AI and ADM inventory
Every system, vendor tool and spreadsheet model that makes or supports decisions.
Service 05 Due 10 Dec 2026
AI governance & compliance
Get ready for the automated decision-making disclosures that apply from 10 December 2026, and govern the AI you already use with a framework your board, auditors and customers can trust.
The deadline
Disclosure is now mandatory.
From 10 December 2026, privacy policies of organisations covered by the Privacy Act must explain when computer programs use personal information to make, or substantially support, decisions that significantly affect people. The regulator published its guidance on 30 September 2026, so most organisations have weeks, not months.
- Know every system that makes or supports significant decisions
- Disclose accurately, without over- or under-stating
- Show your board a defensible governance position
What we deliver
Readiness in two to three weeks.
Significance assessment
Which decisions could significantly affect rights or interests, and why.
Personal information map
The kinds of personal information each system uses, documented clearly.
Draft disclosures
Privacy policy wording drafted for your legal team to review and approve.
AI policy and register
Aligned to the six essential practices in Australia's Guidance for AI Adoption.
ISO/IEC 42001 gap view
Where you stand against the AI management system standard, and what to fix first.
We provide technical and governance support, not legal advice. Your legal advisers remain responsible for legal advice and final disclosures.
Engagement
ADM & AI Governance Readiness
Fixed fee, two to three weeks, delivered with your privacy, legal and technology teams. APRA-regulated? We add an AI service-provider view for CPS 230.
from A$6,500
Who must comply with the automated decision-making disclosure?
Organisations covered by the Privacy Act (APP entities). That generally means Australian Government agencies and businesses with annual turnover above A$3 million, plus some smaller businesses, such as health service providers. Check your position with your legal adviser.
What must the privacy policy say?
Where a computer program makes, or does something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests using personal information, the policy must describe the kinds of personal information used and the kinds of decisions involved. See our plain-English guide.
Do you provide legal advice?
No. We do the technical discovery and governance work: finding the systems, mapping data and decisions, and drafting disclosures for your lawyers to review and approve.
How long does it take?
Two to three weeks for most mid-sized organisations, which leaves time for legal review before 10 December 2026 if you start now.
Related