses using AI.

Organisations must explain automated decisions. If your business makes decisions using AI or automation that affect people, you must be able to explain whether AI is involved and which personal data is being used. This applies to any decision made without meaningful human involvement.

The small business exemption is being removed. Previously, businesses with less than $3 million in annual turnover were exempt from most Privacy Act obligations. That exemption is going. Nearly every Australian business will now be covered — not just the large ones.

Penalties are severe. Non-compliance can attract penalties of up to $50 million AUD or 30% of adjusted turnover for the relevant period, whichever is greater. These are not theoretical numbers. They are designed to make non-compliance far more expensive than compliance.

An automated decision is any decision made without meaningful human involvement that affects someone. If software or AI is making the call — or heavily influencing it — it counts.

This is broader than most people realise. It is not limited to fully autonomous systems. If AI is doing the analysis and a human is just rubber-stamping the result, that likely qualifies.

If you are unsure whether something in your business qualifies, it probably does. The safest approach is to treat any AI-assisted process that affects a person as an automated decision and apply the requirements accordingly.

This is the practical part. Here is a compliance checklist you can start working through today. You do not need a lawyer to begin — most of this is operational.

Start with the audit. You cannot fix what you do not know about. List every AI tool, chatbot, automation, and algorithm in your business. Include third-party tools — if you are using a CRM with AI lead scoring, that counts. If your support tool uses AI to suggest responses, that counts too.

Document the data flows. For each system, write down what personal data it receives, what it does with it, and what decisions it makes or influences. This does not need to be a legal document. A clear spreadsheet is a good start.

Add disclosures. Wherever AI makes or influences a decision about a person, tell them. This means clear labels on chatbots, notifications in automated emails, and explanations in any AI-driven assessment or scoring system.

Build in human review. For high-stakes decisions — hiring, lending, access to services — there needs to be a genuine human review step. Not a rubber stamp. A real checkpoint where a person can override the AI.

Set up audit trails. Every automated decision should be logged. What data went in, what the AI decided, and when. If a regulator asks you to explain a specific decision, you need to be able to pull that up.

We work with Australian SMBs every day. These are the gaps we see most often — and the ones that will cause the most problems after December.

Using ChatGPT or AI tools with customer data and no disclosure. This is the most common one. Staff paste customer emails, enquiries, or records into AI tools to draft responses. The customer has no idea their data is being processed by AI. Under the new rules, this needs to be disclosed.

AI chatbots making recommendations without flagging they're AI. If a customer interacts with a chatbot that recommends products, services, or next steps based on their data, the customer needs to know it is AI. A simple “AI-assisted” label goes a long way.

Automated lead scoring with no human oversight. If your CRM scores leads using AI and automatically routes or prioritises them, that is an automated decision. If it affects how someone is treated — whether they get a call back, how quickly they get a response — it needs human review for high-stakes cases and logging across the board.

No audit trail for AI-generated decisions. Most businesses have no logging for what their AI systems decide. When the regulator asks “why did your system make this decision about this person?” you need an answer. “We don't know” is not going to cut it.

Third-party tools processing data overseas without adequate safeguards. If you use AI tools hosted overseas — and most are — you need to ensure adequate data protection is in place. Data Processing Agreements are the bare minimum.

Compliance is cheaper to build in than to retrofit. Bolting on audit logging, disclosure labels, and human review after the fact is messy and expensive. Building them in from the start is straightforward. It is a design decision, not an afterthought.

Every AI system we build at AI-DOS includes audit logging, clear AI disclosure, and human escalation pathsas standard. Not because we predicted these reforms — because it is the right way to build AI systems. Transparency and accountability should not be optional extras.

If you are building new AI automations, build them right from the start. The marginal cost of including compliance features during the build is a fraction of retrofitting them later.

If you already have AI tools running in your business, audit them now — not in November. The businesses that start early will have time to fix issues properly. The ones that wait until Q4 will be scrambling.

If you need help assessing where your current systems stand or building new ones the right way, that is exactly what our AI consulting and strategy service covers.