From 10 December 2026, Australian Privacy Principle (APP) 1.7 requires APP entities' privacy policies to describe certain automated decision making that uses personal information.
Under the Privacy Act 1988, an APP entity "means an agency or organisation".
Source: Privacy and Other Legislation Amendment Act 2024, Privacy Act 1988
As at the time of writing (October 2026), the latest Office of the Australian Information Commissioner (OAIC) resources on these changes were published on 30 September 2026.
Source: OAIC
For artificial intelligence (AI) and software as a service (SaaS) vendors, the changes may also lead to questions from customers that are APP entities.
What must a privacy policy say about automated decision making?
Where APP 1.7 applies, APP 1.8 requires the privacy policy to describe:
- the kinds of personal information the computer programs use
- the kinds of decisions made solely by the programs
- the kinds of decisions for which the programs do something substantially and directly related to making the decision
Source: Privacy and Other Legislation Amendment Act 2024
Which automated decisions count under APP 1.7?
APP 1.7 applies where a decision could reasonably be expected to significantly affect the rights or interests of an individual.
APP 1.9 gives examples including decisions that:
- grant or refuse a benefit under an Act or legislative instrument
- affect a person's rights under a contract, agreement or arrangement
- affect a person's access to a significant service or support
Source: OAIC, Privacy and Other Legislation Amendment Act 2024
The OAIC gives examples of decisions that would generally be considered in scope, including:
- recruitment software used to sort candidate profiles and make hiring decisions
- computer programs used to approve or reject loan or credit applications
- programmatic advertising relating to decisions to sell significant goods or services
Source: OAIC fact sheet
Automated decisions about customers are also one of the risks discussed in our AI agent liability guide.
Does APP 1.7 apply to small businesses and startups?
APP 1.7 applies to APP entities.
Most businesses with annual turnover of $3 million or less are not covered by the Privacy Act, but there are important exceptions.
The Privacy Act can also apply to startups with annual turnover of $3 million or less. Examples include businesses that trade in personal information and health service providers that hold health information. It can also apply where a company is related to another company whose business is not considered a small business.
Source: OAIC small business guidance, OAIC startup guidance, Privacy Act 1988
Even if your business sits outside the Privacy Act, your customers may still be APP entities.
What may customers ask AI and SaaS vendors for?
A customer may ask how your product makes or informs decisions so it can describe those processes in its own privacy policy.
The OAIC generally expects the APP 1.7 to 1.9 obligation typically to remain with the APP entity using personal information to make the decision. The OAIC's fact sheet says software providers should provide clear, high-level information about how their software can be used to make decisions.
Source: OAIC APP 1 Guidelines, OAIC fact sheet
A customer may also address automated decision making through its master services agreement (MSA), data processing agreement (DPA) or procurement process.
For the insurance side of enterprise procurement, see SaaS enterprise insurance requirements.
How do automated decisions affect professional indemnity and cyber?
An insurer may ask whether personal information feeds automated decisions in your product.
The AI startup insurance guide explains some of the information insurers may ask about.
upcover's glossary defines the duty of disclosure as "The obligation to reveal all material facts that could influence the insurer's decision to provide coverage or set terms".
Cover depends on the policy and insurer you choose. Check the policy wording and its terms and conditions for what is and isn't included.
If a customer alleges that an automated decision your product made or influenced caused financial loss, technology professional indemnity (Tech PI) insurance may be relevant.
Tech PI insurance is designed to cover claims that your advice, service or work caused a client financial loss. It may include legal defence costs, compensation and any settlement you are legally liable to pay, subject to the policy terms.
Cyber insurance is designed to cover costs after a data breach or cyber attack. Third party cover may respond to claims from customers or regulators.
Tech professional indemnity exclusions
Exclusions commonly include, but are not limited to:
- service credits, liquidated damages and other liability you take on under a contract that would not otherwise exist under the law (contractual liability exclusion)
- claims and circumstances you knew about before the policy started
Cyber insurance exclusions
Exclusions commonly include, but are not limited to:
- incidents a senior executive knew about, or could reasonably foresee, before cover started
- dishonest or fraudulent acts by, or known by, a senior executive
Important: These lists are not exhaustive. Exclusions vary between insurers. Always refer to the policy wording and its terms and conditions for the exclusions that apply to you, and if you have questions you should speak to your insurance broker or the upcover team.
What can vendors do before the 10 December 2026 privacy changes?
A vendor may prepare five items to help answer customer and insurer questions:
- Decision features: Keep a record of product features that make or inform decisions about people and the personal information each feature uses.
- Product note: Prepare a plain-language description of how customers can use the product to make decisions.
- Contract review: Check current MSAs and DPAs for clauses dealing with automated decisions, with legal advice where appropriate.
- Privacy Act position: Determine whether your business is itself an APP entity, with legal advice where appropriate.
- Insurer information: Be ready to explain what decisions the product makes or informs and where human review occurs.
How upcover can help
upcover arranges Tech PI and cyber insurance for Australian AI and SaaS businesses and works with more than 80 insurance partners.
- 70,000+ businesses covered across Australia
- 4.9/5 customer rating
- 80+ insurance partners
Get a quote for your AI business.
Frequently asked questions
Does human review take automated decision making outside APP 1.7?
A decision may still fall within APP 1.7 where a program's output forms only part of the decision-making process or is subject to human review.
Source: OAIC APP 1 Guidelines
Does APP 1.7 apply to products launched before 10 December 2026?
APP 1.7 applies to relevant decisions made after the provisions commence, even where the computer program was arranged before then.
Source: Privacy and Other Legislation Amendment Act 2024
Does the Privacy Act automated decision-making requirement cover third party AI tools?
Procuring or using a third party computer program does not automatically take an APP entity outside the transparency obligation.
The OAIC says entities that procure, configure, authorise, integrate or rely on a third party program may still be within scope.
Source: OAIC flowchart
Does Tech PI cover claims about automated decisions?
Whether Tech PI responds to a claim involving automated decision making depends on what the customer alleges, the policy wording and the insurer's assessment.
Written by upcover's editorial team.
This article provides general information only and does not take into account your objectives, financial situation or needs. It is not legal advice. The Privacy Act obligations described here apply from 10 December 2026, as at the time of writing (October 2026). Get legal advice about whether and how they apply to your business and your customers. Insurance availability and cover are subject to underwriting and the terms, conditions, limits and exclusions of the relevant policy. Read the policy wording and its terms and conditions before deciding. upcover arranges insurance products with selected insurers and underwriters and does not compare all general insurers or insurance products available in the market.
.svg){kind=logo}
.svg)
.svg)
.svg)
%201.svg){kind=icon}
.svg)
.svg)
