Australia's AI Rules Are Changing in December 2026 — Here's What Your Business Needs to Do

The Privacy Act 1988 is getting its most significant rewrite since it was enacted. There is a lot in the amendments, but for anyone running AI in their business, three things stand out.

You must disclose automated decisions. If your business makes decisions using AI or automation that affect a person, you have to explain that. Not buried in a privacy policy nobody reads. Proactively. You need to tell people that AI is involved, what data it uses, and how they can challenge the outcome. This applies to any decision made without what the legislation calls “meaningful human involvement.”

The small business exemption is dead. Until now, businesses under $3 million annual turnover could largely ignore the Privacy Act. That carve-out is being scrapped. A solo consultant using Claude to draft client reports is now in the same regulatory bucket as Commonwealth Bank. I cannot overstate how big a shift this is for Australian SMBs. Thousands of businesses that never had to think about privacy compliance now do.

The penalties are severe. Up to $50 million AUD or 30% of adjusted turnover, whichever is greater. These are not theoretical maximums designed to make a press release. They are calibrated so that ignoring the rules always costs more than following them. For a business doing $2 million a year, that is a potential $600,000 fine. Enough to end the business.

When business owners hear “automated decision,” they picture a fully autonomous system deciding whether someone gets a mortgage. The legal definition is much broader than that.

Any decision made without meaningful human involvement that affects a person counts. And “meaningful” is doing a lot of heavy lifting in that sentence. If your AI produces a recommendation and a person rubber-stamps it without genuinely reviewing the reasoning, that is still an automated decision under these reforms. The human review has to be real, not theatrical.

Be honest with yourself for a moment. Does your CRM score incoming leads and route them automatically? Does your chatbot suggest products based on a customer's purchase history? Does anyone on your team paste client emails into ChatGPT to draft responses? Every one of those probably qualifies. If you are unsure about a specific process, assume it does and act accordingly. That is cheaper than finding out the hard way.

You do not need a law firm on retainer to get started. Most of the initial work is operational — mapping what you have, writing down how it works, and plugging the obvious gaps. Here is where to start.

Start with the audit. Go through your entire stack. Every AI tool, chatbot, workflow automation, algorithm, and third-party integration. If your CRM has AI lead scoring, write it down. If your support platform auto-suggests replies, write it down. If anyone uses Claude or ChatGPT with client data, that goes on the list too. You will be surprised how many AI touchpoints exist once you actually look.

Map the data flows. For each system, document what personal data goes in, what processing happens, and what decisions come out. A spreadsheet is fine. Nobody expects a formal data protection impact assessment at this stage. You just need to know what is happening.

Add disclosures everywhere AI touches a customer.Labels on chatbots. Notices in automated emails. Explanations on scoring outputs. People need to know when AI is involved in decisions about them. This is not optional under the new rules. A simple “This response was generated with AI assistance” label takes five minutes to implement.

Build real human review for high-stakes decisions.Hiring. Lending. Service eligibility. Insurance. Anything where the outcome materially affects someone's life. Not a person glancing at a screen and clicking approve. A genuine checkpoint where someone understands the AI's reasoning and can override it.

Set up audit logging.Every automated decision needs a record: what data went in, what the system decided, and when. If a regulator asks about a specific decision six months from now, you need to produce the details. “We are not sure” will not fly.

I work with Australian SMBs daily. These are the issues I find in almost every audit, and they are the ones that will cause real pain after December if they are not addressed.

Staff using AI with client data, no disclosure. This is the most common one by far. Someone copies a client email into ChatGPT, gets a polished response, sends it. The client has no idea their data was processed by a third-party AI system hosted in the United States. Under the new rules, that needs disclosure. Full stop.

Chatbots with no AI label. If a customer interacts with a bot that recommends products or next steps based on their data, they need to know it is AI. Five-minute fix. But I find it missing in the majority of deployments I review.

Invisible lead scoring. Your CRM scores leads, routes them automatically, and determines who gets a fast callback versus who waits three days. That is an automated decision affecting a person. It needs logging, transparency, and for high-stakes scenarios, human review.

Cross-border data without agreements.Most AI tools are hosted outside Australia. If customer data crosses borders — and it almost certainly does — you need Data Processing Agreements in place. That is the bare minimum.

Bolting compliance onto an existing AI system is painful. I have done it. Adding audit logging to a workflow that was never designed for it means rearchitecting half the system. Tracking down every customer touchpoint to add disclosure labels after the fact is tedious and error-prone. You always miss something.

Building compliance into new systems from day one costs a fraction of the retrofit. Every AI system we build at AI-DOS ships with audit logging, clear AI disclosure, and human escalation paths as standard. We did not add those because of these reforms. We included them because that is how responsible AI systems should be built. The legislation just made it mandatory for everyone.

If you are building anything new with AI between now and December, build it right the first time. And if you already have systems running, audit them now. The businesses that start this month will have time to fix issues methodically. The ones that start in September will be scrambling. The ones that start in December will be writing cheques to lawyers.

If you want help assessing where your current systems stand or need to build new ones properly, that is what our AI consulting and strategy service is designed for.