A new privacy rule lands in December. Most business owners haven't heard of it.

From 10 December 2026, if your business turns over more than $3 million a year and you use software that makes, or significantly helps make, a decision affecting someone's rights or interests using their personal information, you have to say so in your privacy policy. 

From 10 December 2026, if your business turns over more than $3 million a year and software plays a key role in making a decision that affects someone's rights or interests, using their personal information, you have to say so in your privacy policy. Not tucked away, not implied. Stated.

This covers more everyday decisions than people expect: a hiring shortlist, a quote that adjusts based on someone's history, a warranty claim assessed by a tool before a person looks at it, a complaint triaged by a chatbot before it reaches a real person. Anywhere personal information feeds into a decision and software does real work shaping the outcome. Plenty of small and mid-sized businesses are already doing this without realising it counts.

And when you do look into it, don't assume a human review clears you. The government's own guidance on this says that if a program's output is a key factor in a human's decision, even just recommending or guiding them, it still counts. Their own example: a formula that triages calls to a crisis hotline, helping decide who gets attended to first, counts, even though a person makes the final call. A formula that just works out someone's age from their date of birth doesn't, because it's not doing enough of the real work.

Their guidance on exactly what 'significantly assists' means is still being finalised, expected some time in September, so nobody has the full picture today. What's already locked in is the date and the threshold: 10 December, $3 million turnover. If you're above that line, this is worth getting ahead of now rather than in November. The EU has its own AI rules now too, worth getting familiar with if you sell into that market.

The practical thing you can do right now, before this forces your hand, is build a register. Not a legal document, just a simple list: every AI tool used in your business, what it does, who uses it, what kind of account it's on, and who's accountable for it. That last part matters more than people think, but a register only works if you actually ask your team what they're using first. That's the missing step in last month's accounting example, nobody asked. This isn't only about clearing the $3 million threshold either. Knowing what AI tools are actually touching your business matters whether the December rule covers you or not. The National AI Centre has free templates for both the register and the policy so you're not starting from a blank page.

A register also does the quiet work of answering the December question before anyone asks it. If you already know exactly what AI tools touch your customers' information and how, writing the disclosure is a formality. If you don't, you're starting from zero in November with a deadline bearing down.

Start the list this month, it's the cheapest insurance you'll buy all year. Thank me later.

What working together looks like.

The work I do with businesses starts with understanding the full picture before anything is recommended or built. That might mean a Technology Opportunity Assessment, a structured review of your systems and workflows that delivers an opportunity matrix and blueprint before you spend anything on licences or training, so you know exactly where investing in AI will impact your business. It also includes building the practical safeguards underneath it, your AI policy and your AI register, so you're not scrambling to write one from scratch when December rolls around. Or it might start with an AI Alignment Session with your leadership team, creating a shared understanding of AI, what it means for your business, and what needs to be in place to move forward well.

If you're in Cairns or FNQ and want to talk through where your business is at, book a call.

Kate Fabian is the founder of Adoptech, a Cairns-based technology and AI adoption consultancy. She works with business owners across Far North Queensland on AI strategy, implementation, and training.

Sources: Privacy and Other Legislation Amendment Act 2024 (APP 1.7–1.9). OAIC ADM Issues Paper, May 2026. EU AI Act, extraterritorial scope provisions. National AI Centre, Essential AI Practices and AI Systems Register template, ai.gov.au.