From 10 December 2026, your privacy policy must explain decisions made with the help of computer programs. For an AML/CTF firm that uses software to verify identity, screen clients and suggest a risk rating, this is a real change. This post explains the new automated decisions rule for privacy policies, which tools it catches, what to add, and an example paragraph you can adapt for your privacy policy update in December 2026.
It is our own reading of the Privacy Act amendments and the OAIC's APP Guidelines. The OAIC's August 2026 guidance for AML/CTF reporting entities does not deal with this rule, so check your wording with your adviser. It is general information, not legal advice.
In short. From 10 December 2026, APP 1.7 to 1.9 require your privacy policy to describe the kinds of personal information used, and the kinds of decisions made, where a computer program makes a decision, or does something substantially and directly related to making one, that could significantly affect a person. Identity verification, screening and risk-rating software can all fall within it. The duty sits with your firm, as the business that makes the decision.
What changes on 10 December 2026
APP 1 is the Privacy Act rule about being open and transparent about how you manage personal information. It is the reason you need a privacy policy at all. The Privacy and Other Legislation Amendment Act 2024 added three new parts to it, APP 1.7 to 1.9, which come into force on 10 December 2026.
They apply where a computer program makes a decision, or does something substantially and directly related to making a decision, that could significantly affect a person. Where that happens, your privacy policy must describe:
- the kinds of personal information the program uses; and
- the kinds of decisions involved.
If your firm would otherwise be exempt as a small business, the OAIC says your privacy policy need only cover the personal information you handle for your AML/CTF obligations. That is exactly where this kind of software is used.
Which AML/CTF tools count as automated decisions?
Start with the decisions about clients that could significantly affect them: whether you can provide a service, the money laundering and terrorism financing risk rating you give them, and whether you need more information from them. Then ask where software makes each one, or does something substantially and directly related to it:
- Identity verification. An identity verification provider's software checks the ID document, compares a selfie with the ID photo, and passes or fails the check or refers it to a person. Here the software can make the decision itself.
- Screening. Software compares the client with sanctions, politically exposed person (PEP) and adverse media lists and flags possible matches. A person at your firm decides what each match means.
- Risk rating. Software works out a suggested rating from the client's answers, the identity check and the screening results. A person reviews it, can override it, and saves it.
- AI tools. Software that reads documents a client gives you, or suggests points for your staff to review.
The last three involve a person, and they can still count. The rule covers a program that does something substantially and directly related to making a decision, not only one that decides on its own. A suggested risk rating is a clear case: one of the examples in the OAIC's APP Guidelines on this rule is a risk score.
Whose privacy policy has to say it?
Yours. The OAIC's APP Guidelines expect the duty to sit with the business that uses the personal information to make the decision. When your firm decides whether to act for a client and what rating to give them, that business is your firm, even though the software belongs to a provider.
The guidelines also suggest that contracts say who keeps the final decision-making. Check that your software provider's terms say your firm makes the decisions about its clients, and that your staff can override what the software suggests.
What to add to your privacy policy: six steps
- List your tools. Every program that makes, or substantially and directly feeds, a decision about a client: identity verification, screening, risk rating and any AI.
- List the personal information each one uses, for example identity details, ID document images and selfie, questionnaire answers and screening results.
- Describe the kinds of decisions. Say which the software makes on its own (such as an identity check that passes or fails) and which a person at your firm makes using the software's results.
- Say how a client can ask about a decision. Our example below tells clients they can ask for an explanation, or for a person to look at it again, using the contact details in your policy.
- Check your provider's terms say your firm keeps the final decision.
- Publish the updated policy before 10 December 2026, and replace older copies on your website, in your office and in onboarding packs.
Our guide to the Privacy Act for AML/CTF reporting entities covers what else a privacy policy must contain, and the OAIC privacy checklist for AML/CTF firms shows where the policy fits among the other steps.
An example automated decisions paragraph for your privacy policy
This is the paragraph CompliDesk gives firms for their privacy policies, with our name taken out. Change it so it describes the tools your firm actually uses: if you use no AI, delete that line, and if a person decides every identity check, say so.
Decisions made with the help of computer programs
We use compliance software to help us meet our obligations under the AML/CTF Act. Some of what it does is automated, and its results are a key input into decisions we make about you: whether we can provide a service to you, the money laundering and terrorism financing risk rating we give you, and whether we need more information from you.
The software uses your identity details (such as your name, date of birth and address), your ID document and selfie, the answers you give in our client questionnaire, and the results of screening, to:
- compare you with the Australian sanctions list and, through an identity verification provider, with politically exposed person (PEP), sanctions and adverse media lists, and flag a possible match for us to review;
- check your identity document and compare your selfie with it, through an identity verification provider whose software passes or fails the check, or refers it to a person to review;
- work out a suggested risk rating from your answers, your identity check and the screening results; and
- use artificial intelligence to read documents you give us and to suggest points for us to review.
The identity verification provider's software decides whether your identity check passes, unless it refers the check to a person. For everything else, a person at our firm reviews the results, makes the decision, and can override what the software suggests. You can ask us to explain a decision, or to have a person look at it again, using the contact details in this policy. In some cases the law does not allow us to explain a decision.
This wording has not yet been tested with the OAIC or a court. Read it against what your firm really does, and take advice before you rely on it.
Two cautions
Explaining a decision must not tip anyone off. The OAIC reminds reporting entities that any use or disclosure of personal information must not be inconsistent with their obligations under the AML/CTF Act, including the prohibition on tipping off (section 123). If a client asks why they were rated High, or why you need more information, never reveal that a suspicious matter report exists or that there is a suspicion. Speak to your compliance officer first. Our post on access requests and tipping off covers the same limit when a client asks to see their file.
Do it on time. From 10 December 2026, if the rule applies to your firm, a privacy policy without this section does not meet APP 1, and the OAIC can issue an infringement notice for a policy without it (Privacy Act s 13K).
How CompliDesk helps
Not using CompliDesk? Our free privacy policy generator writes a privacy policy and collection notice for an AML/CTF firm, including this section, from the tools you tick. No sign-up, and nothing you type into it leaves your browser.
Every privacy policy the CompliDesk Privacy Hub writes includes a section on decisions made with the help of computer programs, and the Hub shows the paragraph so a firm with its own policy can copy it. If you downloaded your policy from the Privacy Hub on or before 10 November 2026, download it again (the Hub shows that step as not done until you do): it was made before this section was added, and a downloaded policy does not update itself.
Inside CompliDesk, the software suggests a risk rating and flags possible screening matches, and your staff review, save or override them. The Privacy Hub also takes you through the rest of the set-up in five steps, from your privacy policy and collection notice to the OAIC's 14-question checklist. It is included in every CompliDesk monthly plan at no extra cost. See pricing, book a demo, or read the full Privacy Act compliance guide.
A privacy policy that already explains your software
The CompliDesk Privacy Hub writes your privacy policy with the automated-decisions section in it, ready for 10 December 2026. Sign up free today.
Get Started FreeFrequently Asked Questions
This article is general information, not legal advice. Related reading: Privacy Act compliance for AML reporting entities · Collection notices for KYC clients · OAIC privacy checklist for AML/CTF firms · Customer due diligence explained · PEP screening guide