Using AI in Your Business? Here's What You Must Do Before 10 December 2026

If your business uses AI tools — even something as everyday as an automated email sequence, a chatbot, or a CRM that scores your leads — there is a legal change landing in under nine weeks that you need to know about.

From 10 December 2026, businesses covered by Australia's Privacy Act will be required to disclose in their privacy policy where they use automated decision-making, including AI-assisted processes, to make decisions that affect a person.

This is not a proposal. It is confirmed law. And most Australian small business owners are not across it yet.

What Does the AI Disclosure Obligation Actually Mean?

The requirement is about transparency, not banning AI. You do not have to stop using the tools you rely on. You do have to tell people you are using them — specifically when those tools make or influence decisions that affect individuals.

In plain language: if your business uses AI or automated systems to decide who gets a quote, who gets followed up, how leads are scored, or how customers are segmented, your privacy policy needs to say so.

It is also worth being clear on what this obligation is — and is not. The AI automated decision-making transparency requirement is confirmed and commences 10 December 2026. A separate change — the removal of the small business exemption — is still progressing through Parliament and has not yet been confirmed. These are two different things, and confusing them is where a lot of misinformation is circulating right now.

Which AI Tools Might Trigger This Obligation?

If any of the following apply to your business, you may need to update your privacy policy:

• CRM automations that segment or prioritise contacts based on behaviour
• AI chatbots that screen enquiries or route customers
• Email sequencing tools that send personalised content based on automated triggers
• Lead scoring systems that rank prospects without manual review
• Booking or scheduling tools that make eligibility or prioritisation decisions

The key test is whether the automated process makes or materially influences a decision about an individual. If the answer is yes — or even probably — your privacy policy needs to reflect that.

What Should Your Privacy Policy Actually Say?

You do not need to reveal your entire tech stack or commission a lengthy legal document. But your privacy policy should, at a minimum, explain:

1. That you use automated or AI-assisted processes in parts of your business
2. What kinds of decisions those processes influence
3. Whether a human reviews, or can review, those decisions

If you do not currently have a privacy policy — or yours has not been updated in years — now is the time to address that. Four documents every small business should have in place are a privacy policy, a cookies policy, a data retention policy, and a bring-your-own-device (BYOD) policy if staff use personal devices for work.

Why This Is Actually a Trust Opportunity

It is easy to frame this as a compliance burden. But there is a better way to look at it.

Being transparent about how you use AI — especially before you are legally required to be — signals that you run an ethical, considered operation. Most clients already assume businesses use some form of automation. Saying so clearly, and explaining it simply, builds confidence rather than concern.

Clients who understand how you work are easier to retain. Referrals come from relationships built on trust. Compliance, handled well, can become a genuine point of difference in a market where most businesses are still catching up.

What to Do Right Now

You have less than nine weeks. Here is a straightforward action plan:

1. Audit your tech stack. List every tool that touches customer data or makes any kind of automated decision.
2. Check your current privacy policy. Does it mention automated decision-making or AI? If not, it needs updating.
3. Talk to a professional. A privacy lawyer or compliance adviser can review and update your policy quickly — this does not need to be a lengthy or expensive exercise.
4. Update before 10 December. Do not wait until the last week. Give yourself time to review the language carefully.

This is not a crisis. It is a clarity moment. Know what you use, say so plainly, and treat it as an opportunity to show your clients that you run a business they can trust.

Want to think through how your business systems and client communication work together? Book a conversation at meetjay.info.

---

Frequently Asked Questions

Does this apply to my small business?

If your business is currently covered by the Privacy Act 1988 (Cth) — generally businesses with an annual turnover above $3 million, or those in certain industries — the AI disclosure obligation applies to you from 10 December 2026. If you are below that threshold, the broader small business exemption may still apply to you, though this is evolving. Seek professional advice if you are unsure.

Do I need a lawyer to update my privacy policy?

Not necessarily, but it is strongly recommended to have a qualified professional review your policy before publishing it. Many privacy lawyers and compliance consultants offer fixed-fee policy reviews that are affordable for small businesses.

What happens if I do not comply?

Non-compliance with the Privacy Act can result in regulatory action from the Office of the Australian Information Commissioner (OAIC). Penalties were significantly increased under recent reforms. More importantly, a privacy incident can cause lasting reputational damage — which is far more costly than updating a policy now.