How to write an AI policy before 10 December

The Privacy Act is changing on 10 December 2026, and a lot of the commentary around it has been louder than it needs to be. This guide is the calm version. It explains what actually changes, who it applies to, and how to write an AI policy that is ready for it, with example wording you can adapt and the reasoning behind each part.

The short version: the change is a disclosure duty, not a ban. It does not stop you using AI. It asks covered organisations to be open, in their privacy policy, about where automated systems help make decisions that affect people. A good AI policy does that and a good deal more, because most of what a policy is for has nothing to do with 10 December at all.

What actually changes on 10 December

The change comes from the Privacy and Other Legislation Amendment Act 2024. It received Royal Assent on 10 December 2024 with a 24 month grace period, so the relevant obligation commences on 10 December 2026. The Office of the Australian Information Commissioner (OAIC) published its final transparency guidance in late September 2026.

In plain terms, new provisions in Australian Privacy Principle 1 require a covered organisation's privacy policy to describe:

• the kinds of personal information used in computer programs that are used to make, or to substantially and directly support making, a decision; and
• the kinds of decisions made, or substantially and directly supported, that could reasonably be expected to significantly affect the rights or interests of an individual.

Three things are worth saying clearly, because they are often lost in the noise:

1. It is a transparency duty. You describe what happens. You are not required to stop using automated systems, and you are not required to declare every use of AI in the business.
2. It applies to covered organisations only. The obligation falls on APP entities, which are generally organisations with annual turnover above 3 million dollars, along with some smaller categories such as health service providers and businesses that trade in personal information. If the Act does not cover your business, this particular requirement is not yours to meet.
3. It sits in your privacy policy. The disclosure belongs in the privacy policy you already publish, not in a separate document.

This is general information, not legal advice. If you are unsure whether the Act covers you, or how it applies to a specific decision, confirm it with a qualified adviser.

Why write an AI policy at all

Even if 10 December does not apply to you, there is a simpler reason to write a policy: your people are already using AI. Staff draft emails, summarise documents and analyse figures with tools the business never formally approved. A policy turns that quiet, unmanaged use into something deliberate. It tells people what they may use, what they must never put into a public tool, and who to ask when they are not sure.

Written well, a policy does three jobs at once. It protects customer information and trust. It gives staff the confidence to use AI properly rather than secretly. And it gives you a clear reference point when a regulator, a client or your own board asks how you approach AI.

How to write it: the six practices

The most useful way to structure an Australian AI policy is around the six practices the Government set out in its Guidance for AI Adoption, published by the Department of Industry, Science and Resources. They are becoming the common language for AI governance here, so writing to them keeps your policy aligned with the baseline your clients and partners are being pointed to.

For each practice below there is example wording you can adapt, a note on why it matters, and a simple split between what to put in place first and what to build towards.

1. Decide who is accountable

Name a real person. Every AI system, and the policy itself, needs someone who is responsible for it. This is the single most important line in the document, because without it nothing else holds.

Example: "A named accountable person is responsible for this policy and for the AI tools we use. They approve new tools, keep our AI register current, and are the first point of contact for any question or concern about AI in our organisation."

Getting started: name one accountable person and record their role, not just their name. Next steps: for larger teams, add a small group that reviews higher-risk uses.

2. Understand the impact

Before a tool is used for anything that touches people, think through who it could affect and how. A chatbot that answers general questions is low impact. A tool that helps shortlist job applicants is not.

Example: "Before we adopt an AI tool for a new purpose, we consider who it could affect, what could go wrong, and whether the people affected would reasonably expect it. We pay particular attention to uses that affect customers, applicants or anyone in a vulnerable position."

Getting started: write a short note for each new use. Next steps: adopt a simple screening step that sorts uses into normal, elevated and not permitted.

3. Measure and manage risk

Match the effort to the stakes. Low-risk uses need light controls. Higher-risk uses need a proper look before they go ahead, and controls that fit the risk you are taking on.

Example: "The level of review for an AI use reflects its risk. Low-risk uses follow our general rules. Higher-risk uses are assessed before they begin, and are only approved with controls that are appropriate to the risk."

Getting started: agree what counts as higher risk for your business. Next steps: record each assessment so you can show your working later.

4. Share essential information (transparency)

This is where the 10 December change lands, and it is narrower than people fear. You describe, in your privacy policy, where personal information feeds automated systems that significantly affect people. If that is not something your business does, you say so, and you review it if that changes.

Example, for a business that does use AI in decisions about people: "Our privacy policy describes the kinds of personal information used in automated systems that make, or substantially support, decisions that could significantly affect you, and the kinds of decisions involved."

Example, for a business that does not: "We do not currently use automated systems to make, or substantially support, decisions that could significantly affect individuals. We will review this statement if that changes."

Getting started: decide which of the two statements is true for you today, and make sure your privacy policy reflects it. Next steps: tell people, in plain language, when they are dealing with AI-generated content or an automated decision.

5. Test and monitor

An AI tool is not something you switch on and forget. Check that it works before you rely on it, and keep an eye on it while it is in use. Quality is a human responsibility, not the tool's.

Example: "We check that an AI tool is fit for purpose before we rely on it, and we monitor its outputs while it is in use. Staff are responsible for the quality of anything an AI tool helps them produce."

Getting started: make clear that the person using a tool owns its output. Next steps: set a regular point to review the tools you depend on.

6. Keep humans in control

A person should be able to pause, override or step in. Where something important depends on an AI tool, keep a way to do the work without it. This also connects to the fixed rule most policies share: AI output that reaches a customer is reviewed by a person first.

Example: "A person reviews AI output before it reaches a customer or informs an important decision. We can pause or stop any AI tool, and we keep a manual way to continue critical work if a tool is unavailable."

Getting started: write down the one or two processes that must keep working without AI. Next steps: confirm the manual fallback actually works, with the people who would run it.

The rules that should never be optional

Separate from the six practices, a workable AI policy almost always fixes a few positions that are not safe to leave to personal judgment. These are the lines that protect customer information and trust, and they belong in every policy:

• A clear stance on staff using unapproved AI tools, sometimes called shadow AI.
• No personal or customer information placed into public AI tools.
• A named accountable person.
• Human review before AI output reaches a customer.
• A plain statement of what staff may and may not put into AI.

Everything else, which tools you approve, your day-to-day ways of working, the tone of the document, can be tailored to how your business actually runs.

Before you publish: the part templates leave to you

Here is the honest bit. The wording above gets you a long way, and you can find free templates from the National AI Centre and others that get you a draft too. Writing an AI policy is not the hard part.

The hard part is knowing it is right. Does what you have written actually meet each standard you care about? Is it internally consistent? Does the automated-decision clause say the correct thing for your business? Has anyone checked? A template hands you a document and wishes you luck. You are left to hope it holds up.

Anyone can write an AI policy. The value is in knowing it meets the standard, that a person has checked it, and that nothing which fails the standard gets through.

That is the gap ORCA closes. Our Verified AI Policy walks you through a short guided interview, drafts the policy for your business, and will not issue a certificate until every required clause is present and consistent. A qualified reviewer stands behind it. It is checked against the standards you choose, including the Australian Privacy Principles, work health and safety, the Voluntary AI Safety Standard guardrails and the principles of ISO/IEC 42001. Where a business is not covered by the Privacy Act, we describe it as aligned to the Principles voluntarily, because we never claim more than is true.

Do this next

If 10 December applies to you, start with practice four: check whether your privacy policy needs the automated-decision statement, and which of the two versions above is true for you today. If it does not apply, the rest of this guide still earns its place, because the other five practices are about using AI properly whatever your size.

And if you would rather talk it through, our free webinar, AI and the Privacy Act: what to do before 10 December, walks through exactly this with time for your questions. Save your spot here.

Common questions

What changes on 10 December 2026? Organisations covered by the Privacy Act must describe, in their privacy policy, how personal information is used in computer programs that make, or substantially and directly support, decisions that could significantly affect someone. It is a disclosure duty, not a ban, and not a rule to declare every use of AI.

Does my business have to comply? The requirement applies to APP entities, generally organisations with turnover above 3 million dollars, plus some smaller categories such as health service providers. If the Act does not cover you, this requirement is not yours to meet, though a written AI policy still helps.

Do I need a policy if I do not use AI in decisions about people? Yes. A policy is mainly about how staff use everyday AI tools, what they may put in, what they must keep out, and who is accountable. The automated-decision clause is just one part, and it records that it does not currently apply if that is true for you.

Is a policy enough to be aligned with the standards? A policy is the written foundation. Whether it actually meets each standard, and stays consistent, is the step most templates leave to you. That is where a verified policy, checked by a person, gives you certainty rather than a document you hope is right.