What legal and compliance teams need to know about AI decision records

Legal and data protection officers are often caught between two demands: regulators want proof that automated decisions are explainable, and data subjects want proof that their specific decision was fair. Neither demand is served by a screenshot or a mutable log.

This guide translates the regulatory obligations into what you actually need to have in place, and how a tamper-evident decision record satisfies both sides without creating new legal risk.

Not legal advice. This is a working reading of published guidance for compliance practitioners. Classification decisions under APP 1.7-1.9 and the scope of your obligations under GDPR Art. 22 depend on facts specific to your systems and contracts. Have counsel or your privacy officer confirm before you rely on it, and where the two readings differ, theirs governs.

The regulatory baseline

Two frameworks dominate the conversation:

APP 1.7-1.9 (Australia, from 10 December 2026)

The Privacy and Other Legislation Amendment Act 2024 inserts a transparency obligation into APP 1. Three sub-sections do three different jobs.

APP 1.7 sets the threshold. All three conditions must hold: the entity arranged for a computer program to make, or to do a thing substantially and directly related to making, a decision; the decision could reasonably be expected to significantly affect an individual's rights or interests; and personal information about that individual is used in the program's operation.

APP 1.8 then lists what the privacy policy must contain: the kinds of personal information used in the operation of those programs; the kinds of decisions made solely by them; and the kinds of decisions for which a thing substantially and directly related to making the decision is done by them. That third limb is the one that surprises most legal teams - a program that recommends or guides a human decision-maker is captured, even where a human makes the final call and could overrule it.

APP 1.9 is definitional: deciding includes refusing or failing to decide, and an effect counts whether it is adverse or beneficial.

The disclosure is about categories. The evidence obligation is separate, and for most organisations it is the harder one to satisfy.

GDPR Art. 22 (EU)

Data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. The controller must provide suitable safeguards, which at minimum include the right to obtain human intervention, express their point of view, and contest the decision.

The European Data Protection Board has consistently interpreted Art. 22 as requiring controllers to be able to explain the logic involved.

What "meaningful information about the logic" means in practice

This phrase comes from the APP 6 collection-notice obligation, not from APP 1.7-1.9. When you collect personal information and a computer program will be used to make a decision about the individual, APP 6 requires you to advise them of the name of the program, the purpose for which it is used, and the meaningful information about the logic utilized.

In practice that means three things:

1. Transparency about the fact of automation. The individual must know a decision was made solely by automated means.
2. Transparency about the factors. The individual must understand the significant factors that were taken into account.
3. Transparency about the role of the logic. The individual must understand how those factors were combined or weighted to produce the outcome.

A signed, hash-chained record does not replace the privacy policy. It is the evidence that the policy description is accurate. When a regulator or data subject asks for proof, you provide the verified receipt, not the policy itself.

How the record supports subject access requests

Under both frameworks, a data subject can request information about an automated decision. The record lets you answer with precision:

• The exact model version that produced the decision.
• The input references (not raw personal data) that were considered.
• The score, class, or routing outcome.
• The timestamp, independently witnessed.
• Proof that the record has not been altered since the decision was made.

You do not hand over your infrastructure. You provide the verified receipt and a plain-language explanation of the logic. The record proves the explanation is accurate.

Privacy policy drafting for automated decisions

A compliant disclosure has three parts:

• Scope. Which decisions are made solely by automated means. Be specific: "We use automated systems to assess credit applications" is better than "We use technology to make decisions."
• Factors. The significant factors the system considers. You do not need to disclose proprietary model weights, but you must disclose the categories of information and their general role.
• Recourse. How an individual can seek human review, contest the decision, or obtain more information.

The underlying record supports each part. If the policy says "we consider income, credit history, and existing liabilities," the record proves that those factors were in fact used in the specific decision.

The erasure tension

Both GDPR Art. 17 and the Australian APPs include rights that can conflict with evidence retention. A data subject may request deletion. A regulator may require retention.

A signed cryptographic erasure proof reconciles the two. You redact the content, you preserve the chain anchor, and you produce a proof that deletion was performed according to policy. The evidence of the decision remains without the personal data that created the conflict.

Cross-border considerations

If you operate in both Australia and the EU, the same evidence chain can satisfy both frameworks. The six properties (authentic, intact, timed, verifiable, erasable, complete) are framework-agnostic. What changes is the disclosure language in your privacy policy and the retention schedule in your data governance policy.

For a practical implementation guide for GRC teams, see Audit-ready AI: how GRC teams prove every automated decision. For the Australian regulatory context, see AI decision logging in Australia: meeting APP 1.7-1.9.