APP 1.7 Rapid Review

The obligation, in plain English

The Privacy and Other Legislation Amendment Act 2024 added a new transparency requirement to the Privacy Act. By 10 December 2026, organisations covered by the Act must disclose in their privacy policy which decisions are made by computer programs, and what kinds of personal information those programs use. There are no extensions.

The difficulty isn't the policy wording. It's that most executive teams don't have a reliable list of the automated decisions their business already makes. Systems bought years ago, vendor tools, and features switched on by default all count. When we inventory automated decision-making with a client, the list is usually far longer than the leadership team expected.

Who's in scope

Consumer-facing and APRA-regulated businesses carry the most exposure. If your organisation uses any of the following, you're making automated decisions:

• Credit scoring or application approvals
• Fraud detection and transaction blocking
• HR screening or rostering algorithms
• Customer service routing and prioritisation
• Pricing, eligibility or claims automation

ASIC Report 798 reviewed 624 AI use cases across 23 licensees and found nearly half lacked fairness policies for systems already in production. The regulator's position is simple: it doesn't matter how little AI you think you use. It matters whether you can account for the AI you do use.

The three ways in

Rapid Screen. The fast first step. We identify which of your systems make automated decisions, whether APP 1.7 captures them, and the size of the gap between your current privacy policy and what the law requires. You get a short, board-readable exposure summary and a clear next step. Days of work, not months.

Full Review. The complete inventory. Every system and vendor tool mapped, each decision classified against the obligation, and the privacy policy disclosure drafted to close the gap. Your legal team reviews and adopts; we do the heavy lifting.

Review and Board Pack. Everything in the Full Review, plus board-ready documentation: who's accountable for each automated decision, how the governance aligns with ASIC's stated expectations, and a remediation pathway for anything that shouldn't survive contact with a regulator.

Every engagement is fixed price and scoped in one short conversation. No hourly meters, no 80-page frameworks.

What you walk away with

• A defensible inventory of your automated decisions
• A privacy policy that meets the APP 1.7 disclosure requirement
• A plain-English account your board can give a regulator
• A prioritised view of the adjacent risks the review surfaces, and which ones are worth fixing

Why now

The deadline maths is unforgiving. A proper review takes weeks, legal adoption takes weeks more, and December is closer than it looks. Organisations that start now work with buffer and choice. Organisations that start in the fourth quarter will be competing with everyone else who waited, for advisory capacity that doesn't scale.

Who runs it

Ramon Rodriguez leads the review. He's an operator who has carried a P&L, not a career consultant, and he hosts Australia's executive AI podcast, Applied AI Australia. Delivery is backed by Acquire Intelligence, the Australian firm behind Applied AI Australia. You deal with a principal, and the work is built to be read by boards.

**