From 10 December 2026, certain APP entities will have additional privacy policy obligations where computer programs use personal information in qualifying automated decisions.
What changes on 10 December 2026 for management consultants?
AI and automated tools are becoming part of everyday business. For management consultants, they may appear in recruitment, analysis and client projects.
The OAIC says: “From 10 December 2026, an APP entity must include additional information in its APP Privacy Policy if it arranges for a computer program to use personal information to make decisions that could reasonably be expected to significantly affect the rights or interests of an individual.”
If your consulting business is covered by the Privacy Act, now is a good time to check where automated tools sit in your work and whether your privacy policy needs attention.
What you should know
The change adds new requirements to Australian Privacy Principle 1.
The requirements can apply where an APP entity arranges for a computer program to use personal information to make a decision that could reasonably be expected to significantly affect a person’s rights or interests.
The privacy policy will need to include specified information about relevant automated decisions and the personal information used.
It is not just about generative AI
The rules refer to a computer program. They are not limited to products described as AI.
So the question is not simply whether your business uses generative AI. You should also consider whether software uses personal information to make, or directly support, a significant decision about someone.
Having a person make the final decision does not necessarily remove the automated element. The requirements can also apply where a computer program does something substantially and directly related to making the decision.
Where could this matter for management consultants?
Start with your own business. OAIC guidance discusses AI being used to screen candidates, analyse resumes and job applications, and conduct pre-employment assessments.
Management consultants may also work across recruitment, project management, procurement and outsourcing, systems analysis, and business process improvement.
These are examples of consulting activities where it may be useful to check whether automated systems and personal information are involved.
That does not mean every consulting project involving AI falls within the new requirements. The important questions are what the program does, what personal information it uses and whether a decision could significantly affect a person’s rights or interests.
What information are you putting into AI tools?
Privacy considerations start before information is entered into an AI system.
For management consultants, this may be relevant when working with client files, CVs, employee information or other material that can identify a person.
As a matter of best practice, “the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools”.
It is also worth checking who can access information entered into a commercial AI product. OAIC guidance says organisations should consider who will have access to personal information input into or generated when using the product.
What happens when AI output is wrong?
OAIC guidance says AI systems can produce inaccurate or false results. It also links AI use to existing obligations around the accuracy of personal information.
If an AI tool contributes to research, analysis or a recommendation, check the source information and review the result before it is used.
For management consultants, the practical point is simple. Using a new tool does not remove the need to check the work before it reaches a client or becomes part of a decision.
Updating your privacy policy is only part of the job
Before changing policy wording, understand what is actually happening in your business.
A practical review could include:
- Identifying programs that make or directly support decisions about people
- Checking what personal information those programs use
- Understanding whether those decisions could significantly affect a person’s rights or interests
- Reviewing where staff check automated outputs
- Checking whether your privacy policy and internal processes need to change
The aim is not to treat every piece of software as an automated decision-making issue. It is to identify the systems that may fall within the new requirements.
Working with Australian Government clients?
Most small businesses are not covered by the Privacy Act, although there are exceptions. The OAIC defines a small business as one with annual turnover of $3 million or less.
Contractors providing services under a Commonwealth contract are one example of businesses that can be covered regardless of turnover.
There is also a separate Australian Government AI policy.
“Agencies are required to implement the AI impact assessment requirement for in-scope use cases by 15 December 2026.”
That requirement is directed at agencies. Management consultants supporting government AI projects may still encounter these assessments as part of project governance.
Where does insurance fit?
AI may change the information you handle, the tools you use and the way you provide services. That makes it worth checking whether your insurance arrangements still reflect how your business operates.
Depending on the policy, professional indemnity cover may address certain civil liability claims involving privacy, confidentiality, or intellectual property.
Cyber-related exclusions and optional extensions can affect how a claim is treated, so cover should not be assumed.
Some policies may also provide cover for certain legal or quasi-legal enquiries by regulatory, licensing or statutory bodies, subject to the applicable terms, limits and exclusions.
“Cybersecurity insurance isn’t just for big companies.”
“Assistance in notifying impacted third parties following a privacy breach, as well as complying with government reporting requirements.” as an example of what cyber insurance can include.
Cover needs to be checked against the relevant policy wording and schedule, including applicable terms, conditions and exclusions. Speak with your Marsh risk advisor about your circumstances.
Frequently asked questions
No. Whether they apply depends on whether your business is an APP entity and whether its use of a computer program meets the conditions in the new APP provisions.
No. The requirements refer to computer programs more broadly. A system does not have to be marketed as AI to potentially fall within the rules.
The requirements concern certain decisions that could reasonably be expected to significantly affect an individual’s rights or interests and where personal information is used in operating the computer program.
Not necessarily. The requirements can also apply where a computer program does something substantially and directly related to making a decision.
The requirements focus on information about relevant automated decisions and the personal information used. Check the OAIC guidance when reviewing what needs to appear in your privacy policy.
The OAIC recommends, as a matter of best practice, that organisations do not put personal information, particularly sensitive information, into publicly available generative AI tools.
Most small businesses are not covered, but exceptions apply. Check the OAIC guidance or seek legal advice about your circumstances.
A contractor providing services under a Commonwealth contract is one type of small business that can be covered by the Privacy Act regardless of turnover.
If the new requirements apply to your business, review your privacy policy before the commencement date so the required information is addressed when the changes take effect.
The DTA requirement is directed at Australian Government agencies. Consultants supporting those agencies may still encounter AI impact assessments as part of government projects.
Yes. WA has a separate public sector privacy regime. From 1 July 2026, Information Privacy Principle 10 introduced requirements relating to automated decision-making by the WA public sector. It can also apply to contracted service providers in relevant circumstances.
References
- Office of the Australian Information Commissioner, “Chapter 1: APP 1 Open and transparent management of personal information”, https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-1-app-1-open-and-transparent-management-of-personal-information, accessed on 22 September 2026.
- Office of the Australian Information Commissioner, “Guidance on privacy and the use of commercially available AI products”, https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products, accessed on 22 September 2026.
- Office of the Australian Information Commissioner, “Small business”, https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business, accessed on 22 September 2026.
- Australian Government, “Artificial intelligence impact assessment tool: Introduction”, https://www.digital.gov.au/ai/impact-assessment-tool/introduction, accessed on 22 September 2026.
- Government of Western Australia, “Privacy and accountability in automated decision making”, https://www.wa.gov.au/organisation/office-of-the-information-commissioner/privacy-and-accountability-automated-decision-making, accessed on 22 September 2026.
Any statements concerning actuarial, tax, accounting, or legal matters are based solely on our experience as insurance brokers and risk consultants and are not to be relied upon as actuarial, accounting, tax, or legal advice, for which you should consult your own professional advisors.
This website contains general information, does not take into account your individual objectives, financial situation or needs and may not suit your personal circumstances.
Marsh Pty Ltd (ABN 86 004 651 512, AFSL 238 983) (“Marsh”) and Marsh Advantage Insurance Pty Ltd (ABN 31 081 358 303, AFSL 238 369) (“MAI”) arrange the general insurance (i.e. not the Discretionary Trust Arrangement) and are not the insurer.
Discretionary Trust Arrangements are issued by the Trustee, JLT Group Services Pty Ltd (ABN 26 004 485 214, AFSL 417 964) (“JGS”). Any advice or dealing in relation to a Discretionary Trust Arrangement is provided by JLT Risk Solutions Pty Ltd (ABN 69 009 098 864, AFSL 226 827) (“JLT”). The cover provided by a Discretionary Trust Arrangement is subject to the Trustee’s discretion and/or the relevant policy terms, conditions and exclusions.
For full details of the terms, conditions and limitations of the covers and before making any decision about whether to acquire a product, refer to the specific policy wordings and/or Product Disclosure Statements (PDSs) available from the relevant product issuer. Target Market Determinations (TMDs) are available here.
Marsh, MAI, JGS and JLT are all businesses of the Marsh group.
LCPA 26/3872