OAIC explains the 10 December automated decision rule

5 min read · 19 October 2026

The rule that moved: the OAIC explains the 10 December automated decision rule

Hello, this week's theme is a deadline with new detail attached. The OAIC has published its final guidance on the automated decision transparency rule that starts on 10 December 2026, and it reads more broadly than many owners expect. No new rule took effect this week, but with about seven weeks to go, this is the one to work on. If you missed it, last week's edition is still up.

What the guidance says

From 10 December, an organisation that is an APP entity under the Privacy Act must describe three things in its privacy policy: the kinds of personal information a computer program uses in decisions, the kinds of decisions the program makes on its own, and the kinds of decisions where it substantially and directly supports a human decision. It applies to decisions that could reasonably be expected to significantly affect the rights or interests of a person. The detail is in the OAIC fact sheet on APP 1.7 to 1.9.

The guidance treats "computer program" widely. According to the OAIC, it covers rule-based software, AI and machine learning, and generative AI, and a human reviewing the output does not take a decision out of scope. One of the OAIC's own examples is a spreadsheet that ranks people for services. Another is generative AI reports used when deciding bonuses. Where a business is unsure, the OAIC advises taking a cautious approach.

Responsibility generally stays with the business even when the software comes from a vendor, although vendors are expected to supply high-level information. Commercial-in-confidence detail, such as how a fraud tool weights its signals, can be withheld. The personal information the tool uses cannot.

What this means for your business: first work out whether the Privacy Act applies to you, using the reference page on whether the Privacy Act applies. If it does, list every tool that scores, ranks, approves or screens people, such as hiring, pricing, credit, eligibility or bonuses, and read the reference page on the 10 December rule.

Tool changes that affect your client data

Microsoft 365 Copilot memory is on by default

Microsoft's documentation says Copilot memory, currently in preview and subject to change, keeps three kinds of information: memories a person asks Copilot to keep, details inferred from chat history, and custom instructions. The Enhanced personalization control that gates it is on by default, and Microsoft states that no action is needed to turn it on. Memories are stored in a hidden folder in the user's Exchange mailbox. The source is Microsoft Learn.

The limits are the part an owner should read twice. Per Microsoft, Purview retention policies and labels do not apply to Copilot memory, there are no admin controls to enforce retention rules for it, memory actions are not logged in Purview, and admins cannot restrict what type of information is added. Deleting a chat does not delete a memory generated from it. Admins can search, export and delete memory data using eDiscovery and Microsoft Graph Explorer.

In practice, if a staff member types a client's details into Copilot Chat, a memory generated from that chat can outlive the chat, and you may not see it in your logs. I did not confirm any change this week from a primary source for Google Workspace, ChatGPT, Xero or MYOB, so none is listed.

What this means for your business: ask whoever manages your Microsoft 365 whether Enhanced personalization is on, decide whether you want it on, and write the decision down. Then tell staff which client details never go into any AI chat. See which AI tools can hold client data and staff using free AI tools.

Scams to brief your staff on

Supplier payment redirection

Scamwatch describes business email compromise, also called payment redirection, as scammers posing as a business you have dealt with and sending an invoice with new payee details. Its warning signs include payee details that change without notice and an email address that is slightly off. In a media release dated 6 October 2026, ANZ listed business email compromise, impersonation and invoice scams among the main risks for organisations of all sizes and said criminals are using AI-enabled deception.

My inference, not a finding, is that polished AI writing removes the spelling mistakes staff were once taught to look for. The control does not depend on spotting a bad email. It depends on a step that an email cannot fake.

Scamwatch advises stopping to check any change to payee information and calling the business on a number you found yourself, not one in the email. ANZ adds confirming supplier banking changes by phone and requiring two authorisations for payments.

What this means for your business: write a one-line rule: no bank detail changes from an email alone, a call-back goes to a number already on file, and two people approve the payment. If a mailbox was actually compromised, that can also raise a breach question, so keep is it a data breach handy, and the rest of the reference pages sit in one place.

One thing to decide this week

Pick one AI use in your business that you are least sure about. It might be a tool that screens job applicants, a chatbot that answers customers, or a staff member using an AI assistant on client files. Then answer one question about it: where does the information go, and who is responsible if it goes wrong?

What this means for your business: run that single use through the twelve-question check and note the result next to the tool's name. That note is the start of the list the 10 December rule asks you to build, and it works as a basis for an AI policy later.

The bigger picture

ASIC's media release of 17 August 2026 said scammers are using generative AI to build networks of deepfake websites and endorsements, and that AI is making investment scams more convincing and harder to detect. Two figures from that release show the scale.

Put the week together and the thread is the same. The automated decision rule asks you to know where software helps decide things about people. Copilot memory shows information can be kept in places you did not choose. The scam advice shows that a believable message is no longer evidence of anything. Each one comes back to knowing where your information and decisions go, and writing it down.

Whether the Privacy Act applies to your business depends on factors such as turnover and what you do with personal information, so check rather than assume. Nothing here makes a business meet or miss an obligation by itself. It tells you which rule is in play so you can make the call or hand it to your adviser.

What this means for your business: if you are a bookkeeper, accountant, broker or IT provider, expect clients to ask about these three items before December. The overview of Australian AI frameworks and the Limitless AI Framework are a place to point them.

That is the week. If one thing in here applies to you, the reference pages say which rule it falls under and link the source, so you can act on it or hand it to your adviser.

More on this: the reference pages · the Limitless AI Framework · something else in mind

See you next Monday.
Ashley

General information for Australian small to medium businesses, not legal advice. Sources are linked in the text.