Privacy Act 2026 AI compliance checklist

You cannot govern what you have not mapped. These items build the inventory.

• We have a written inventory of every AI tool in use across the organisation.
• We know which personal information each AI tool handles or processes.
• We have identified which AI tools send personal information overseas and to which countries.Cross-border disclosure of personal information engages obligations under the Australian Privacy Act.
• We have assessed whether staff use consumer AI tools (ChatGPT, Gemini, Claude free tier) with work data.Consumer accounts on free tiers are a common route for sensitive data to leave the organisation.
• We have a formal approved-tool list that staff can consult before adopting a new AI tool.

From 10 December 2026, organisations must disclose in their privacy policy where AI makes or substantially assists decisions that significantly affect individuals.

• We have identified every AI use that screens, scores, ranks, or triages individuals.The Privacy and Other Legislation Amendment Act 2024 defines automated decision-making as using a computer program to make, or substantially assist in making, decisions that significantly affect individuals.
• Our privacy policy discloses where and how we use automated decision-making with personal information.This disclosure is mandatory from 10 December 2026 under the federal Privacy Act reform.
• We have a standard disclosure template for new AI uses that could constitute automated decision-making.See the ADM disclosure template at /resources/adm-disclosure-template-australia.
• We have reviewed whether our AI hiring, lending, insurance, health, or customer-service tools count as significant automated decisions.
• We have a scheduled date before 10 December 2026 to confirm all disclosures are live.

The Privacy Act reform tightened disclosure obligations and introduced enforcement teeth. The policy must reflect current AI use.

• Our privacy policy reflects how personal information is currently used in or processed by AI tools.
• Our privacy policy discloses the countries to which we send personal information via AI services.
• We have a practice of not including more personal information in AI prompts than the task requires.
• We understand how long AI vendors retain the data we send them and whether that matches our retention obligations.
• We have assessed how AI tool use changes our data breach surface area.The OAIC recorded 532 notifiable data breaches in H1 2025, with 37% caused by human error - the failure mode ungoverned AI use amplifies.
• We are aware that the Privacy Act reform allows infringement notices of up to $66,000 per contravention for certain breaches.

Human error drove 37% of notifiable data breaches in H1 2025. Training reduces the risk before it becomes a breach.

• All staff have been given a written AI usage policy and confirmed they have read it.
• We have a clear rule on whether personal or free-tier AI accounts are permitted for work tasks.
• Staff know which data categories must never be entered into AI tools without approval.
• Staff have received at least one training or briefing session on responsible AI use and privacy obligations.
• Staff have a clear pathway to report an AI-related data incident or suspected breach.

For Commonwealth agencies, naming accountability officials is already mandatory under the DTA policy. For private organisations, it is simply good practice.

• A named person (or role) is accountable for AI governance in our organisation.
• New AI tools go through a review process before adoption, not after.
• We review the privacy and data-handling terms of AI vendors before we use their tools with personal information.
• We maintain an AI register that records each tool, its owner, the data it processes, and who approved it.
• If we are a WA public sector entity, we have noted that the WA PRIS Act takes effect from 1 July 2026.The Privacy and Responsible Information Sharing Act 2024 (WA) brings the WA public sector under a formal privacy regime.

Governance is not a one-off exercise. These items keep the posture current as AI use evolves.

• We have a scheduled review of AI use and governance at least once per year.
• When a new AI tool is adopted mid-cycle, it is added to the register and reviewed against our policy before use.
• Our privacy policy has a review date and a named person responsible for keeping it current.
• We log any AI-related data incidents even when they fall below the notifiable breach threshold.
• We have reviewed the /resources/privacy-act-2026-ai-compliance guide or an equivalent reference.