AI decision logging in Australia: meeting APP 1.7–1.9

From 10 December 2026, Australia's Privacy and Other Legislation Amendment Act 2024 brings automated-decision-making transparency into the Privacy Act 1988 (Cth) through APP 1.7–1.9. If your organisation makes decisions with a legal or similarly significant effect on people - credit, eligibility, pricing, access - and those decisions are made wholly by automation, these rules now apply to you. The OAIC's guidance on AI and privacy and the amending Act itself are the authoritative references; PwC and Deloitte have published practical read-outs of what the reforms require.

This guide explains what each obligation requires and how a tamper-evident decision log satisfies them without bolting on a new platform.

What APP 1.7–1.9 actually require

APP 1 is the "open and transparent management" principle. The new sub-sections focus it on automated decision-making:

• APP 1.7 - disclose the kinds of personal information used to make automated decisions.
• APP 1.8 - disclose the kinds of decisions made solely by automated means, and meaningful information about the logic.
• APP 1.9 - provide that meaningful information about the logic used, on request.

The key word is meaningful. A vague sentence in a privacy policy is not the same as being able to show, for any given decision, exactly what happened.

Why a plain log falls short

Most teams reach for a database table or a logging service. That is a start, but it has a problem: a log that can be edited after the fact is not evidence. If a regulator or auditor asks "what actually happened on 3 March?", a mutable log cannot answer with confidence.

APP 1.9 wants information that is trustworthy. The strongest way to make a log trustworthy is to make it tamper-evident: every record is cryptographically linked to the one before it, so changing any entry breaks the chain for everyone downstream. Auditors verify the whole chain offline against your published key - no account, no trust in the vendor.

A compliant privacy policy disclosure might read: "We use automated systems to assess credit applications. Decisions are made solely by automated means. The logic applied includes assessment of income, credit history, and existing liabilities. You can request meaningful information about the logic used in your specific decision." The record behind that statement is what APP 1.9 expects to be available on request.

How Decision Keep maps to each obligation

Each automated decision is:

1. Signed with your organisation's own key - you hold the root of trust, not a third party.
2. Sealed in a hash chain - content hash bound to the previous entry.
3. Optionally time-stamped by an independent RFC 3161 authority - proving exactly when the decision was signed, outside your control.
4. Retained under a policy that supports verifiable erasure - content is removed while the chain anchor is preserved.

That directly answers APP 1.7 (what information was used), APP 1.8 (decisions made solely by automation, disclosed), and APP 1.9 (meaningful information about the logic, available on request and via the public verifier).

A practical rollout

• Inventory the automated decisions with significant effect.
• Capture references (not raw personal information) at the point of decision.
• Record each one with a signature and, where forensic proof matters, an independent timestamp.
• Publish your verification key and let auditors check receipts offline.

You do not need a new data platform. The evidence store can run on infrastructure you already control, sovereign and portable.

For how verifiable evidence maps to multiple frameworks, see Audit-ready AI: how GRC teams prove every automated decision.