Which of your systems makes a decision about your people?

We only have about eight weeks.

Yes, this is the deadline for Australian businesses covered by the Privacy Act before you must be able to provide a written answer to this question: What decisions in your business are being made, about people, or decisions that are materially shaped, by computer programs using their personal information, where those decisions could significantly affect them.

That’s actually 2 questions, but this is not a project to mess about with. The answer, will need to sit in your privacy policy, where anybody can read it. Your privacy policy will need to describe the kinds of personal information used and kinds of decisions involved.

What actually commences on 10 December

On 10 December 2026 the automated decision-making transparency obligation introduced by the Privacy and Other Legislation Amendment Act 2024 commences. From that date an entity covered by the Australian Privacy Principles must set out in its privacy policy the kinds of personal information used in automated decision making, and the kinds of decisions made that way, where such a decision could significantly affect an individual's rights or interests. The Office of the Australian Information Commissioner is consulting on its guidance for the obligation now, and the OAIC's consultation material takes a deliberately broad view of what constitutes a 'computer program', while it is still working through the boundaries of what is 'substantially and directly related' to a decision and what significantly affects a person's rights or interests.

Three things in that paragraph are worth separating, because most of the commentary I have read runs them together.

It is a transparency obligation and not a prohibition. Nothing in it stops a business making automated decisions. It requires the business to say that it does, and to say what kinds.

It attaches to the decision and not to the technology. There is no threshold of sophistication anywhere in the language. A rule typed into a practice management system in 2014 that sorts, scores or excludes people could sit inside it. The obligation does not care whether a vendor calls the thing artificial intelligence, automation, a workflow or a filter.

The hard part is not the drafting. It is the knowing. Two accurate sentences in a privacy policy takes a lawyer an afternoon. Producing the list those two sentences have to be true about is the actual work, and very few businesses have that list.

Why very few businesses have the list

Adoption ran ahead of documentation, quickly and in plain sight.

An IDC study sponsored by Caseware, reported by Accounting Times on 4 May 2026, found that 68 per cent of Australian accounting firms had embedded or piloted artificial intelligence, against a global average of 66 per cent, with half planning to expand use over the following two years. Read that as a compliance number rather than a technology number and it says something less comfortable than the press release intended. Roughly two thirds of Australian practices have changed how decisions get made, recently, without a register of what changed. This is a governance signal rather than a technology statistic. Two thirds of Australian firms surveyed are already experimenting with or deploying AI into their businesses. It would be remarkable if the documentation of those new workflows had moved at the same speed.

That is not carelessness. It is simply how tools arrive in a services business.

Nobody convenes a project to introduce automated decision making. A partner buys a licence. A practice manager switches on a feature that was already inside the subscription. An offshore team is handed a rule and applies it consistently for two years. A spreadsheet with a scoring column becomes the way work gets triaged, then becomes the way it has always been done, then becomes invisible. Each step is small, defensible and undocumented. The aggregate is a business making decisions about people through machinery that no single person in it can describe.

Which is the same sentence as the compliance problem, arrived at from the other direction.

Where the decisions actually are

Here is the list in the vocabulary a practice actually uses rather than the vocabulary of a privacy seminar. In the practices I look at, the honest version usually includes most of these.

Client onboarding. A verification, sanctions or risk step that ranks, flags or declines a prospective client before a human opens the file.

Fee debtors and lockup. The order in which the lockup report gets worked, set by a rule somebody wrote once and nobody has reviewed since. Who gets a reminder, who gets a phone call, who gets stopped.

Payment plans and credit terms. Eligibility decided by a rule inside the system rather than by the partner whose name is on the engagement letter.

Recruitment. A shortlist that arrives already sorted, produced by a platform nobody in the practice configured and nobody can explain.

Allocation and rostering. Who gets which job, which drives what your people earn and how quickly they progress.

Client triage. Anything sitting above the practice management system that scores, ranks or prioritises a human being.

Every line there is a decision about a person. Several of them plainly touch that person's interests in a way the obligation is aimed at. And in most practices the rule behind each one lives either in a vendor's default configuration or in the head of whoever set it up, who may no longer work there.

I do note that the existing employee records exemption may apply to current and former employees, so some elements such as rostering may be excluded.

The four questions that produce the map

The compliance artefact and the operating artefact are the same document, which is the only genuinely good news in any of this. It is a list with four columns.

1. What is the decision? Stated as a decision about a person, not as a process name. "We decide which overdue clients get contacted first" rather than "debtor management". Process names hide decisions, which is how the register stays empty.

2. Where is it made? The specific system, spreadsheet, integration or standing instruction. If the honest answer is "it depends who is doing it that week", write that down, because that is a finding rather than a gap in your knowledge.

3. What does it use? Which fields, which personal information, which history. This is the column your privacy policy sentence gets built from, and it is the column people skip.

4. Who owns the rule? A person, by name, who can change it and explain why it says what it says. Where that column comes back blank you have found the expensive thing, and it was never the privacy exposure.

That is two days of work in a mid-sized practice and one day in a small one. It does not need a consultant and it certainly does not start with a technology assessment. Anyone who tells you it starts with a technology assessment is selling the assessment.

Why the map outlives the deadline

I have argued for years that the most expensive asset in a founder-run or partner-run business is the set of decisions that exist only as judgement. Expensive in three specific ways, none of them theoretical.

You cannot delegate a decision you cannot describe. So the partner keeps making it, indefinitely, at the price of a partner's hour. And calls that being across the detail.

You cannot price consistently against a rule nobody has written down. Two partners quote the same engagement differently, the practice absorbs the variance and the variance never appears as a line item anywhere.

And you cannot sell a business whose decisions live in three people's memories without a buyer pricing that fact. I have been on the receiving end of that one. When the company I was running was sold, the buyer's remedy for the risk that I might leave was to name me in the agreement as a key person, restrain me for a period and defer part of the consideration until it was satisfied the business ran without me. That is not a governance metaphor. It is a clause, it has a number attached and the number is paid by the seller.

A decision register is the cheapest instrument I know that acts on all three at once. The December obligation happens to make it urgent this quarter. It was already the highest-return dull thing available in a professional services business.

What good looks like on 10 December

Three artefacts, and you should be able to hold each of them up.

A register of every material decision the business makes about a person where a system, rule or model plays a meaningful part, with the APP 1.7 decisions identified.

Two sentences in the privacy policy that are true about that register, drafted from it rather than from a template found on another firm's website.

And a named person who reviews the register whenever a system changes, which is the only part of this that has to survive past December and therefore the only part most practices will drop.

Nothing on that list requires a purchase. All of it requires somebody to sit down and find out how the business actually decides things, which is the least glamorous and highest-return work available in a services practice, and always has been.

Most practices will do this in the last fortnight of November. As a policy edit. And, they’ll probably do it badly.

The map takes a day. The panic takes a month. Getting it wrong could be severe.

The law gives you a reason to build it. Your business gives you a reason to keep it.

Sources. Privacy and Other Legislation Amendment Act 2024; Office of the Australian Information Commissioner, consultation on guidance for transparency in automated decision making, oaic.gov.au. Adoption figures: IDC, "The Future of Audit and Accounting in the AI Era", sponsored by Caseware, reported by Accounting Times, 4 May 2026.