AI decision logging in Australia: meeting APP 1.7–1.9

From 10 December 2026, Australia's Privacy and Other Legislation Amendment Act 2024 brings automated-decision-making transparency into the Privacy Act 1988 (Cth) through APP 1.7–1.9. If your organisation makes decisions with a legal or similarly significant effect on people — credit, eligibility, pricing, access — and those decisions are made wholly by automation, these rules now apply to you.

This guide explains what each obligation requires and how a tamper-evident decision log satisfies them without bolting on a new platform.

What APP 1.7–1.9 actually require

APP 1 is the "open and transparent management" principle. The new sub-sections focus it on automated decision-making:

• APP 1.7 — disclose the kinds of personal information used to make automated decisions.
• APP 1.8 — disclose the kinds of decisions made solely by automated means, and meaningful information about the logic.
• APP 1.9 — provide that meaningful information about the logic used, on request.

The key word is meaningful. A vague sentence in a privacy policy is not the same as being able to show, for any given decision, exactly what happened.

Why a plain log falls short

Most teams reach for a database table or a logging service. That is a start, but it has a problem: a log that can be edited after the fact is not evidence. If a regulator or auditor asks "what actually happened on 3 March?", a mutable log cannot answer with confidence.

APP 1.9 wants information that is trustworthy. The strongest way to make a log trustworthy is to make it tamper-evident: every record is cryptographically linked to the one before it, so changing any entry breaks the chain for everyone downstream. Auditors verify the whole chain offline against your published key — no account, no trust in the vendor.

How Decision Keep maps to each obligation

Each automated decision is:

1. Signed with your organisation's own key — you hold the root of trust, not a third party.
2. Sealed in a hash chain — content hash bound to the previous entry.
3. Optionally time-stamped by an independent RFC 3161 authority — proving exactly when the decision was signed, outside your control.
4. Retained under a policy that supports verifiable erasure — content is removed while the chain anchor is preserved.

That directly answers APP 1.7 (what information was used), APP 1.8 (decisions made solely by automation, disclosed), and APP 1.9 (meaningful information about the logic, available on request and via the public verifier).

A practical rollout

• Inventory the automated decisions with significant effect.
• Capture references (not raw personal information) at the point of decision.
• Record each one with a signature and, where forensic proof matters, an independent timestamp.
• Publish your verification key and let auditors check receipts offline.

You do not need a new data platform. The evidence store can run on infrastructure you already control, sovereign and self-hosted.

Conclusion

APP 1.7–1.9 reward organisations that can prove what their AI decided and why. A tamper-evident, independently verifiable decision log turns a compliance burden into defensible evidence — and keeps the proof in your hands.