How to write an automated decision-making (ADM) transparency statement

An ADM transparency statement is the section of your privacy policy that tells people which decisions about them your computer programs make, or substantially help a person make, and what personal information those programs use. Australian Privacy Principles 1.7 to 1.9 ask for this disclosure wherever a decision could significantly affect someone’s rights or interests. The wording is the part most people get stuck on, and it is the easier half. This guide gives you the structure and three worked passages so you can see adequate and inadequate disclosure side by side. The harder half, which the worked examples point back to, is knowing which decisions to disclose and keeping that current as your systems change.

What APP 1.7 to 1.9 actually require

From 10 December 2026, an organisation that has arranged for a computer program to make a decision, or to do something substantially and directly related to making it, has to set this out in its privacy policy. The obligation was added to APP 1 by the Privacy and Other Legislation Amendment Act 2024, and the OAIC published its final guidance on it on 30 September 2026.

APP 1.7 names the trigger, which has three conditions. A computer program makes the decision or does a thing substantially and directly related to making it. The decision could reasonably be expected to significantly affect the rights or interests of an individual. Personal information about the individual is used in the operation of the program. APP 1.8 says what the privacy policy must contain. That is the kinds of personal information used in the operation of those programs, the kinds of decisions made solely by the operation of a program, and the kinds of decisions where a thing substantially and directly related to making the decision is done by a program. APP 1.9 clarifies the terms. A decision includes refusing or failing to make one, and a decision counts whether it affects a person adversely or beneficially.

Read together, the practical effect is that your privacy policy has to make three things clear. The kinds of decisions your systems make on their own. The kinds of decisions your systems substantially help a person make. The kinds of personal information those systems use. You are not required to publish the model, the source code or a technical specification. You are required to be clear about what is decided, on what information and how automation is involved. The OAIC’s examples of decisions that can significantly affect rights or interests include granting or refusing a statutory benefit, decisions affecting rights under a contract such as an insurance policy, decisions affecting access to a significant service such as healthcare, and personalised pricing or targeting that limits access to significant goods, services or employment.

The obligation is about transparency. It does not on its own give a person a right to contest an automated decision or to request an explanation of one.

Fully-automated and substantially-assisted are both in scope

One distinction does more work than any other when you write this statement, and getting it wrong is the most common way a disclosure goes thin.

A fully-automated decision is one a system reaches and applies with no person in the loop. An application is scored and declined, and the outcome takes effect, without anyone reviewing it. A substantially-assisted decision is one where a system does the substantive work and a person signs off on the result. A model ranks, scores or recommends, and a person approves what the model produced rather than reaching the decision independently.

Both are in scope, and APP 1.8 names them as separate categories. One is decisions made solely by the operation of a program. The other is decisions where a program does something substantially and directly related to making them. A person clicking approve at the end does not move a decision out of scope if the system did the deciding. The OAIC’s guidance says the obligation can apply where the output is subject to human review, and that even an advisory output counts where the person relies on it or is significantly influenced by it. The line that matters is whether the human adds independent judgement or rubber-stamps the output. If the system substantially shapes the outcome, it is disclosable, even with a person at the end. A person who only used software to draft a document is not captured. The worked examples below show how this changes the wording.

How to structure the disclosure in your privacy policy

Put the statement inside the privacy policy as a clearly headed section, not a separate page or a downloadable annex. APP 1 governs the privacy policy, so the disclosure has to live there to do its job.

Organise it system by system, or by kind of decision where several systems make the same kind. For each one, cover the three required elements in plain order. What kind of decision is made. What kinds of personal information are used. How the system is used to reach the decision, including whether it is fully automated or a person reviews the result. Keep each passage short and specific. A reader should be able to tell what your organisation decides about them by automation, and you should be able to point to the system behind every sentence.

Worked example one: a fully-automated decision

The first example is a lending decision made with no person in the loop. Compare the two passages.

Inadequate:

We use advanced technology and data analytics to deliver fast, accurate outcomes and to improve our services. Automated tools may be used as part of our processes.

This says nothing a reader can use. It names no decision, no information and no effect. It describes a stance toward technology rather than disclosing an automated decision, and it would leave a person no wiser about whether a decision about them was automated.

Adequate:

We use an automated system to decide whether to approve or decline applications for a personal loan. The decision is made by the system without a person reviewing it. The system uses the personal information you provide in your application, your stated income and the information in your credit report. Where your application is declined by this system, you can ask us to review the decision.

This passage names the decision, states that it is fully automated, lists the kinds of personal information used and gives the reader a route to a person. It maps directly onto what APP 1.8 asks for.

Worked example two: a substantially-assisted decision

The second example is the case people most often get wrong. A model does the substantive work and a staff member approves the result. The temptation is to describe this as a human decision and leave it out. If the system substantially shapes the outcome, it is in scope.

Inadequate:

All decisions about claims are made by our trained assessors. We may use tools to help our staff work efficiently.

This passage uses the human sign-off to imply the decision is not automated. If the model produces the assessment and the assessor approves it, the decision is made substantially by automated means and this wording understates the system’s role. It discloses nothing about the personal information used or the kind of decision reached.

Adequate:

We use an automated system to assess claims and recommend whether a claim is accepted, declined or referred. A claims assessor reviews each recommendation before it takes effect and can change the outcome. The system uses the information in your claim, your policy details and your claims history to produce its recommendation. You can ask us how a decision about your claim was reached.

This passage is accurate about the division of work. It states that the system does the assessment and a person reviews the result, which is the substantially-assisted case, and it covers the kinds of decisions and the kinds of personal information as APP 1.8 requires.

Worked example three: scope of personal information

The third example shows a passage that is clear about automation but thin on the information used. Adequate disclosure has to cover the kinds of personal information, not just the existence of the system.

Inadequate:

We use an automated system to prioritise applications for housing assistance. The system uses your personal information to do this.

This names the decision and the automation, which is a start, but “your personal information” tells a reader nothing about the kinds of information involved. APP 1.8 asks for the kinds of personal information used, so a single catch-all phrase does not meet it.

Adequate:

We use an automated system to prioritise applications for housing assistance and to decide the order in which applications are assessed. This prioritisation significantly affects how quickly you are assisted. The system uses the information in your application, your stated circumstances, your household composition and information we hold about your prior contact with us. A person can adjust the priority where your circumstances are not captured by the system.

This passage gives the reader the kinds of information used and is specific about the effect of the decision, which is what carries it from describing a tool to disclosing an automated decision.

The statement is not write-once

The deadline is why you write the statement now. Keeping it true is the work that continues after. A transparency statement reflects the systems your organisation runs at the moment it is written. Organisations add automated-decision systems, change how existing ones work and retire others. Each of those events can make the statement wrong in a way that is quiet and easy to miss. The policy can keep claiming to disclose a decision that has changed, or it can fall silent on a new system that should now be named.

This is why the prose is the easy half. Once you can see the three worked patterns above, writing an adequate passage is mostly mechanical. The hard half is knowing which decisions are in scope today and noticing when that set changes, because that is what keeps the statement accurate rather than just well written. A statement that was correct in December and wrong by March is the failure mode to design against.

Where Aicura fits

Knowing which decisions to disclose comes from reconciling the privacy policy against a current record of your systems. In Aicura that record is the AI register, where each system’s record carries what the system produces, whether it affects individuals and its level of human oversight. The Privacy tier reviews your policy against APP 1.7 to 1.9, names the registered systems whose decisions the policy does not yet cover and drafts language you can use.

When a system is added or changed, the review runs again and shows what the policy no longer covers. The draft is a starting point, and the wording you publish stays your decision.

Where to go next

Work out what belongs in scope before you write a word, since that is the input every passage above depends on. The framework page on automated decision-making under the Privacy Act sets out how APP 1.7 to 1.9 define a decision that significantly affects a person, how to triage your systems against it and what changes on 10 December 2026.

One caution on the worked examples. They are illustrative passages rather than legal templates, written to show the difference between adequate and inadequate wording, and using one does not make an organisation compliant with anything. Where a decision is finely balanced, or the stakes are high, take your own advice against your specific facts.

---

A note on this page

This guide explains what the rules require and how to do the work. It is general information, not legal advice. How the obligations apply turns on your own circumstances, so read the primary source and take your own advice before you rely on it.

Aicura does not certify, audit or issue a compliance verdict, and it does not produce a score. That decision belongs to your organisation and its people.

Primary source: OAIC, APP Guidelines Chapter 1 (APP 1), updated for APP 1.7 to 1.9