From 10 December 2026, Australian businesses that use a computer program to make or inform decisions about customers, known as automated decision-making or ADM, may need to disclose that use in their privacy policies.
For financial services and fintech businesses, including insurers, lenders, underwriting agencies, financial advisers, insurance and mortgage brokers, who regularly use technology in the delivery of these services, now is the time to assess how you are using ADM in your business.
The Office of the Australian Information Commissioner (OAIC) has confirmed in its guidance that the ADM obligation reaches well beyond artificial intelligence (AI). It extends to a broad range of computer programs, including rules-based underwriting engines, credit scoring tools, advice recommendation engines, scoring tools, pricing and discount algorithms which already sit at the centre of decision-making for insurance, credit and financial services.
What you need to know
- The disclosure obligation, under new Australian Privacy Principles (APPs) 1.7 to 1.9, comes into effect on 10 December 2026. Privacy policies need to be updated by this date, but this is more than a simple policy wording update.
- ADM includes a broad range of computer programs, not just AI. This includes computer programs involved in assessing an individual’s eligibility for insurance and to approve or reject a loan or credit application as categories generally within scope.
- It doesn’t have to be fully automated, a human involved in an underwriting, lending, advising or a claims outcome does not automatically take the process out of scope; what matters is whether the program’s output is a key factor the person relies on to make a decision or inform the decision about an individual.
- The updated APP 1 Guidelines give a dedicated insurance example confirming that fast, software-driven policy decisions trigger the obligation.
- Outsourcing underwriting, fraud prevention technology, claims or other such decision-making processes to a vendor does not shift responsibility for ADM transparency, which stays with the APP entity that arranged for the computer program to make or inform the decision.
- Guidance from the OAIC is that if there is doubt as to whether the use of a computer program falls within scope of the disclosure obligation, APP entities should take a cautious approach and include information in their privacy policy.
Background: the new transparency obligation
The ADM transparency obligation is about privacy policy disclosure. It is not, of itself, a restriction on the use of ADM, nor does it create a general right for an individual to require an explanation or a human review of every automated decision. Instead, it is intended to give consumers access to the information about ADM that involves the use of personal information about them. This could, of course, then be used by the individual to exercise access and correction rights, or make a privacy complaint, under the Privacy Act and enable the individual to contest a decision, including through the Australian Financial Complaints Authority, or under sector-specific codes such as the General Insurance Code of Practice.
For details about the background of the new obligations, read our article Transparency in automated decision-making: What regulated entities need to know and do before December 2026.
How to assess what must be disclosed and why it catches more than AI
An APP entity must include the prescribed information in its privacy policy where all three conditions in APP 1.7 are satisfied.
- First, the entity has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision; and
- Second, the decision could reasonably be expected to significantly affect the rights or interests of an individual; and
- Third, personal information about the individual is used in the operation of the program to make the decision or do the thing.
A “computer program” is not defined in the Privacy Act and is intentionally broad. It covers pre-programmed rule-based processes, artificial intelligence and machine learning, ordinary software, apps and word-processing tools, and generative AI, including chatbots.
A rules-based underwriting engine or a scoring spreadsheet is within scope alongside any machine learning or generative AI tool.
Computer programs and platforms used for assessing applications and issuing quotations for insurance involve the kind of decisions within scope of the transparency obligation (where the above three criteria are met), alongside online loan and credit applications and approvals, automated responsible lending assessments and robo advice.
The OAIC expressly calls-out “computer programs used to approve or reject loan or credit applications” and “computer programs involved in assessing an individual’s eligibility for insurance” as examples of decisions that are within scope of the ADM disclosure obligation under APPs 1.7 – 1.9.
The updated OAIC APP 1 Guidelines further provide a life insurance example: “Life Insured, a life insurance company, introduces automated decision-making software that lets staff enter an applicant’s personal information and receive an accept or decline decision on a life insurance policy within ten seconds”. The Guidelines conclude that although the software improves efficiency, Life Insured must update its privacy policy under APP 1.7 because the software has a significant effect on the applicant’s rights and interests.
The three-limb ADM test applied to the financial services industry
The table below walks through six examples where a computer program commonly makes or informs a decision s applying the three-limb test from APP 1.7 to each. These are illustrative applications of the test, not conclusions about any particular business or product, and each business should work through its own systems against the same three conditions.
| Insurance underwriting and pricing | Claims assessment |
| An underwriting engine might use an applicant’s age, occupation, claims history or health information to present a quote and calculate the premium. If the output determines access to cover or materially influences the terms offered, it may involve ADM. A pricing tool’s significance turns on what it does with the individual’s information and the effect of the resulting decision, not on whether the underlying logic is AI or a set of underwriting rules. | A program might analyse a claimant’s documents and recommend acceptance, rejection or a settlement amount. An example being an insurer whose computer program determines whether to reject a claim and gives the claims officer a rejection decision without explaining which information drove it. Even without an explicit recommendation, a tool that selects or extracts information which materially steers the assessor’s conclusion can be ADM requiring disclosure under APP 1.7. |
| Lending and credit decisions | Renewal and retention systems |
| A lender or credit provider might use a computer program to generate a credit risk score or serviceability assessment for an individual to review, approve, decline or set conditions on a loan or credit application. Where the loan officer relies heavily on the score and rarely departs from it, the output is likely to be substantially and directly related to the decision to grant a loan or credit, even where a human signs off on the decision. | A renewal system might use a customer’s personal information collected through a computer program to identify whether the insurer will recommend changes to the insurance terms or whether to offer renewal at all. At renewal time a broker might use an app to compare different policies from different providers and populate the app with a client’s personal information to match them to a policy that is suitable for their needs. |
| Financial advice and product recommendations | Fintech & payments |
| A financial adviser might rely on a computer-generated risk profile, suitability score or investment product ranking when preparing an advice strategy for an individual client, including when recommending an investment and comparing fees and performance based on the client’s personal circumstances. Where that profile or ranking materially steers the advice given, for example, the product or service the client holds, and this has a significant impact on the rights or interests of the individual (even if beneficial) even where a human adviser signs off on the final recommendation. | A payments provider’s fraud detection model might flag suspicious transactions and feed directly into a decision to block a payment. A fraud tool’s confidential data-point weighting still requires disclosure if personal information is used to detect fraud and decide outcomes that significantly affect an individual’s rights or interests. The proprietary logic and output can stay confidential; the kinds of personal information used to operate the model, and the decisions made or informed by the model cannot. |
What the privacy policy must disclose
Where the three limb ADM test is met, APP entities must identify in their privacy policy the kinds of personal information used in the operation of the relevant programs, the kinds of decisions made solely by those programs, and the kinds of decisions for which the program does a thing substantially and directly related to making the decision.
A generic statement that the business uses AI will not satisfy the disclosure obligation. Disclosures must be tailored, meaningful and readily understandable. A generic, high-level transparency statements will not be sufficient. Particular care is required when the ADM involves sensitive information: i.e. where a program uses more sensitive categories such as health or biometric markers, the use of this type of personal information must be clear rather than folded into a general description. Guidance from the OAIC (which is instructive, but not legally binding) is that it is important to include sufficient information to allow customers to request further information and challenge a decision, while avoiding excessive detail.
For example, an insurer that uses a computer program to assess whether to accept applications for insurance could update its policy to include the kinds of personal information used in the operation of the computer program, the fact that the program is used to quote and underwrite the insurance, and whether the decision to offer cover is made solely by the program or substantially informs the decision (e.g. that staff always have oversight and make the final decision based on the output provided).
Responsibility where technology is outsourced
Outsourcing a system to a vendor does not change who is responsible for disclosing its use under APPs 1.7 to 1.9. The ADM obligations remain with the APP entity that “arranged” for the computer program to make the relevant decision, not the technology vendor. This will mean that APP entities will need to work with their vendors and technology suppliers (and consider contractual obligations) to provide clear, high-level information about how their software can be used to make decisions, so that the user can include appropriate detail in its own privacy policy.
APP entities should also watch for upgrades and changes to the functionality of third party systems and platforms, including those they already use. For example, as a vendor rolls out AI features or other new automated functionality into an existing system, you need to understand how staff are actually using those new features in practice, rather than assume the original assessment of the platform still applies.
Practical steps before 10 December 2026
Financial services and fintech businesses have a short window to complete their assessment of what ADM practices are in place and may require disclosure in their privacy policies. The following steps reflect the approach recommended by the OAIC and what is central to compliance.
- Map decisions across the business to see where in your business ADM occurs in connection with computer systems in use currently – i.e. underwriting, pricing, claims assessment, renewals, fraud detection, lending and credit approvals, and financial advice and product recommendation tools. Include outsourced services, spreadsheets and automation introduced incrementally through software updates, since these are easily overlooked if the business has not labelled them as AI.
- Assess and record the type of personal information used, the program’s output, and the human involvement that actually occurs in practice. Ask business teams to demonstrate a live workflow using realistic test material rather than relying only on a product description from a vendor.
- Apply the three limb ADM test to each identified use and document the reason why or why not an ADM disclosure is required, including for borderline cases and where there is likely effect on people experiencing vulnerability.
- Obtain the information needed from vendors to describe the use of a customer’s personal information accurately, and agree with your vendors how changes to a vendor’s functionality or data inputs will be notified to the business on an ongoing basis.
- Update your privacy policy ahead of 10 December 2026, distinguishing clearly between decisions made solely by a computer program and decisions that a program substantially and directly informs. Allocate internal responsibility for reviewing and updating these disclosures as systems or practices change.
- Consider whether your privacy collection notices also need updating. Where a computer program is used as part of ADM, the notice given to individuals at the point of collection may also need to disclose that use.
Hamilton Locke’s Privacy and Financial Services teams can assist financial services and fintech businesses with mapping their ADM use, and reviewing and updating privacy policies ahead of the 10 December 2026 deadline.
