Who should do your ADM disclosure work: a lawyer, a consultant, your own people or software
Four ways to get your privacy policy ready for the December ADM rules, being a lawyer, a consultant, your own people or software. What each is best at and what each costs.
Who should do your ADM disclosure work?
From 10 December 2026, Australian Privacy Principles 1.7 to 1.9 require your privacy policy to disclose the kinds of automated decisions that significantly affect people and the kinds of personal information used in them. Someone has to do that work, meaning find the systems, decide which ones the rules capture, update the policy and keep it true afterwards. There are four ways to get it done, and this page weighs them plainly. It is written by Aicura, which is the fourth option, so read it with that declared.
Option one: a privacy lawyer
Where a lawyer wins: legal judgement and privilege. Whether a specific decision “significantly affects” an individual is ultimately a legal question, and where your situation is contested, novel or high-stakes, a lawyer’s opinion is the thing nothing else on this page can be. If a regulator or a dispute is already in the picture, this is not a comparison, it is a referral.
Where a lawyer strains: a legal opinion describes your systems as at the date of the advice, and law firms price accordingly. The engagement answers the question you brought; it does not watch your systems afterwards, and few organisations can afford to ask again every time something changes. The common result is excellent advice about last year’s estate.
Option two: a privacy consultant
Where a consultant wins: process and thoroughness. A good consultancy interviews widely, finds automation your own people forgot, writes a policy update that reads professionally and hands over a register of what they found. For an organisation with no idea where it stands, a scoped review buys clarity fast.
Where a consultant strains: the deliverable is a set of documents true at handover, engagements of this shape commonly run to tens of thousands of dollars, and the standing obligation begins the day they leave. The December rules do not ask whether your policy was accurate when the consultants finished. They ask whether it is accurate.
Option three: your own people
Where in-house wins: cost and knowledge. Your people know where the automation is, or can find out, and the work of walking systems against the rules builds understanding no external party leaves behind. For a small, stable estate this is genuinely workable, and the how-to guides on this site exist to support exactly that path.
Where in-house strains: the first pass is a project, but the obligation is not a project. Somebody has to notice that the new tool scores applicants, that the vendor switched on a decisioning feature, that the policy no longer matches, and noticing is nobody’s job in most organisations. Manual registers decay quietly, and the disclosure drifts with them.
Option four: software
Where software wins: tense. Aicura is your AI Register, it scans your privacy policy against the ADM rules, surfaces which registered automated-decision systems are not yet disclosed and drafts the fixes for your review, and it does the same again when systems change or the register grows. The work the other three options do once, it keeps doing. A subscription costs less than any of the professional engagements above, and the disclosure question stops being an annual scramble. Current rates are on the pricing page.
Where software strains: it is not a legal opinion and does not pretend to be. Whether a borderline decision significantly affects someone can need a lawyer, and Aicura’s role is to put the question in front of you with the register evidence attached, not to answer it for you. The decisions stay with your people.
Choosing, practically
If you are in a dispute or a genuinely contested judgement call, start with the lawyer. If you do not know what you are running and want a professional first pass, a scoped consultant review or a disciplined in-house project both work. For everything after the first pass, which is most of the obligation’s life, the work is repetitive, standing and register-shaped, and that is what software is for. Many organisations sensibly combine them, with the register and scan running continuously and the professional judgement bought at the moments that need it, cheaper and sharper because the register already exists.
A note on this page
Written by Aicura, one of the four options above. The rules themselves are the primary source, so read APP 1.7 to 1.9 and the OAIC’s guidance directly, and nothing on this page is legal advice.
Related guides
- How to write an ADM transparency statement
- How to work out which of your systems make automated decisions
- Privacy compliance kits: what they do, what they miss and when software is the better buy
Related frameworks
Keep your disclosure true as your systems change
Aicura is your AI Register. It scans your privacy policy against the ADM rules and surfaces which automated-decision systems are not yet disclosed, and the scanning keeps pace as your systems change.