A new privacy rule lands in December. Most business owners haven't heard of it.

From 10 December 2026, if your business turns over more than $3 million a year and you use software that makes, or significantly helps make, a decision affecting someone's rights or interests using their personal information, you have to say so in your privacy policy. Not tucked away, not implied. Stated.

This covers more everyday decisions than people expect: a hiring shortlist, a quote that adjusts based on someone's history, a warranty claim assessed by a tool before a person looks at it, a complaint triaged by a chatbot before it reaches a real person. Anywhere personal information feeds into a decision and software does real work shaping the outcome. Plenty of small and mid-sized businesses are already doing this without realising it counts.

And when you do look into it, don't assume a human review clears you. The government's own guidance on this says that if a program's output is a key factor in a human's decision, even just recommending or guiding them, it still counts. Their own example: a formula that triages calls to a crisis hotline, helping decide who gets attended to first, counts, even though a person makes the final call. A formula that just works out someone's age from their date of birth doesn't, because it's not doing enough of the real work.

Their guidance on exactly what 'significantly assists' means is still being finalised, expected some time in September, so nobody has the full picture today. What's already locked in is the date and the threshold: 10 December, $3 million turnover. If you're above that line, this is worth getting ahead of now rather than in November. The EU has its own AI rules now too, worth getting familiar with if you sell into that market.

The practical thing you can do right now, before this forces your hand, is build a register. Not a legal document, just a simple list: every AI tool used in your business, what it does, who uses it, what kind of account it's on, and who's accountable for it. That last part matters more than people think, but a register only works if you actually ask your team what they're using first. That's the missing step in last month's accounting example, nobody asked. This isn't only about clearing the $3 million threshold either. Knowing what AI tools are actually touching your business matters whether the December rule covers you or not. The National AI Centre has free templates for both the register and the policy so you're not starting from a blank page.

A register also does the quiet work of answering the December question before anyone asks it. If you already know exactly what AI tools touch your customers' information and how, writing the disclosure is a formality. If you don't, you're starting from zero in November with a deadline bearing down.

Start the list this month, it's the cheapest insurance you'll buy all year. Thank me later.

Common questions

When does the new privacy rule start?

10 December 2026.

Which businesses does it apply to?

Businesses turning over more than $3 million a year that use software which makes, or significantly helps make, a decision affecting someone's rights or interests, using their personal information.

Does having a human make the final decision let my business off the hook?

No. The government's own guidance says that if a program's output is a key factor in a human's decision, even just recommending or guiding it, it still counts.

What kinds of decisions actually count?

More than most people expect: a hiring shortlist, a quote adjusted by someone's history, a warranty claim assessed by a tool before a person looks at it, a complaint triaged by a chatbot before it reaches a real person. More details to be released soon.

What can I do now, before December?

Build a register: a simple list of every AI tool used in the business, what it does, who uses it, what kind of account it's on, and who's accountable for it. The National AI Centre has free templates for both the register and the policy.

If you're in Cairns or FNQ and want to talk through where your business is at, book a call.

Kate Fabian is the founder of Adoptech, a Cairns-based technology and AI adoption consultancy. She works with business owners across Far North Queensland on AI strategy, implementation, and training.

Sources: Privacy and Other Legislation Amendment Act 2024 (APP 1.7–1.9). OAIC ADM Issues Paper, May 2026. EU AI Act, extraterritorial scope provisions. National AI Centre, Essential AI Practices and AI Systems Register template, ai.gov.au.