What are my Privacy Act obligations if my staff use ChatGPT or other AI tools?

If your organisation is covered by the Privacy Act, the Australian Privacy Principles apply when your staff use AI with personal information. The OAIC recommends, as a matter of best practice, that you do not enter personal information, especially sensitive information, into publicly available generative AI tools. A separate transparency obligation for some automated decision-making takes effect on 10 December 2026. This is general information, not legal advice.

Can my staff put client information into ChatGPT?

The OAIC recommends, as a matter of best practice, that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. If your organisation is covered by the Privacy Act, the Australian Privacy Principles still apply to personal information put into a tool, and to any output that contains personal information.

That recommendation comes from the OAIC's guidance on commercially available AI products, published on 21 October 2024 and updated on 17 January 2025. The same guidance says organisations should not use an AI product simply because it is available. If personal information is put into a system, APP 6 still has to be considered.

The choice of tool still sits with you and your advisers.

Do I have to update our privacy policy for AI?

The OAIC's guidance on commercially available AI products, updated on 17 January 2025, says organisations should update their privacy policies and notifications with clear information about their use of AI. Public-facing tools such as chatbots should be clearly identified as such. A separate transparency obligation for some automated decision-making takes effect on 10 December 2026.

Whether your current policy is enough depends on whether your organisation is an APP entity, how AI is used, and whether the later rule described below applies.

What changes on 10 December 2026?

From 10 December 2026, APP entities that meet a specific test will need to include certain information in their privacy policies about automated decisions. The Privacy and Other Legislation Amendment Act 2024 starts these rules 24 months after Royal Assent (10 December 2024), and the OAIC gives the date as 10 December 2026.

The test is in the new APP 1.7. It applies if three things are all true: the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; that decision could reasonably be expected to significantly affect the rights or interests of an individual; and personal information about that individual is used in the operation of the program to make the decision or do that thing.

If that test is met, APP 1.8 says the privacy policy must include the kinds of personal information used in those computer programs, the kinds of decisions made solely by those programs, and the kinds of decisions for which a thing substantially and directly related to making the decision is done by those programs. I have kept close to the wording of the Act.

The OAIC published resources on this obligation on 30 September 2026, including a fact sheet and an update to the APP 1 guidelines. Those pages state the same commencement date.

Does every use of AI count as automated decision-making under that rule?

No. The 10 December 2026 obligation does not capture every use of ChatGPT. It applies only where APP 1.7 is met: a computer program makes, or does a thing substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, and personal information about that individual is used.

APP 1.9 adds that making a decision includes refusing or failing to make one, and that the effect may be adverse or beneficial. The Act's examples, which are not a complete list, include granting or refusing a benefit under an Act or a legislative instrument, a decision that affects rights under a contract, agreement or arrangement, and a decision that affects access to a significant service or support.

A staff member asking a public chatbot to tidy a paragraph is not, on its own, the same thing as a system that decides a claim, a contract, or access to a service. Some uses will sit in a grey area. Get advice on your own facts rather than treat every login as an automated decision.

Who should be accountable for AI use in a mid-sized firm?

The National AI Centre's foundations guidance, published on 5 May 2026, tells organisations to assign a senior leader as the overall AI governance owner. That can be you, or another senior person in the business, if they have the authority to oversee how AI is used. A Fractional Chief AI Officer can help you design the work. They do not take your place.

I have already defined that advisory in the earlier article. The person accountable for governance is still inside your firm. If you want help after you have a dollar figure on the leak, the Fractional Chief AI Officer advisory is the later work.

How should I start, given these rules?

Start by being honest about how staff already use these tools, and by putting a dollar figure on the work that is already costing you time and money, as I set out in Where should I start with AI in my Australian business?. The 45-minute diagnostic is that first meeting. It is not a Privacy Act review. If it's small, we'll say so.

The diagnostic looks at time and money already being lost. It does not assess your privacy policy, and it does not replace legal advice.

Put a dollar figure on the problem

Book the 45-minute diagnostic and leave with a dollar figure on the leak. The meeting is not a legal review.

Author

I'm Johnny Sukkar, founder of Versantly, which is operated by Lycaon Media Pty Limited (ABN 22 671 975 983). I've been in lending since 1990 and in broking since 2008, and I've been building and running AI workflows inside my own brokerage since 2023.