ADM Transparency Deadline: 10 December 2026

What the ADM Requirement Means

The amendment requires organisations to disclose automated decision-making in their privacy policies. Specifically:

• Which automated systems you use that affect individuals' rights or interests
• How those systems make decisions
• What information feeds into those decisions
• How individuals can seek review of automated decisions

"Significantly affects rights or interests" is the trigger. Credit scoring that determines whether someone gets a loan. Insurance pricing that determines how much they pay. HR screening that determines whether they get an interview. Fraud detection that freezes their account. Customer service routing that determines wait times and service quality.

Most organisations are running more automated decision systems than they realise. I've audited firms that listed two initially and found eleven by the time we finished.

The Compliance Timeline

The maths is straightforward:

• More than 30 weeks left: the ADM Sprint takes 6 weeks, leaving over 6 months of buffer. Standard pricing.
• 20 to 30 weeks left: still comfortable. Roughly 5 months of buffer after the Sprint. Standard pricing.
• Under 15 weeks left: workable, but the buffer is down to weeks rather than months. Rush pricing.
• Starting November 2026: 6 weeks to deadline. Extremely high risk. Cost: premium rates if advisory capacity exists.

The pricing difference isn't arbitrary. Every compliance advisory firm in Australia will be working toward the same deadline. September onwards, capacity fills up nationally. Early movers get standard pricing and months of buffer. Late movers pay 50% to 100% more with zero margin for error.

Who Is in Scope

Any organisation that operates automated systems affecting individuals' rights or interests. In practice, that includes:

• Financial services: Credit scoring, loan approvals, insurance pricing, fraud detection
• Retail and e-commerce: Recommendation engines, dynamic pricing, automated customer service
• Healthcare: Automated claims processing, patient triage systems
• Human resources: CV screening, candidate scoring, automated interview scheduling
• Property: Automated valuation models, tenant screening, lead scoring
• Professional services: Automated billing, client risk scoring

If you're unsure whether your systems qualify, they probably do. The scope is intentionally broad.

What Non-Compliance Looks Like

After 10 December 2026, organisations that haven't updated their privacy policies face:

• OAIC enforcement action (the same regulator currently running the Privacy Sweep with $66,000 penalties)
• Regulatory investigation triggered by consumer complaints about automated decisions
• Reputational damage when non-compliance becomes public
• Director liability exposure (boards that allowed the deadline to pass without action failed to exercise reasonable care)

The OAIC Privacy Sweep targeting 60 entities since January 2026 shows the enforcement posture is real. That sweep focuses on current privacy policies. The ADM deadline adds a new layer of scrutiny.

The ADM Transparency Sprint

Our 6-week fixed-price sprint covers everything:

Week 1-2: Discovery. Complete inventory of every automated decision system. Classification by scope (affects customers, employees, or both). Documentation of data inputs and decision logic.

Week 3-4: Policy Drafting. Plain English privacy policy updates disclosing each ADM system, its purpose, its impact, and how individuals can seek review. Written to meet the legislative standard, not just best practice.

Week 5-6: Implementation. Updated policies deployed, staff trained on new disclosure requirements, evidence package compiled for regulatory defence.

Guaranteed compliance by 10 December 2026 or full refund. The guarantee holds as long as you start with enough lead time.

Related Resources

• Privacy Act AI Compliance: Full Privacy Act requirements for AI
• AI Governance Framework: Complete governance framework
• AI Compliance Checklist: Step-by-step verification
• ASIC AI Director Duties: Director obligations