Automated Decision Making in Australia

Monday, 7 September 2026

Why has automated decision making become a compliance priority?

The catalyst for Australia’s current regulatory focus on ADM was the Robodebt Royal Commission. Over six years, Centrelink’s automated income averaging system issued debt notices to hundreds of thousands of welfare recipients based on flawed data matching. The Royal Commission’s July 2023 report made specific recommendations on ADM governance, including the need for a cohesive legislative framework ensuring that algorithms are fit for purpose, lawful and fair. That report turned what had been a technical governance question into a political and institutional priority.

The response has been substantial. The Attorney-General’s Department conducted a public consultation between November 2024 and January 2025 on protections for government use of ADM. The Privacy and Other Legislation Amendment Act 2024, which received Royal Assent in December 2024, introduced a new ADM transparency obligation. In September 2024, the Government released the Voluntary AI Safety Standards (VAISS), followed in October 2025 by Guidance for AI Adoption. Each of these sits within a broader reform program that is still taking shape.

What does the 2024 privacy legislation require?

The Privacy and Other Legislation Amendment Act 2024 introduced an ADM transparency obligation that takes effect on 10 December 2026. From that date, organisations covered by the Australian Privacy Principles (APPs) must include in their privacy policies the types of personal information that may be used in substantially automated decisions with the potential to significantly affect an individual’s rights or interests. The OAIC is currently developing guidance to help organisations comply with this obligation, including clarifying what counts as a substantially automated decision and what level of disclosure is expected.

The scope is broad. The term “computer program” covers sophisticated AI and machine learning systems as well as simpler rule based automation. Any system that uses personal information to produce a decision with legal or similarly significant effect falls within the obligation. For government agencies, this means that existing automated processes, not just new ones, need to be reviewed against the disclosure requirement before the December 2026 deadline.

What does the Ombudsman’s Better Practice Guide require?

The Commonwealth Ombudsman’s 2025 Better Practice Guide is the operational compliance document for Australian government agencies. It sets out the principles that ADM systems must satisfy: legality (the decision must have a lawful basis), fairness (affected individuals must be treated equitably), rationality (the decision making path must be logical and explicable) and transparency (the public must be able to understand that ADM is being used and how it works).

The Guide includes a checklist for managers and project officers covering the design, implementation and ongoing assurance of automated systems. Key requirements include assessing whether the system meets Australia’s AI Ethics Principles, mapping whether the decision making path involves the exercise of judgement or discretion, identifying the legislative authority for automating the decision and ensuring that avenues of review remain available to affected individuals. The Guide makes clear that automation does not displace the requirement for administrative law compliance. A decision made by a computer program must meet the same legal standards as a decision made by a human officer.

For managers, the practical implication is that every automated system needs documented governance. This includes a record of why the decision was suitable for automation, what data inputs the system uses, how errors are detected and corrected and how affected individuals can seek review.

What should managers focus on to meet these requirements?

The compliance challenge for most agencies is not understanding the principles. It is applying them operationally across systems that may have been built years ago without the governance documentation the current framework requires. The first step is an inventory. Managers need to know which decisions in their area are partially or fully automated, what personal information those systems use and what legislative authority underpins each one.

The second step is disclosure. Before December 2026, privacy policies must be updated to describe the types of personal information used in ADM. This is not a generic statement. The OAIC’s consultation on ADM transparency guidance indicates that specificity will be expected. Agencies should identify each automated system, document the personal information categories it processes and draft disclosure language that meets the new standard.

The third step is review pathways. Automated decisions must remain reviewable. The Administrative Review Tribunal Act 2024, which replaced the Administrative Appeals Tribunal, reinforces that ADM should not displace review rights. Managers need to ensure that individuals affected by an automated decision can access a human review and that the system’s audit trail supports that review process.

How can managers build the capability to lead in this area?

ADM governance sits at the intersection of digital service delivery, administrative law and people management. The managers who are accountable for these systems are not typically technologists. They are operational leaders responsible for service delivery, compliance and team performance. What they need is the capacity to ask the right questions of technical teams, understand the legal obligations that apply and lead the governance processes that make ADM defensible.

AcademyGlobal (AG), the Chartered Institute of Procurement & Supply (CIPS) Centre of Excellence for Australia, New Zealand and Southeast Asia, delivers practitioner led training for public sector leaders navigating complex governance and compliance environments. AG’s Leadership & Management Skills programs are designed for professionals who need to lead teams through change, manage compliance obligations and make sound decisions under regulatory complexity. For managers overseeing ADM implementation, this includes building the judgement to assess when automation is appropriate, how to structure governance around it and how to maintain accountability when decisions are made by systems rather than people. AG’s Risk Management Fundamentals program provides the structured approach to identifying, assessing and managing the risks that ADM systems introduce, including the reputational and legal exposure that comes with automated processes affecting individuals’ rights.

The regulatory environment around ADM in Australia is still evolving. Managers who build governance capability now will be better positioned to meet the December 2026 deadline and adapt as the framework continues to develop.

Frequently asked questions

What is automated decision making in the Australian government context?

Automated decision making is the use of computer programs to make or substantially assist administrative decisions. It ranges from simple rules based calculations to complex AI systems. Australian government agencies have used ADM since 2001. The practice is now subject to specific transparency and governance requirements.

When does the new ADM transparency obligation take effect?

The transparency obligation introduced by the Privacy and Other Legislation Amendment Act 2024 takes effect on 10 December 2026. From that date, organisations must disclose in their privacy policies the types of personal information used in substantially automated decisions that could significantly affect individuals’ rights or interests.

Does the ADM framework apply to AI systems?

Yes. The framework covers any computer program used in decision making, including AI and machine learning systems. The Voluntary AI Safety Standards (September 2024) and the Guidance for AI Adoption (October 2025) provide additional principles specifically for AI, but the Privacy Act obligations apply to all forms of ADM.

What did the Robodebt Royal Commission recommend about ADM?

The Royal Commission recommended a cohesive legislative framework ensuring that algorithms and automated decision systems are fit for purpose, lawful and fair. It specifically recommended that agencies publish information on departmental websites explaining that ADM is used and how the process works.

Where can managers learn more about leading in complex compliance environments?

AcademyGlobal’s Leadership & Management Skills programs are designed for public sector leaders managing compliance obligations, team governance and organisational change.

References

1. Commonwealth Ombudsman, OAIC and Attorney-General’s Department, “Automated Decision-Making Better Practice Guide,” March 2025, https://www.ombudsman.gov.au/…

2. Attorney-General’s Department, “Automated Decision-Making Reform: Consultation,” https://consultations.ag.gov.au/integrity/adm/

3. Office of the Australian Information Commissioner, “Consultation on Guidance for Transparency in Automated Decision Making,” https://www.oaic.gov.au/engage-with-us/consultations/…

4. Privacy and Other Legislation Amendment Act 2024 (Cth), Royal Assent 10 December 2024

5. Government News, “Government Watchdog Updates ADM Guidelines,” March 2025, https://www.governmentnews.com.au/government-watchdog-updates-adm-guidelines/