Privacy Act · APP 1.7 to 1.9
Software for the Privacy Act automated decision-making (ADM) disclosure obligation.
From 10 December 2026, APP 1.7 to 1.9 require your privacy policy to disclose the automated decisions that significantly affect people. Aicura keeps the register of your AI systems, reviews your privacy policy against those rules and shows which registered systems it does not yet disclose.
Aicura provides support and guidance. It does not certify your policy or tell you that you are compliant.
The obligation
What you have to do.
The obligation is narrow and specific. From 10 December 2026, the Australian Privacy Principles require your privacy policy to set out where you use automated decision-making that could significantly affect the rights or interests of an individual.
The work has three parts. The first two are a project you can finish before December. The third continues as your systems change, and that is the part Aicura is built to support.
The Privacy Act ADM framework page explains who the obligation applies to and what a significant effect means. The guide to writing an ADM transparency statement works through the wording with examples.
Know your automated decisions
Know which of your systems make, or substantially help make, decisions about people. A decision counts when it has a real effect on someone, such as whether they get a loan, a job, a price or a service.
Say so in your privacy policy
Describe the kinds of decisions those systems make and the kinds of personal information they use. The disclosure lives in your privacy policy, where people can read it.
Keep it current
The policy has to match what you actually do. Every time you add or change an automated decision system, the disclosure has to keep up or it stops being true.
In Aicura
How the work runs.
Five steps from an empty register to a published policy that stays in step with your systems. Each step names the plan it starts on.
- 01Register, free
List your AI systems
Add the systems your organisation uses. Most vendor products are already in Aicura's library, so adding one means checking details that are already filled in rather than starting from a blank form.
For systems built in-house, download the helper document, have the people who built the system complete it and upload it to add the system to your register. Discovery can also surface AI already in use from the cloud, device, code and service desk sources you connect. The dashboard counts down to 10 December 2026 until the date passes.
- 02Privacy
Review your privacy policy
Upload your current privacy policy. Aicura reviews it against what APP 1.7 to 1.9 ask you to disclose and against the systems in your register, and returns specific recommendations rather than generic advice.
Each policy keeps its versions and its full review history, so an earlier round of recommendations stays beside the new one.
- 03Privacy
Draft the disclosure
For each registered system the policy does not yet cover, the review suggests wording drawn from what the register records about it. That covers which decisions it makes, whether a person reviews them and the kinds of personal information it uses.
On Essentials and above, each system in the register can also carry an AI-generated decision disclosure that your team reviews and accepts, and the AI Transparency Statement is one of the governance policy types Aicura drafts and reviews.
- 04Privacy
Work through legal review
Most organisations send the draft to internal counsel and then to external counsel, who usually comment on phrasing and on what counts as automated where a person sits in the process.
When their feedback changes what you record about a system, update that system's details in the register and run the review again. The new round reflects the change, so nobody rewrites the disclosure from scratch.
- 05Privacy
Publish, then keep it true
Your web team publishes the updated policy when your organisation is satisfied with it. Aicura does not publish anything for you.
After that the work is ongoing. When a system is added to the register or changed, Aicura notifies you, and you decide when to run a fresh review of the policy.
What a register alone does not show.
You can hold a complete AI register and a published privacy policy and still not know which systems the policy leaves out. The register records what you run and the policy records what you disclose. Neither one shows where the two disagree.
Aicura reads both sides and names the difference, meaning the registered systems that make automated decisions and are not yet in your privacy policy. A manual review does this once, for the day it is done. Aicura keeps both in one place so the comparison can be run again whenever something changes.
Why this is a subscription, not a one-off fix.
December 2026 is a real reason to act now. But the disclosure is not a document you finish once and file away.
You will add automated decision systems, retire old ones and change what existing ones do. Each change can pull your privacy policy out of step with what you run, so a disclosure that was true in December is not automatically true a quarter later.
The subscription is the ongoing work that keeps the disclosure current, rather than a fix you cancel in January.
Questions
Do I have to disclose AI in my privacy policy?
Yes, where your organisation uses a computer program to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect a person's rights or interests, using their personal information. From 10 December 2026, APP 1.7 to 1.9 require the privacy policy itself to describe the kinds of decisions and the kinds of personal information involved.
Does a person reviewing the decision take it out of scope?
Not on its own. A system that does the substantive work, with a person approving the result, can still be in scope. What matters is whether the system's output carries real weight in the outcome. The more the person relies on it, the more likely the decision is in scope. The framework page sets out the test in full.
Does Aicura make my organisation compliant?
No. Aicura provides support and guidance. It does not certify you, audit you or tell you that you are compliant. It helps you find and disclose your automated decision systems and keeps that disclosure in step with your register as things change. The decision about your privacy policy stays with you.
What exactly does Aicura review?
Your privacy policy, against what APP 1.7 to 1.9 ask you to disclose. It also compares your AI register with the policy and shows the registered automated decision systems the policy does not yet mention.
Is this only useful before 10 December 2026?
No. The deadline is why most people start, but the disclosure has to stay true as you add and change automated decision systems. Aicura notifies you when the register changes so you can review the policy again.
How is this different from hiring a privacy consultant?
A consultant's review is accurate on the day it is delivered and starts to date when your next system ships. Aicura keeps the register and the policy side by side as standing work, so the comparison can be run again whenever your systems change.
Does Aicura give me a compliance score?
No. The privacy policy review does not compute scores, ratings or traffic-light verdicts. It names the specific systems that are not disclosed and suggests wording you can use, and you decide what to do.
This page explains how Aicura supports disclosure work under the Australian Privacy Principles. It is general information and not legal advice. The authoritative sources are the Privacy Act 1988 (Cth), the Australian Privacy Principles and the guidance of the Office of the Australian Information Commissioner.
Keep the disclosure true after December.
Start with the systems your privacy policy does not yet cover, and keep the policy in step with your register as your organisation changes.