What legal and compliance teams need to know about AI decision records

Legal and data protection officers are often caught between two demands: regulators want proof that automated decisions are explainable, and data subjects want proof that their specific decision was fair. Neither demand is served by a screenshot or a mutable log.

This guide translates the regulatory obligations into what you actually need to have in place, and how a tamper-evident decision record satisfies both sides without creating new legal risk.

The regulatory baseline

Two frameworks dominate the conversation:

APP 1.7-1.9 (Australia, from 10 December 2026)

APP entities must disclose in their privacy policy the kinds of personal information used in automated decision-making, the kinds of decisions made solely by automation, and meaningful information about the logic. On request, they must provide that meaningful information about the logic used.

The OAIC's Issues Paper makes clear that "meaningful" is not satisfied by a vague sentence. The disclosure must enable an individual to understand the significant factors that influenced the decision.

GDPR Art. 22 (EU)

Data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. The controller must provide suitable safeguards, which at minimum include the right to obtain human intervention, express their point of view, and contest the decision.

The European Data Protection Board has consistently interpreted Art. 22 as requiring controllers to be able to explain the logic involved.

What "meaningful information about the logic" means in practice

The phrase is deceptively simple. In practice, it means three things:

1. Transparency about the fact of automation. The individual must know a decision was made solely by automated means.
2. Transparency about the factors. The individual must understand the significant factors that were taken into account.
3. Transparency about the role of the logic. The individual must understand how those factors were combined or weighted to produce the outcome.

A signed, hash-chained record does not replace the privacy policy. It is the evidence that the policy description is accurate. When a regulator or data subject asks for proof, you provide the verified receipt, not the policy itself.

How the record supports subject access requests

Under both frameworks, a data subject can request information about an automated decision. The record lets you answer with precision:

• The exact model version that produced the decision.
• The input references (not raw personal data) that were considered.
• The score, class, or routing outcome.
• The timestamp, independently witnessed.
• Proof that the record has not been altered since the decision was made.

You do not hand over your infrastructure. You provide the verified receipt and a plain-language explanation of the logic. The record proves the explanation is accurate.

Privacy policy drafting for automated decisions

A compliant disclosure has three parts:

• Scope. Which decisions are made solely by automated means. Be specific: "We use automated systems to assess credit applications" is better than "We use technology to make decisions."
• Factors. The significant factors the system considers. You do not need to disclose proprietary model weights, but you must disclose the categories of information and their general role.
• Recourse. How an individual can seek human review, contest the decision, or obtain more information.

The underlying record supports each part. If the policy says "we consider income, credit history, and existing liabilities," the record proves that those factors were in fact used in the specific decision.

The erasure tension

Both GDPR and APP 1.9 include rights that can conflict with evidence retention. A data subject may request deletion. A regulator may require retention.

A signed cryptographic erasure proof reconciles the two. You redact the content, you preserve the chain anchor, and you produce a proof that deletion was performed according to policy. The evidence of the decision remains without the personal data that created the conflict.

Cross-border considerations

If you operate in both Australia and the EU, the same evidence chain can satisfy both frameworks. The six properties (authentic, intact, timed, verifiable, erasable, complete) are framework-agnostic. What changes is the disclosure language in your privacy policy and the retention schedule in your data governance policy.

For a practical implementation guide for GRC teams, see Audit-ready AI: how GRC teams prove every automated decision. For the Australian regulatory context, see AI decision logging in Australia: meeting APP 1.7-1.9.