If you’re using AI in your business, two pieces of government material from the past few weeks are worth knowing about. One is a legal deadline that applies to some businesses. The other is practical advice that applies to everyone.
What happened
A privacy rule starts on 10 December 2026. On 30 September 2026, the Office of the Australian Information Commissioner (OAIC) published resources on a new transparency obligation. It was introduced by the Privacy and Other Legislation Amendment Act 2024 and sits within APP 1 of the Australian Privacy Principles. From 10 December 2026, an organisation covered by the Privacy Act must update its privacy policy if three things are true:
- it has arranged for a computer program to make a decision, or do something substantially and directly related to making one;
- the decision could reasonably be expected to significantly affect someone’s rights or interests; and
- the person’s personal information is used in the process.
If all three apply, the policy must describe the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds of decisions the program helps make. The OAIC has published a fact sheet, a flowchart and updated APP 1 guidelines.
Does it apply to you? The OAIC says most small businesses (annual turnover of A$3 million or less) aren’t covered by the Privacy Act. Some are covered regardless of turnover, including health service providers and businesses that trade in personal information. The OAIC has a checklist to help you work out where you stand.
New advice on using AI securely. On 7 October 2026, cyber.gov.au published a “Using AI securely in your business” chapter in its small business cyber security handbook. It advises against sharing passwords, financial details or confidential data with AI tools, and against relying on AI output without checking it. It also says to know where your data is stored, especially if that’s outside Australia. On AI agents, it says to give them only the minimum access they need and not to let them approve transactions, send communications or change business data without your oversight. It also warns that scammers are using AI to make fake invoices, phishing emails and cloned voices more convincing.
Training for SMEs. The National AI Centre and NAB have also run an online AI for Business Masterclass from 20 October 2026, with a workbook built around the National AI Centre’s six essential practices. These include deciding who’s accountable, testing before relying on a tool, and keeping a person in control of important decisions.
What it means for a small business
If the Privacy Act covers you and you use software to make or shape significant decisions about people, such as approving credit, setting a price for an individual, screening job applicants or suspending an account, check your privacy policy before 10 December. If it doesn’t cover you, the cyber.gov.au advice is still good practice, and it lines up with how I’d set up any AI automation for a small business.
What to do next
- Run the OAIC small business checklist to see whether the Privacy Act covers you.
- List every AI tool you use, what it does and what data goes into it.
- Flag anything that decides things about people. If you’re covered, that’s what your privacy policy needs to describe.
- Tighten access for any AI agent to the minimum it needs, and keep a person approving payments and outgoing messages.
- Brief your staff on AI-powered scams, especially fake invoices.
Not sure where your setup stands? Get in touch and I’ll help you map your AI tools. For legal questions about your obligations, talk to your lawyer or industry association.