Privacy Act 2026 AI compliance checklist

You cannot govern what you have not mapped. These items build the inventory.

• We have a written inventory of every AI tool in use across the organisation.
• We know which personal information each AI tool handles or processes.
• We have identified which AI tools send personal information overseas and to which countries.Cross-border disclosure of personal information engages obligations under the Australian Privacy Act.
• We have assessed whether staff use consumer AI tools (ChatGPT, Gemini, Claude free tier) with work data.Consumer accounts on free tiers are a common route for sensitive data to leave the organisation.
• We have a formal approved tool list that staff can consult before adopting a new AI tool.

From 10 December 2026, organisations must disclose in their privacy policy where AI makes or substantially assists decisions that significantly affect individuals.

• We have identified every AI use that screens, scores, ranks, or triages individuals.The Privacy and Other Legislation Amendment Act 2024 defines automated decision-making as using a computer program to make, or substantially assist in making, decisions that significantly affect individuals.
• Our privacy policy discloses where and how we use automated decision-making with personal information.This disclosure is mandatory from 10 December 2026 under the federal Privacy Act reform.
• We have a standard disclosure template for new AI uses that could constitute automated decision-making.See the ADM disclosure template at /resources/adm-disclosure-template-australia.
• We have reviewed whether our AI hiring, lending, insurance, health, or customer service tools count as significant automated decisions.
• We have a scheduled date before 10 December 2026 to confirm all disclosures are live.

The Privacy Act reform tightened disclosure obligations and introduced enforcement teeth. The policy must reflect current AI use.

• Our privacy policy reflects how personal information is currently used in or processed by AI tools.
• Our privacy policy discloses the countries to which we send personal information via AI services.
• We have a practice of not including more personal information in AI prompts than the task requires.
• We understand how long AI vendors retain the data we send them and whether that matches our retention obligations.
• We have assessed how AI tool use changes our data breach surface area.The OAIC recorded 532 notifiable data breaches in H1 2025, with 37% caused by human error. That is the exact failure mode ungoverned AI use amplifies.
• We are aware that the Privacy Act reform allows infringement notices of up to $66,000 per contravention for certain breaches.

Human error drove 37% of notifiable data breaches in H1 2025. Training reduces the risk before it becomes a breach.

• All staff have been given a written AI usage policy and confirmed they have read it.
• We have a clear rule on whether personal or free tier AI accounts are permitted for work tasks.
• Staff know which data categories must never be entered into AI tools without approval.
• Staff have received at least one training or briefing session on responsible AI use and privacy obligations.
• Staff have a clear pathway to report an AI related data incident or suspected breach.

For Commonwealth agencies, naming accountability officials is already mandatory under the DTA policy. For private organisations, it is simply good practice.

• A named person (or role) is accountable for AI governance in our organisation.
• New AI tools go through a review process before adoption, not after.
• We review the privacy and data handling terms of AI vendors before we use their tools with personal information.
• We maintain an AI register that records each tool, its owner, the data it processes, and who approved it.
• If we are a WA public sector entity, we have noted that the WA PRIS Act takes effect from 1 July 2026.The Privacy and Responsible Information Sharing Act 2024 (WA) brings the WA public sector under a formal privacy regime.

Governance is not a one-off exercise. These items keep the posture current as AI use evolves.

• We have a scheduled review of AI use and governance at least once per year.
• When a new AI tool is adopted mid cycle, it is added to the register and reviewed against our policy before use.
• Our privacy policy has a review date and a named person responsible for keeping it current.
• We log any AI related data incidents even when they fall below the notifiable breach threshold.
• We have reviewed the /resources/privacy-act-2026-ai-compliance guide or an equivalent reference.