There is an AI deadline in December. Most businesses have not heard of it.

Most of the AI conversation right now is about what you could build. This one is about what you have to disclose.

On 10 December 2026, a change to Australia's privacy law takes effect. If your business uses someone's personal information inside a computer program to make, or to substantially help make, a decision that significantly affects them, your privacy policy has to say so. In plain terms: if software is helping decide who gets approved, priced, hired or turned away, you now have to disclose it.

This applies to organisations covered by the Privacy Act. Broadly, that means businesses turning over more than three million dollars a year, though some smaller ones are caught too, including health providers and any business that trades in personal data. If you are genuinely not sure whether it applies to you, that uncertainty is worth a real answer from someone qualified, because the penalties for getting it wrong are not small.

The part that catches people is how wide "computer program" is drawn. It is not only the tools you think of as AI. A rule-based system counts. A spreadsheet that scores or ranks people counts. A machine-learning model counts. The test is not how clever the software is, it is whether a person's rights or interests are significantly affected. The textbook example the regulator gives is home loan eligibility. If you are a broker, a lender or an insurer, this is squarely about you.

What you actually have to do is not dramatic. Your privacy policy needs to spell out the kinds of personal information these programs use, and the types of decisions they make or help make. The work is not the writing. It is knowing, honestly, every place in your business where software is quietly making a call about a real person.

Here is the uncomfortable bit. Decidr's 2026 report found 91% of businesses know a privacy change is coming. Far fewer have done anything about it. The regulator's guidance on how to comply only arrived around September, which leaves roughly ten weeks to the deadline.

It is tempting to file this under boring and deal with it later. I would not. Not because of the fine, though that is real, but because of what it signals. The businesses that sort this before December are the ones a client feels safe handing their information to. In a market where trust is the thing that actually wins the work, being visibly on top of this is worth more than the box it ticks.

It is also the kind of gap that only shows up when someone maps how the business really runs: where personal data goes, which tools touch it, and what gets decided without a human in the loop. That is exactly the sort of thing a HALO™ review is built to surface.

If you would rather just jump on a quick call, to chat through what's holding your business back: grab a time here.

This is general information, not legal advice. Check your own obligations with a qualified adviser. The deadline and requirements refer to the automated decision-making transparency reforms to the Privacy Act 1988, in effect 10 December 2026, per the Office of the Australian Information Commissioner. The awareness figure (91%) is from The state of AI in Australian business 2026, commissioned by Decidr, fieldwork by Nature, survey of 1,324 Australian business decision-makers.