From 10 December 2026, NDIS and aged care providers using AI must disclose it in their privacy policy. Here’s exactly what the law requires.
From 10 December 2026, if your care business uses AI to support decisions that affect participants and that isn’t disclosed in your privacy policy, you’re not meeting your legal obligations. Not a best practice recommendation. A legal obligation.
The Privacy and Other Legislation Amendment Act 2024 introduced a new requirement under Australian Privacy Principle 1. Any business covered by the Privacy Act that uses personal information in automated decision making, where that decision could significantly affect the rights or interests of an individual, must include a specific disclosure in their privacy policy.
Two things must be disclosed: what kinds of personal information your business uses in those automated processes, and what kinds of decisions are being made using automated decision making. That’s the minimum the law requires. A policy that addresses neither of those things right now is not ready.
Who this applies to
Most care providers are covered regardless of their size. Health service providers are generally excluded from the small business exemption under the Privacy Act, which means an NDIS provider or aged care operator handling participant health information is likely an APP entity, whether they’re turning over $3M or $300,000.
If you’re unsure whether you’re covered, check your own position now, not in November. The deadline doesn’t move, and a conversation with your legal adviser costs considerably less than a compliance gap found in an audit.
What counts as automated decision making
This is where a lot of providers get tripped up. Automated decision making isn’t just a robot making a call in isolation. It’s any process where a computer program uses personal information to produce a decision that could significantly affect someone.
Think about what’s running in your operations right now. Rostering tools that determine shift allocation. AI that flags incidents or generates progress note drafts. Systems that use participant data to generate recommendations. Any software that takes participant information and produces an output that shapes how they receive support.
If those tools are in your business and they’re touching participant information, this applies to you.
The OAIC has confirmed the requirement applies to decisions made from 10 December 2026 onwards, regardless of when the system was set up. It doesn’t matter that your team started using a rostering tool in 2023. If it’s running on participant information after 10 December and producing decisions that affect them, your policy needs to cover it.
What your privacy policy needs to say
A policy that says your business “uses AI for administrative purposes” doesn’t meet the obligation. Specificity is the point.
Participants have a right to understand when their information is being processed by an automated system. Vague language doesn’t give them that. A policy that names what the tool uses and what decision it produces does.
Here’s the difference in practice. “We may use technology to support service delivery” tells a participant nothing. “We use an automated rostering tool that uses participant availability, support needs, and worker qualifications to allocate support shifts” gives them an actual picture of what’s happening with their information.
For each AI tool in your operations, answer two questions. What personal information does this tool use? What decision does it produce or support? Those two answers are the substance of your disclosure. They’re also your evidence if the OAIC ever asks how a significant decision about a participant was made.
The disclosure doesn’t need to be lengthy. It does need to be accurate.
What the guidance says, and what it doesn’t
The OAIC had not published detailed guidance specific to care sector businesses as at September 2026. That doesn’t reduce your obligations. The APP guidelines, updated in October 2025, already set out what the obligation requires.
The absence of sector specific guidance means you work from the principle, not that you wait. The deadline is December. Compliance can’t wait for guidance that may or may not arrive before then.
Where to start this week
Before you can update your privacy policy, you need to know what’s actually in your operations. Not what you’ve officially rolled out. What your team is using day to day.
Start with a list. Every AI tool your business uses that touches participant information. Progress note drafting tools. Rostering software. Incident flagging systems. Communication tools that process participant data. Anything that takes participant information and produces an output that affects them.
Then open your current privacy policy. Find the section that deals with how you collect, use, and store personal information. Read it as if you were a participant who had just asked how your business handles their information.
If there’s nothing in it about automated decision making, AI tools, or computer programs used to support decisions about them, you know exactly where to start. That list is step one. The policy update follows from it.
The bigger picture
This is the first time Australian law has required businesses to be explicit about AI in their compliance documents. It reflects a shift in how regulators are thinking about the use of technology in services that affect vulnerable people.
NDIS and aged care providers are already operating in one of the most compliance-intensive environments in the country. Adding AI to that environment without documenting it properly creates a gap in your obligations. The gap is closable, and December gives you time to close it.
The providers who move on this now won’t be scrambling in November. That’s the practical case for doing it this week.