Before December, find every customer decision your AI is quietly shaping
From 10 December, many Australian businesses must explain where computer programs make or substantially inform significant decisions. Start mapping them now.
From 10 December, many Australian businesses must explain where computer programs make or substantially inform significant decisions. Start mapping them now.
The decisions you did not know you delegated
Ask a business owner whether AI makes decisions about their customers and the first answer is often no. We use it for emails and summaries, not decisions.
Then walk through a normal week.
The CRM scores leads and the sales team only calls the top tier. A tool flags some customers as high risk and their orders get held for review. An AI assistant drafts responses to hardship or refund requests, and staff mostly send them as written. A screening tool ranks job applicants before anyone reads a CV. A pricing tool suggests which customers get a discount.
None of those feel like "AI deciding". But each one shapes an outcome that matters to a real person.
What changes on 10 December
The Office of the Australian Information Commissioner (OAIC) published new resources on 30 September about a transparency obligation that starts on 10 December 2026.
From that date, APP entities must include information in their privacy policy where they have arranged for a computer program to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, and personal information is used in the process.
Where that applies, the privacy policy needs to describe the kinds of personal information used, the kinds of decisions made solely by computer programs, and the kinds of decisions where a program does something substantially and directly related to making the decision.
The OAIC has published a fact sheet, a flowchart and updated APP 1 guidelines to help.
Does this apply to you?
This is not legal advice, and you should check your own position.
The obligation applies to APP entities under the Privacy Act. Many small businesses with an annual turnover of $3 million or less are not APP entities, although there are exceptions, such as businesses that provide health services or trade in personal information. If you are unsure, the OAIC resources and your adviser are the place to start.
But even if the rule does not apply to you, the exercise is worth doing. If you cannot list where software is shaping customer outcomes, you cannot check whether it is doing it fairly, accurately or the way you intended.
How to map the decisions your AI shapes
You do not need a consultant to start. You need a list and some honest conversations.
- List every tool that touches customer or staff data. CRM, helpdesk, accounting, marketing, recruitment, AI assistants, automations. Include the small ones.
- For each, ask what it decides or influences. Does it approve, reject, rank, score, prioritise, price or route anything about a person?
- Ask how much people rely on it. Is a human genuinely reviewing each outcome, or mostly accepting what the tool suggests? Be honest. A rubber stamp is not the same as a review.
- Ask what is at stake for the person. Access to credit, a refund, a job, a price, a service level. The bigger the impact, the more it matters.
- Note what personal information goes in. Names, purchase history, location, financial details, anything sensitive.
- Write it down in one place. A simple table is enough: tool, decision, human role, impact, data used, owner.
That table is the raw material for any privacy policy update, and for a better question: are we comfortable with how these decisions are being made?
What to do with what you find
Once you have the map, a few things usually follow.
- Some decisions need a real human review step, because the impact is too high for a tool to decide alone.
- Some tools need better information, because they are working from out-of-date or incomplete data.
- Some workflows need an owner, because nobody is accountable for how the tool's suggestions are used.
- Your privacy policy may need updating, if you are an APP entity and the obligation applies.
Do it now rather than in the second week of December, when everyone is chasing end-of-year work.
Questions to ask this month
- Which tools in our business rank, score, approve or reject anything about a customer or applicant?
- Where do staff mostly accept the tool's suggestion without changing it?
- Are we an APP entity, and have we checked?
- Who owns keeping this list up to date as we add new AI tools?
How Walter approaches it
At Walter, I think every decision that affects a person should be traceable: what information was used, what the system recommended, who made the call, and why. That is good operating practice regardless of what the law requires.
The December deadline is a useful prompt. Use it to find the decisions your AI is quietly shaping, give each one an owner, and make sure you would be comfortable explaining any of them to the customer on the other end.
Join the waitlist at https://hirewalter.ai/
