Organisations subject to the changes will need to update their privacy policies to explain the types of personal information being used, the decisions being made entirely by computer programs, and where those programs play a significant role in informing an outcome. For many organisations, the challenge will not be updating the policy itself, but understanding where automated decision-making is already occurring, and what personal information those systems rely on.

View the OAIC's new resources on transparency for use of AI and automated decision-making.

In this article we talk about:

• Why transparency is going to be vital for your organisation
• How the new rule applies to any automated decision-making program, not just AI, where personal information is used and the statutory conditions are met
• Why (and how) you need to map your information environment ahead of the changes  
• How you can ensure human oversight steps are actually compliant, not just a checkbox that leaves you exposed
• What actions you need to take right now, to be ready for December.

Why this transparency is vital

Most of us provide personal information to government and businesses every day, but we don’t have visibility into when their computer programs are being used to assess our information, compare it with other information, or recommend an outcome or decision about us.

If someone’s personal information contributes to whether they receive a service, qualify for an opportunity, have an application approved, or are assessed as presenting a particular level of risk, that person should be entitled to know whether a human or an algorithm made that call. That’s the crux of the new APP changes, coming in December 2026, which take a first step to policy controls you will need to implement to support this transparency.

Not just AI – any automated decision making

Automated decision-making (ADM) is not always what we think of as ‘AI’. The new requirements cover a much broader range of technology, from relatively simple rules-based programs through to artificial intelligence, machine learning and LLMs. ‘Robodebt’ was not AI, but it was ADM.

The computer program does not need to make the final decision itself. An insurer, for example, might use a traditional rules-based system to assess an application and calculate a risk score, which is then provided to an employee who makes the final decision. Your organisation might even use AI to review job applications and recommend which candidates should progress to interview, with a hiring manager making the final selection.

In both cases, a person technically makes the final call, but the computer program has already influenced the information or recommendation put in front of them. Where that contribution plays a significant role in the decision, a program using personal information to make the decision, or do something substantially and directly related to making it, and the decision could reasonably be expected to significantly affect that individual’s rights or interests, will likely fall within the new requirements.

Software is already helping organisations work through volumes of information that would be difficult, and sometimes impossible, for people to manually review in full. Those efficiencies can make it tempting to transfer more of the workload to AI and other automated systems. As their role expands, your organisation needs to keep track of which decisions they influence, what personal information they use, and where meaningful human judgement remains.  

Knowing a computer was involved is only part of the answer

For organisations, being transparent about computer-assisted decisions starts with understanding your own systems and information.

Computer-based decisions are not automatically objective simply because a computer made them. Programs still rely on information and rules that have been created or configured by people, while AI models are influenced by the data and parameters behind them.

If the information is incorrect or out of date, the result may be wrong. An inappropriate classification can change how information is treated, while an AI model can introduce bias, or a rules-based program can consistently apply a predetermined rule that does not account for circumstances or discretion relevant to an individual case.

This is one of the reasons Castlepoint has taken an Explainable AI approach from the very beginning. Rather than producing an output without visibility over how it was reached, Castlepoint maintains evidence and full transparency behind its AI-driven recommendations, allowing you to see the information and rules behind any classification or action, and understand exactly why it arose.

The OAIC changes are focused on transparency overall, rather than requiring you to explain the inner workings of every individual computer-based decision you make. However, an organisation that understands how its own technology is working, what information it is using, and why particular actions are occurring, is in a much stronger position to provide meaningful transparency and manage those systems responsibly.

The information behind the decision is also important

Understanding how computer programs are being used also depends on understanding the information available to them. There are multiple aspects to consider:

Explainable source data: Many traditional Machine Learning programs are trained on large caches of data – some internal to the organisation, and some external. Decisions involving your own corporate data can therefore be influenced by patterns learned from external, historical information. If those patterns are inappropriate for your organisation’s circumstances, they can contribute to unfair outcomes for your stakeholders. Without visibility into that influence, you may struggle to explain those outcomes in the context of your own operations.  

When using ML systems that are not fully transparent, your organisation can mitigate the risk by making sure you know where the corporate information to train it came from, and whether it is accurate and current.  

Security and privacy of inputs: Before using corporate data in any AI or ADM processes, you also need to understand whether that information is appropriate for use. That includes whether it should actually even be in your network at all, and if so, whether personal and sensitive information is being appropriately identified and protected from exposure.

Castlepoint works across existing systems to automatically discover and classify information in-place, giving you a clear view of what you hold, where it sits, what it relates, to and whether it is appropriate to be fed into AI platforms. That visibility helps you assess whether information is appropriate for use in AI platforms, including whether it is overdue for disposal under applicable law, confidential or private, or not a ‘record of business’. Use these findings to define and enforce your AI/ADM data scope: exclude information that should no longer be retained, and assess other flagged information against applicable legal requirements, policies and approvals before including it.  

You can use Castlepoint to automatically detect confidential, classified, and personal information and restrict access for AI systems to the sensitive data it finds. Castlepoint also automatically sentences records of business, so that you can dispose of obsolete and non-corporate information completely and keep it out of your AI scopes. Castlepoint also audits staff use of Copilot, for example, and where Copilot pulls its answers from, so you can continually monitor whether access remains appropriate.

For one Australian statutory insurer managing significant volumes of personal and medical information, understanding what information existed across its systems had become increasingly difficult. By implementing Castlepoint across 75 systems, the organisation  automatically discovered and classified sensitive information, replacing its manually maintained Information Asset Register with a dynamic view of its information holdings. With more than three million items analysed and 332 retention policies applied, the organisation gained greater visibility over its information and how that information was governed. Read the case study. 

While the new requirements focus on transparency, organisations cannot provide meaningful transparency around information they do not properly understand. For those using AI and automated decision-making, knowing what information they hold, where it sits, and how it is being used, is part of the same governance overlay.

The role of human oversight

Having a person make the final decision does not automatically resolve the issue raised by the APP rule changes. If the staff member receives a score, classification, or recommendation from a computer program without themselves understanding how it was produced, their ability to properly assess or question the recommendation can be limited.

Human oversight needs to involve genuine judgement rather than simply approving an output generated by a system. Giving people enough information to understand and question those outputs helps organisations retain meaningful human oversight while making use of the efficiencies that AI and automation can provide.

With rules-as-code Explainable AI like Castlepoint, the algorithm is trained on specific rules, not bulk data. This includes your own internal policies, as well as legislation you have to comply with. Every recommendation and subsequent decision is therefore linked explicitly to your own rules and policies, and your own corporate records, showing a clear nexus. Reviewers can see exactly what rule was used to reach the outcome, based on exactly what language in the source documents. This supports robust appraisal and provides evidence for explaining and reviewing AI-supported decisions.  

For action now: you next steps before December

Updating your privacy policy is the immediate requirement, but there is groundwork to do before you can accurately describe how computer programs are using personal information across your organisation.

Start by identifying the computer programs being used to make or inform decisions about people, including third-party systems, and which of those decisions could significantly affect an individual.  

From there, you need to understand what personal information those programs use, where that information comes, from and the role the program plays in the eventual decision.

This is also a good opportunity to look at the information environment behind those systems. Do you know where personal and sensitive information sits across the organisation? Can you identify which systems have access to it? If an automated process uses or acts on that information, do you have enough visibility to understand what has happened and exactly why?

Castlepoint can support this work by helping organisations discover and classify personal and sensitive information across their existing systems, understand where that information sits and who owns it, and apply information governance controls at scale. Through Explainable AI, you also retain full evidence of how Castlepoint itself classifies and controls information, providing complete visibility into the technology, rather than asking your teams to simply trust the output.

The OAIC advice may begin with what organisations disclose in their privacy policies, but the case for transparency goes further. People should be able to understand how their personal information is used when it contributes to decisions that can have a significant impact on them. For your organisation, meaningful transparency starts with understanding what is happening within your own information environment.

If your organisation is reviewing its use of AI, automated decision-making, or personal information ahead of the December changes, talk to Castlepoint about how we can help you understand, govern and manage the information behind it.

‍