- What starts
- A transparency duty for automated decisions, in new APPs 1.7 to 1.9
- When
- 10 December 2026
- Who it binds
- Organisations covered by the Privacy Act, which excludes most small businesses
- What to do now
- Map what your phone software decides, then update the privacy policy
Most of the Privacy Act changes passed at the end of 2024 started straight away. One of them was given two years of lead time, and those two years are nearly up. From 10 December 2026, organisations covered by the Act have to explain in their privacy policy when they use computer programs to make decisions about people.
That sounds like a problem for banks and insurers, and mostly it is. But in 2026 a growing share of business phone lines are answered by software that does more than take a message, and some of what that software does is starting to look like deciding.
What the rule actually says
The Privacy and Other Legislation Amendment Act 2024 added new Australian Privacy Principles 1.7 to 1.9. In plain terms: if your organisation uses a computer program to make a decision, or to do something that substantially and directly relates to making one, and that decision could reasonably be expected to significantly affect an individual's rights or interests, your privacy policy has to describe two things. The kinds of personal information the program uses, and the kinds of decisions it makes or helps make.
Three things it doesn’t do are worth saying clearly, because the summaries going around tend to blur them.
- It’s not a ban. You can keep using the software. You’ve to be open about it.
- It doesn’t create a right to a human review. That idea was discussed during the reform process and isn’t part of this change.
- It’s not limited to generative AI. A rules engine written in 2012 is a computer program too. The obligation follows the decision, not the technology.
Who it applies to
Only organisations already bound by the Privacy Act. Most businesses with an annual turnover of $3 million or less are not, under the small business exemption, and that exemption wasn’t removed in this round.
The exemption has exceptions that catch more phone lines than people expect. A business that provides a health service is covered whatever its size, which takes in a large share of the clinics, physios and allied health practices that were early adopters of AI booking. So is a business that trades in personal information, and a business working as a contracted service provider to the Commonwealth. Larger customers increasingly write privacy obligations into supplier contracts as well, so the practical reach is wider than the statutory one.
Where a phone line starts making decisions
An AI agent that answers, takes details and books a plumber into the next free slot is probably not making a decision that significantly affects anybody. The caller wanted a booking and got one. Compare that with these, all of which are on offer from phone platforms in some form today:
- Triage. An agent that decides a clinic caller's matter can wait until next week, or that a caller doesn’t meet the criteria for a same-day appointment.
- Eligibility. Screening callers for a payment plan, a rental application, a job or a service area, and turning some of them away.
- Prioritisation. Lead scores generated from call transcripts that decide who gets a callback and who does not.
- Blocking. Automated fraud or nuisance flags that stop a number reaching the business at all.
Some of those will clear the "significantly affect" threshold and some will not, and where the line falls is ultimately a question for the regulator and for your own adviser rather than for a comparison site. The point is that you can’t answer it without knowing what your phone software is doing, and many businesses switched these features on from a settings page without writing any of it down.
A practical list before December
- Inventory the automation. AI answering, call scoring, sentiment flags, automatic routing based on who is calling, after-hours triage. Ask your provider for a list of what is switched on for your account, not what is available.
- For each one, ask whether it decides. Does it change what happens to the caller, or does a person decide with the output in front of them? "Substantially assists" means the second case can still count.
- Write down what goes in. Recordings, transcripts, the caller's number, CRM history. That list is half of what the privacy policy now has to say.
- Find out where it’s processed. If transcripts or recordings are sent offshore for processing, that’s already a cross-border disclosure question under APP 8, separate from the new rule and in force today.
- Update the privacy policy and tell callers up front. A short line at the start of the call that they’re speaking with an automated assistant is good practice regardless of the law, and it costs nothing.
Recording consent is a different question again, governed by separate federal and state law, and nothing in this change alters it.
Why where the platform lives matters here
Every one of those steps is easier when the platform, the data and the people who can answer your questions are in the same country as you. That’s part of why our scorecard gives Australian footprint a 20 per cent weight, and why the two Australian platforms at the top of our comparison table score well on it: recordings and transcripts stay onshore, and the answer to "what is this feature doing with my callers' data" comes from the company that wrote it.
None of this is a reason to switch the AI off. As we wrote in our piece on AI receptionists, the good implementations already say who they’re and hand over to a human early. The new rule mostly asks you to write down what a well-run deployment should already be able to explain.
This article is general information, not legal advice. It summarises the amendments as passed in 2024 and published commentary on them. The Office of the Australian Information Commissioner is the authority on how the obligation is applied; check its current guidance and take advice on your own circumstances.
The two that topped our 2026 scorecard
Uniden Voice over Cloud scored 95/100 at $34.90 per user per month with calls, AI agents and 40+ call-flow features included. VOCPhone scored 92/100 and is the one to shortlist if the phone is a sales tool.
Questions
Does the new rule ban AI receptionists or AI call agents?
No. It’s a transparency obligation, not a prohibition. If a computer program makes, or substantially assists in making, a decision that could reasonably be expected to significantly affect someone, your privacy policy has to say what kinds of personal information it uses and what kinds of decisions it makes. Nothing in it stops you using the software.
My business turns over less than $3 million. Does this apply to me?
Usually not, because most businesses at or under that turnover are outside the Privacy Act altogether. The exemption doesn’t cover everyone, though. Health service providers, businesses that trade in personal information and contracted service providers to the Commonwealth are covered regardless of size, so a small clinic with an AI receptionist may well be in scope. If you’re unsure which side of the line you sit, get advice.
Is an AI call summary an automated decision?
A summary on its own normally is not. It becomes relevant when the summary, a score or a flag feeds a decision that significantly affects the caller, such as whether they get an appointment, a payment arrangement or a callback at all. The test is about the effect of the decision, not about whether the technology is called AI.
Related articles
- The AI receptionist stopped being a demo this year (AI, 8 min read)
- Your telco’s cloud phone system probably isn’t theirs (Analysis, 7 min read)
- Before the Christmas shutdown: six phone settings to check while the office is still open (Guide, 6 min read)
Or go straight to the 2026 comparison table, try the phone system finder, or browse all news and analysis.