Five ordinary tools that just became 'automated decisions' you have to disclose

One date belongs in your calendar that almost certainly isn't there yet. 10 December 2026. From that day, the Privacy Act makes you disclose, in your privacy policy, where automated tools make decisions that significantly affect people.

The line we hear back, nearly every time: "doesn't apply to us, we don't use AI like that." Nearly every time, it does. The new rules, Australian Privacy Principles 1.7 to 1.9, are drafted wide. They catch plain, boring software that firms have run for a decade without ever calling it an "automated decision." Five we run into constantly.

1. The lead scoring in your CRM

Your CRM ranks an inbound lead. That rank decides who gets the callback, who gets the discount, who quietly never hears back. That is an automated process driving a decision about a person. You file it under sales convenience. The Privacy Act is starting to file it under things you have to be able to explain out loud.

2. CV and applicant screening

Anything that filters, ranks, or scores job applicants sits near the bullseye of these rules. Hiring plainly affects people, and "the software shortlisted them, not us" is not a sentence you want to be saying to a regulator, or to a rejected candidate's lawyer. Run an applicant-tracking system that does any automated ranking, assume you're in scope, and plan from there.

3. Dynamic or per-customer pricing

If software sets or nudges a price for an individual based on their data, that's an automated decision about that individual. It catches more firms than expect it, including the ones running an off-the-shelf quoting or pricing tool that personalises quietly in the background. You may not have built it. You're still the one running it.

4. Tenant and tenancy screening

Property managers and agencies, this one is dead centre of what the rules care about. Automated tenant screening, application scoring, the lot. Approving or knocking someone back for a place to live is about as "significant to a person's interests" as the test ever gets. There isn't much grey here to hide in.

5. Automated credit, risk, or eligibility checks

Brokers, lenders, insurers, and plenty of ordinary service businesses run automated checks that decide who qualifies and on what terms. Those have always carried obligations. The transparency change bolts a specific new one on top: state that you do this, and be able to explain it in language a normal person can follow.

Why it's so easy to miss

None of these looks like "AI" the way the headlines paint it. They're quiet. Embedded. Usually bought as one feature inside something else you actually needed. That is precisely what makes the obligation sneaky. The law firms tracking this keep making the same observation: most organisations rolled these systems out without ever cataloguing them, so the first honest answer to "are you in scope?" is "we'd have to go and check."

We'll be straight about the soft edges, because anyone selling you hard boundaries is guessing. The OAIC won't publish final guidance until around September 2026, so the precise meaning of "significantly affects" a person is still setting. Our position: don't wait for the perfect map. The five above are not going to drop out of scope between now and then, and squaring them away takes weeks, not afternoons.

What to actually do

Disclosure and governance, not a ban. The fix isn't dramatic. In order:

Find them. List every tool that scores, ranks, filters, or decides about people, the ones baked into software you already pay for very much included.

Flag the ones that bite. For each, ask the law's question, could this materially affect someone, and start with those.

Put a human where it counts. Make sure a person can review and overturn the decisions that matter, and write down, by name, who's accountable.

Say it plainly. Update the privacy policy to describe what you do, in words a customer could actually parse.

Handled now, this is a contained job, a few weeks of unglamorous work. Handled in late November, it's a scramble, and scrambles are where the rushed, wrong disclosures get written.

Want a fast read on which of your tools are likely caught? Our free AI Exposure Check maps it in a few minutes and hands you a one-pager to take to your team. Same first step we'd take with you.

General information about a moving regulatory picture, not legal advice. Where it matters, get a lawyer to check it.