Software for the Privacy Act ADM disclosure obligation
From 10 December 2026, APP 1.7 to 1.9 require you to disclose in your privacy policy where you make automated decisions that significantly affect people. Aicura is your AI Register. It scans your privacy policy against those rules and surfaces which of your registered automated-decision systems are not yet disclosed.
Aicura is AI governance support, not a compliance verdict. It helps you disclose and keep that disclosure true as your systems change. It does not certify you or tell you that you are compliant.
What you have to do
The obligation is narrow and specific. From 10 December 2026, the Australian Privacy Principles require your privacy policy to set out where you use automated decision-making that significantly affects the rights or interests of an individual.
In plain terms, the work has three parts.
Know your automated decisions. You need to know which of your systems make, or substantially help make, decisions about people. A decision counts when it has a real effect on someone, for example whether they get a loan, a job, a price or a service.
Say so in your privacy policy. APP 1.7 to 1.9 ask you to disclose the kinds of personal information involved and the kinds of decisions made by those systems. The disclosure lives in your privacy policy, where people can read it.
Keep it current. The privacy policy has to match what you actually do. Every time you add or change an automated-decision system, the disclosure has to keep up, or it stops being true.
The first two parts are a project you can finish before December. The third part continues as your systems change, and that is the part Aicura is built for.
For the full explanation of the obligation, who it applies to and what "significant effect" means, read the ADM framework explainer.
How Aicura does it
Aicura works from your own systems and your own privacy policy.
It is your AI Register. You register each automated-decision system once, and the register is the standing record of what you run, what data it uses and what decisions it makes.
It scans your privacy policy against the ADM rules. Aicura reads your current privacy policy and reviews it against what APP 1.7 to 1.9 ask you to disclose.
It surfaces what is not disclosed. Aicura compares the register to the policy and shows you which registered automated-decision systems your privacy policy does not yet mention.
This work is generated, not billed by the hour. Aicura recommends what to disclose and drafts the language, and the decision about what your policy says stays with you and your people. Aicura does not issue a score, a green light or a verdict.
What a register alone does not close
You can hold a complete AI Register and a published privacy policy and still not know which systems are missing from it. The register records what you run and the policy records what you disclose, but neither one shows you where the two disagree.
That reconciliation is what Aicura does. It reads both sides and surfaces the difference between them, the registered systems that are making automated decisions and are not yet named in your privacy policy. A manual review can do this once, for the day it is done. A consultant does this once and bills for the hours, and the result is out of date as soon as your next system ships.
Aicura does it as standing work. The register and the policy stay reconciled as you change, not just on the day someone looked.
Why this is a subscription, not a one-off fix
December 2026 is the reason to act now, and it is a real one. But the disclosure is not a document you finish once and file away.
Your automated-decision systems will change. You will add new ones, retire old ones and change what existing ones do. Each of those changes can pull your privacy policy out of step with what you actually run. A disclosure that was true in December is not automatically true a quarter later.
Aicura is the reconciliation you re-run. It is a standing subscription that keeps the AI Register and your privacy policy reconciled as your systems change, so the disclosure stays true after the deadline, not just on it. What you are subscribing to is the ongoing work that keeps disclosure current, rather than a one-time fix you cancel in January.
FAQ
Start finding the automated-decision systems your privacy policy does not yet cover, and keep that disclosure true as you change.
Want the background first? Read the Privacy Act ADM framework explainer.
A note on this page. This page explains how Aicura supports your disclosure work under the Australian Privacy Principles. It is general information about AI governance support and is not legal advice. The authoritative source for the automated decision-making obligation is the Privacy Act 1988 (Cth) and the Australian Privacy Principles as administered by the Office of the Australian Information Commissioner. Aicura Pty Ltd. provides AI governance support and does not certify, audit or issue a compliance verdict.