01
The vendor handles it
The vendor may operate the technology, but your organisation may still have arranged for it to be used in the decision process.
The real problem
Finding the decisions comes before disclosing them.
Updating a privacy policy is the final step. The harder task is finding every workflow where software uses personal information to make or substantially support a decision that may significantly affect someone.
- /vendor platforms bought years ago
- /rules engines and spreadsheets
- /features enabled inside existing software
- /workflows where staff usually accept a system recommendation
- /processes owned by operations rather than legal or procurement
A software register shows what the organisation bought. It does not show every decision those systems make or shape.
Decision impact scan
You may need a review when software affects an outcome about a person.
The legal test depends on the role of the computer program, the personal information it uses and the significance of the outcome. Artificial intelligence is not the deciding factor because the Australian Privacy Principles are technology-neutral.
- 01who reaches a recruiter's shortlist
- 02who qualifies for credit, insurance or another service
- 03what premium, rate, limit or price someone receives
- 04whether a claim, refund or account review is approved
- 05whether an account is flagged, held or restricted
- 06which customers receive priority or specialist support
- 07who receives work, shifts, benefits or opportunities
Three common assumptions
02
A person approves it
A final human click does not automatically resolve the issue. The system may still have substantially shaped the recommendation or outcome.
03
It is only a rule or spreadsheet
The obligation refers to computer programs. Legacy rules, scoring tools and established software may still require assessment.
The Rapid Review
Answers the questions your board will ask.
- which systems make or substantially support decisions about people
- which personal information each workflow uses
- what outcome the system influences
- whether human review is genuine and effective
- which vendor tools require further investigation
- which workflows may require privacy policy disclosure
- which gaps need legal, operational or governance action
You receive a clear decision map, an exposure summary and a prioritised action list.
Choose the review depth
01
Rapid Screen
Confirms where to investigate.
The Rapid Screen identifies the systems and workflows most likely to warrant assessment.
- a focused review of priority workflows
- an initial view of possible APP 1.7 exposure
- a short executive summary
- a recommended next step
02
Full Review
Builds the complete decision inventory.
The Full Review maps relevant systems and vendor tools, records the personal information used, examines human involvement and classifies each workflow against the obligation.
- a decision register
- workflow-level findings
- identified disclosure gaps
- draft plain-English disclosure content for legal review
- a prioritised remediation plan
03
Review and Board Pack
Adds accountability and governance.
This option includes the Full Review plus board-ready documentation.
- named ownership for each decision workflow
- governance and oversight findings
- a board-level risk summary
- a practical remediation pathway
- materials designed for executive and legal review
Every engagement is fixed-price and scoped through one initial discussion.
Why now
Delay reduces the time available for discovery, legal review and remediation.
APP 1.7 begins on 10 December 2026. A proper review may require input from legal, privacy, procurement, technology and the operational teams that use the systems each day.
Starting before the final quarter leaves time to investigate rather than assume.
Financial services
A visible governance gap already exists.
ASIC reviewed 624 artificial intelligence use cases across 23 financial services licensees. Nearly half of those licensees lacked policies that considered consumer fairness or bias.
The finding does not determine APP 1.7 scope, but it shows why software use and governance records may not align.
Who runs it
Ramon Rodriguez leads the review.
Ramon advises Australian executives on artificial intelligence strategy, governance and operational risk. He spent fifteen years carrying commercial P&L accountability at News Corp Australia and approaches the work as an operator rather than a career consultant.
You work directly with a principal, and the output is designed for boards, legal teams and operational owners.
Start with what is not mapped
Identify the decisions you have not mapped.
Start by establishing whether your organisation may be covered, which workflows should be examined first, and whether a Rapid Screen or Full Review is appropriate.
Frequently asked questions