May 25, 2026ZynexAI Security & Risk Management: How to Build Safe AI Systems
AI Security & Risk Management: How to Build Safe AI Systems
AI Compliance
AI Compliance Audit: 7 Steps to Meet Australia's 10 December 2026 Privacy Deadline
Published:October 7, 2026
Read time:13 min read
An AI compliance audit in Australia is a structured review of every computer program, AI tool and automated workflow your business uses to make or support decisions about people. From 10 December 2026, Privacy Act entities must disclose these decisions in their privacy policy. Most mid-sized businesses can complete the audit and policy update in 3 to 6 weeks.
Table of Contents
Blog Summary
An AI compliance audit in Australia is a structured review of every computer program, AI tool and automated workflow your business uses to make or support decisions about people. From 10 December 2026, Privacy Act entities must disclose these decisions in their privacy policy. Most mid-sized businesses can complete the audit and policy update in 3 to 6 weeks.
Introduction
An AI compliance audit in Australia is a structured review of every computer program, AI tool and automated workflow your business uses to make or support decisions about people. From 10 December 2026, Privacy Act entities must disclose these decisions in their privacy policy. Most mid-sized businesses can complete the audit and policy update in 3 to 6 weeks.
This guide is for Australian businesses that are covered by the Privacy Act and use software to approve, price, rank, screen or flag people. It walks through what the new rule actually requires, the seven audit steps we use with clients, what it costs in time and money, and where most businesses trip up.
What changes on 10 December 2026?
From 10 December 2026, APP entities must add automated decision-making disclosures to their privacy policies. The change comes from the Privacy and Other Legislation Amendment Act 2024, which gave businesses two years to prepare.
According to the OAIC's guidance, the obligation applies when three things are true:
- You have arranged for a computer program to make a decision, or to do something substantially and directly related to making a decision.
- The decision could reasonably be expected to significantly affect the rights or interests of an individual.
- Personal information is used in the operation of that program.
When all three apply, your privacy policy must state the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds of decisions where the program does something substantially and directly related to the decision.
Who has to complete an AI compliance audit?
Any business covered by the Privacy Act that uses software in decisions about people should run an AI compliance audit before the deadline. In practice, that means businesses with annual turnover above $3 million, plus smaller businesses that are covered anyway, such as health service providers and businesses that trade in personal information.
One trap we see often: businesses assume 'we don't use AI' and stop there. The law says 'computer program', not 'artificial intelligence'. A rules-based eligibility check written in 2015 is in scope just as much as a machine learning model built last month.
Which decisions fall inside the scope?
A decision is in scope when it could significantly affect someone's legal rights, finances, employment, housing, health, or access to important services. Allens' summary of the OAIC guidance highlights a vulnerability lens: would the outcome land differently on a vulnerable person than on the general population?
| System or workflow | Example decision | Likely in scope? |
|---|---|---|
| Credit or payment terms engine | Approves or declines trade credit for a customer | Yes |
| Recruitment platform filter | Rejects applicants who fail a knockout question | Yes |
| Dynamic pricing tool | Shows different prices to different customers using their data | Likely |
| Tenant or customer screening API | Flags an applicant as high risk | Yes |
| CRM lead scoring | Ranks leads so sales calls the top 20% first | Depends on impact, assess case by case |
| Chatbot answering opening hours | No decision about the person | No |
| Inventory reorder automation | Uses no personal information | No |
The 7-step AI compliance audit
An AI compliance audit has seven steps: inventory, filter, trace data, classify, check vendors, draft disclosures and set up governance. Here is how we run each one.
- Step 1: Build a full inventory of programs that touch decisions. List every system that makes, recommends, scores, filters or ranks anything involving a person, including CRM, HR, finance tools and spreadsheet logic.
- Step 2: Filter for decisions with significant effect. Run each item through the impact test. If it changes what someone gets, pays or is allowed to do, keep it on the list.
- Step 3: Trace the personal information each program uses. Write down the categories of personal information it consumes, such as contact details, transaction history, location, employment records or behaviour data.
- Step 4: Classify each decision as 'solely automated' or 'substantially supported'. Be honest here. A human who rubber-stamps most recommendations is not a meaningful check.
- Step 5: Check your vendors and integrations. Third-party software counts if you arranged for it to be used. Ask vendors what personal information their tools use and what logic they apply.
- Step 6: Draft and publish the privacy policy disclosures. Group decisions into plain English categories, describe the personal information used and get legal review before publishing.
- Step 7: Set up governance so the policy stays accurate. Add a procurement and change check: if a tool makes or supports decisions about people, update the register and the policy.
How long does an AI compliance audit take, and what does it cost?
For most mid-sized Australian businesses, an AI compliance audit takes 3 to 6 weeks from kickoff to published policy update. The biggest variable is how many systems and vendors are involved, not the size of the business.
| Business profile | Typical scope | Indicative timeline |
|---|---|---|
| Single entity, 3 to 5 core systems | One workshop, vendor checks, policy update | 2 to 3 weeks |
| Multi-site, 6 to 12 systems including HR and finance tools | Department interviews, vendor review, register build | 3 to 5 weeks |
| Group with custom AI or in-house models | Model documentation, data lineage, governance design | 5 to 8 weeks |
With roughly nine weeks between early October and the deadline, businesses with more than a handful of systems should start now. Vendor responses are almost always the slowest part.
What we see in practice
We run these audits alongside our custom AI development work, so we see both sides: the systems being built and the policies describing them. A few patterns come up again and again.
- The inventory is always bigger than expected. On a typical first workshop, the client lists four or five systems. By the end of week one the register often has 10 to 15 because HR, finance and marketing each have their own tools.
- Spreadsheets get missed. A credit approval spreadsheet with nested IF formulas is a computer program making a decision. We have found these in businesses that were sure they had no automation at all.
- Human in the loop is often thinner than people think. If a manager approves a day's recommendations in one bulk click, regulators are unlikely to see that as meaningful human review.
- Vendors are slow. Ask them early, in writing, and keep a record of what they tell you.
- The policy is not the finish line. The businesses that cope best treat the register as a living document and connect it to their wider AI security and risk management practices.
Should you run the audit yourself or bring in a partner?
You can run an AI compliance audit in-house if you have a small number of systems and someone with time to chase vendors. Bring in a partner if you have custom AI, many integrations or a tight deadline. The steps above are not secret. What a partner adds is speed, a tested inventory template, and technical people who can read a model or integration and tell you what it actually does.
If you're also deciding where AI should go next, our AI Strategy Report combines the compliance view with a roadmap, so the audit doubles as planning.
Final Thoughts
The deadline is close enough that businesses need to treat this as an operational compliance task, not a legal side project. The cheapest and safest approach is to map all automated decisions, classify the impact, review vendors, and update the privacy policy before the policy rewrite becomes urgent.
The businesses that keep a live register and connect it to change control will be in the strongest position when new AI tools are introduced in the next twelve months.
Frequently Asked Questions
1. Does the 10 December 2026 rule ban automated decisions?
No. The rule is about transparency, not prohibition. Businesses can keep using automated and AI-assisted decisions, but their privacy policy must explain the kinds of decisions made and the kinds of personal information used.
2. Do we need to disclose how our algorithm works?
No. The privacy policy needs to describe the kinds of decisions and the kinds of personal information involved, not the underlying logic or scoring method. Clear, plain-English categories are what regulators expect to see.
3. Does using ChatGPT or Copilot at work put us in scope?
Only if those tools are used to make, or substantially and directly support, decisions that significantly affect individuals using their personal information. Staff using an AI assistant to draft emails is usually out of scope. Using it to screen job applications or assess customer eligibility is a different matter and should be audited.
4. Are third-party tools our responsibility?
Yes, if you arranged for the tool to be used in your decision-making. A recruitment platform, credit check service or pricing engine supplied by a vendor still counts as your computer program for disclosure purposes. Ask vendors what personal information their tool uses and record their answers in your register.
5. How much does an AI compliance audit cost in Australia?
Cost depends mainly on how many systems and vendors are involved. A small business with a few core systems needs far less work than a group running custom AI models. Expect separate costs for legal review of the final privacy policy wording. Ask any provider for a fixed scope and timeline before you start.
6. What happens if we miss the deadline?
Missing the deadline exposes your business to OAIC complaints and regulatory action, and the 2024 amendments expanded the OAIC's enforcement tools. Beyond the legal risk, an inaccurate privacy policy is a trust problem with customers and enterprise clients, many of whom now ask about AI use in their supplier due diligence.
Talk to us before the deadline
Not sure how many of your systems are in scope? Book a call with our Melbourne team and we'll scope your AI compliance audit, give you a timeline, and tell you honestly whether you need us or can do it yourself.