Clause · Privacy, Data Protection & Cyber
AI and automated decisions clause for privacy policies and collection notices
Modular privacy policy wording on AI: how AI is used, chatbot labelling, the APP 1.7 to 1.9 automated-decision disclosure required from 10 December 2026, AI-inferred information, training and overseas AI providers, plus a short chatbot collection notice.
- Kind
- Clause. Wording to drop into a longer document.
- Where it applies
- Australia
- AI use
- Yellow AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at
- 17 October 2026
- Status
- Maintained. Checked against the cited sources on 17 October 2026.
- Version
- 1
- Source
- Written for this library
When to use it
Use when a client already has an adequate privacy policy and needs to add AI and automated-decision content before 10 December 2026. Build Module C only from a verified inventory of the computer programs the client uses in significant decisions.
How AI may be used
AI may draft the modules from the client's confirmed inventory and compare the result with the OAIC guidance. A lawyer confirms every statement is true and complete.
AI may
- Turn a client-approved inventory of systems and decisions into the Module C table.
- Check the draft against APP 1.8(a) to (c) and the OAIC's guidance on level of detail.
- Check that the chatbot notice covers the APP 5 matters and matches the policy.
AI must not
- Must not decide that a decision is not "significant" or that a program is not "substantially and directly related" to a decision.
- Must not choose Module E Alternative A (no training) unless contracts and configuration confirm it.
- Must not describe safeguards the client does not have.
The lawyer checks
- Module C covers every decision in scope, grouped meaningfully, with sensitive information called out.
- The chatbot is labelled as AI in the product itself, not only in the policy.
- The wording is consistent with collection notices, terms of use and vendor contracts.
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Official form
Open the official form. Always use the current version from the issuer.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
- Notifiable data breach statement to the OAIC: completion guide for the online form
- APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
- Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
- Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
- Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area