AI hiring disclosure Australia: the new right that starts in December 2026

You've probably assumed, correctly, that some part of your job application gets read by software before a person sees it. What you haven't had is any right to be told that in plain terms, or what that software is actually looking at. From 10 December 2026, that changes for a real slice of Australian recruitment, and it's worth understanding exactly what the new right covers before you rely on it.

The position worth stating first: this is a genuine, dated legal change, not a proposal or a lobbying wishlist. It gives you a specific, checkable thing to look for in a company's privacy policy, and specific questions you're now entitled to ask a recruiter, even though it stops well short of a right to appeal an AI-influenced decision or to see the exact scoring behind it.

What the new disclosure right actually is

The change comes from amendments to the Privacy Act 1988, and it creates a new automated decision-making (ADM) transparency obligation for entities covered by the Act. Norton Rose Fulbright's analysis of the reform confirms the obligation commences on 10 December 2026 and applies to decisions made from that date. Once it's in force, a covered organisation has to include, in its own privacy policy, what personal information its automated systems use and what kinds of decisions those systems make or materially help make.

That's a narrower right than "AI can't reject you" or "you get to see your score." It's a transparency obligation aimed at the privacy policy itself: an employer using a computer program in its recruitment process has to say so, and say broadly what it does, in a document you're entitled to read before or after you apply.

The three-part test that decides whether it applies

Not every use of software in hiring triggers the disclosure duty. Norton Rose Fulbright's analysis sets out the three conditions that all have to be met before a decision falls inside the new obligation:

1. The organisation has arranged for a computer program to make, or to do something substantially and directly related to making, a decision.
2. That decision could reasonably be expected to significantly affect an individual's rights or interests.
3. Personal information about that individual is used in the operation of the program to make, or help make, that decision.

A resume-screening tool that filters, ranks, or shortlists candidates using your personal information, and whose output has a real effect on whether you progress, is squarely inside that test. A minor, low-stakes use of software somewhere in a company's back office is not automatically inside it just because AI is involved.

Why recruitment specifically is named as in scope

This isn't a case of a career site stretching a general privacy reform to fit a resume angle. Norton Rose Fulbright's analysis states plainly that "hiring, firing, salary reviews and investigations processes deserve review because of the significant impact and personal information involved," naming recruitment as one of the use cases the obligation was built to cover.

Johnson Winter Slattery's coverage of the same reform goes further, using an actual recruitment scenario as its worked example: a case where an algorithm on a company's careers site determines which classes of potential candidates get shown a particular job ad at all, and whether not displaying that job ad to a female graduate engineer, JWS's example, counts as a decision under the new rules. That's a useful illustration of how wide the obligation can reach: it isn't limited to the moment your application is scored, it can extend to whether the ad ever reached you in the first place.

The timeline behind this is also worth knowing, because it tells you how settled the detail still is. The Office of the Australian Information Commissioner (OAIC) ran a public consultation on implementation guidance that closed on 15 June 2026, with the OAIC intending to release its finalised guidance by September 2026. In other words, the legal obligation itself has a fixed commencement date, but exactly how strictly it will be interpreted and enforced in practice is still being worked out by the regulator as this is written. That's a normal pattern for a new transparency law, and it's a reason to treat this as a right worth knowing about now, not a fully mature enforcement regime yet.

What you can actually do with this right

1. Check a company's privacy policy before you apply, not just after you're rejected. Search the policy for terms like "automated decision," "automated processing," or "computer program," which is the language the obligation itself uses. A covered employer will need this language in place from December 2026 onward.
2. Ask directly, in an interview or a follow-up email, whether AI is used in screening. You don't need to cite the Privacy Act to ask a recruiter a plain question: "Is any part of the shortlisting process automated?" A reasonable recruiter can answer that, and a company that has done the compliance work will usually have a ready answer.
3. Treat the disclosure as information, not as leverage over a specific decision. The obligation tells you what a system does in general terms. It doesn't give you a right to see your individual score, challenge a specific rejection, or demand a human re-review, so don't expect the disclosure itself to reverse an outcome.
4. Keep tailoring for the system you now know is likely there. Knowing that a company almost certainly uses some automated filtering doesn't change what beats that filtering: a resume whose language genuinely matches the specific role, the same practical response this site covers in how recruiters actually use AI to screen resumes.

A worked example

Say you're applying to a mid-size logistics company for an operations coordinator role, and the company's careers page mentions nothing about how applications are reviewed. After 10 December 2026, if that company is covered by the Act and its screening process meets the three-part test above, its privacy policy has to say, in general terms, that it uses a computer program in some part of its hiring decisions and what personal information that program uses. Before you apply, you check the policy and find a paragraph confirming automated resume screening is used to shortlist candidates against role criteria. That single sentence doesn't tell you the exact keywords the system weighs, but it does tell you that a generic resume is being read by software looking for a match to specific criteria, not just a person skimming for a general impression, which is a reason to tailor the application specifically to the ad's stated requirements rather than sending a broad, general version.

This sits alongside, and is distinct from, the US-focused legal fight covered in this site's piece on what the Workday AI hiring lawsuit means if you're job hunting right now: that case is about alleged discrimination by a specific AI screening product in US courts, while the Privacy Act reform is an Australian transparency obligation that applies regardless of which product an employer uses, and doesn't itself allege discrimination by any particular system.

What this right doesn't give you

It's worth being direct about the limits, because overstating a new right is as unhelpful as ignoring it. The disclosure obligation doesn't require an employer to explain the exact logic or weighting behind a specific decision about you individually. It doesn't create an automatic right to a human review of an automated outcome. It doesn't ban AI use in recruitment, and it doesn't require an employer to tell you, at the moment you're rejected, that AI was involved in that specific decision. What it requires is a general, forward-looking statement in the privacy policy about what the organisation's automated systems do and what personal information they use, published before, not after, any individual decision is made about you.

Common questions

What is the AI hiring disclosure obligation in Australia?

It's a new Privacy Act 1988 requirement, commencing 10 December 2026, that requires organisations to disclose in their privacy policy when a computer program makes, or substantially helps make, a decision that could significantly affect someone's rights or interests using their personal information. Recruitment decisions are explicitly named as a covered use case.

When does the automated decision making transparency law start in Australia?

The obligation commences on 10 December 2026 and applies to decisions made from that date onward, according to Norton Rose Fulbright's analysis of the reform. The Office of the Australian Information Commissioner's implementation guidance, following a consultation that closed 15 June 2026, was expected to be finalised by September 2026.

Does an employer have to tell me if AI screens my resume?

From 10 December 2026, a covered employer has to disclose in its privacy policy, in general terms, that it uses automated systems in decisions like hiring and what personal information those systems use, if the decision meets the law's three-part test. It doesn't have to tell you at the moment of a specific rejection that AI was involved in that particular decision.

Can I ask a recruiter if AI is being used to screen candidates?

Yes. You don't need to reference the Privacy Act to ask directly whether any part of the shortlisting process is automated. From December 2026, a compliant employer should also have this documented in its privacy policy, which you can check independently of asking.

Does this new law stop employers from using AI to reject applications?

No. The obligation is a transparency requirement, not a ban. It requires disclosure of automated decision-making in a privacy policy; it doesn't prohibit the practice or guarantee a human reviews every automated outcome.

Is this the same as the Workday AI hiring lawsuit?

No. The Workday case is a US discrimination lawsuit against a specific AI screening product. The Privacy Act reform is an Australian transparency obligation that applies to any organisation using automated systems in recruitment, regardless of which product they use, and it doesn't itself allege discrimination.

Where ResumeProofed fits, and where it doesn't

ResumeProofed doesn't have visibility into any individual employer's automated screening system, and it can't tell you whether a specific company's process meets the new law's three-part test. What it can do is make sure the resume you submit into whichever system is reading it, automated or human, genuinely matches the language and requirements of that specific role, which is the one part of an AI-screened application you have real control over regardless of how transparent the employer eventually becomes about its process.

Try ResumeProofed free: two tailored applications on the house, no card required.