Compliance guide

OAIC APP 1.7–1.9: automated-decision transparency and evidence

Name: Decision Keep
Brand: Decision Keep
Availability: LimitedAvailability

Australia's APP 1.7–1.9 obligations require APP entities to be transparent about certain computer-program decisions in their privacy policies. The obligations apply from 10 December 2026. This page explains the practical evidence question: can you describe the relevant decision types and produce trustworthy evidence for a specific decision later?

Not legal advice. APP 1.7 scope and APP 1.8 disclosures are fact-specific. Use this guide with privacy/legal advice and authoritative OAIC guidance.

Quick answer

APP 1.7 sets threshold conditions. APP 1.8 requires privacy-policy disclosures about kinds of personal information used, kinds of decisions made solely by computer programs, and kinds of decisions for which a computer program does a substantially and directly related thing. APP 1.9 clarifies definitions, including that deciding can include refusing/failing to decide and can have adverse or beneficial effects. Decision Keep helps APP entities create tamper-evident, verifiable decision records and receipts to support evidence and governance; it is not the decision-maker.

What APP 1.7, 1.8 and 1.9 mean in practice

APP 1.7 — scope

Assess whether the entity arranged for a relevant computer-program decision or a substantially/directly related action, whether it could significantly affect rights or interests, and whether personal information is used.

APP 1.8 — disclosures

Describe kinds of personal information used, kinds of solely automated decisions, and kinds of decisions where computer programs do substantially and directly related things. Avoid over-claiming or omitting in-scope categories.

APP 1.9 — definitions

“Decision” includes refusing or failing to make a decision, and effects can be adverse or beneficial. Human involvement does not automatically remove every computer-assisted pathway from scope.

Evidence an APP entity may need

Inventory: which systems make or substantially support relevant decisions.
Decision context: system, agent/model/rules version, timing, and input references (prefer references or minimised payloads, not unnecessary personal information).
Outcome path: routing outcome, automated vs human-reviewed pathway, and material human-review context where relevant.
Verifiability: a signed, tamper-evident receipt that can be checked later by auditors or internal reviewers without relying on mutable logs.
Retrieval: the ability to produce evidence for a specific decision, not only aggregate policy statements.

How Decision Keep helps

Decision Keep is an out-of-band forensic witness for automated decisions. It creates signed, hash-chained, tamper-evident receipts (dkr-1) that can be verified against a published key. For OAIC APP 1.7–1.9 readiness, that can support evidence for decision records, system/version context, timing, routing/human-review context and independent verification. Decision Keep does not decide APP 1.7 scope, write your privacy policy for you, or replace legal/privacy advice.

Compliance mapping Verify a receipt Book an APP 1.7–1.9 readiness demo

Readiness checklist

1. Inventory automated and computer-assisted decisions
List systems that make decisions, recommend outcomes, score, rank, route, approve, decline or substantially support decisions affecting individuals.
2. Classify APP 1.7 scope
For each system, assess whether the APP 1.7 threshold conditions are met, including ‘arranged for’, significant effect, and use of personal information. Confirm classifications with privacy/legal advice.
3. Prepare APP 1.8 disclosures
Draft privacy-policy disclosures for kinds of personal information used, kinds of decisions made solely by computer programs, and kinds of decisions where programs do substantially and directly related things.
4. Capture verifiable decision evidence
Record decision metadata and references at decision time: system/model version, timing, routing/human-review context, and a tamper-evident receipt that can be verified independently.
5. Test retrieval and verification
Run a drill: can you locate a specific past decision, explain the recorded context, and verify the receipt offline against your published key without trusting the vendor?

Authoritative sources

Use primary sources for final interpretation and compliance decisions.

FAQ

OAIC APP 1.7–1.9 FAQ

When do OAIC APP 1.7–1.9 automated-decision transparency obligations apply?+

The APP 1.7–1.9 transparency obligations apply from 10 December 2026. APP entities should use the lead time to inventory relevant computer-program decisions, assess APP 1.7 conditions, prepare APP 1.8 privacy-policy disclosures, and confirm they can produce evidence for specific decisions on request.

What does APP 1.7 cover?+

APP 1.7 sets threshold conditions for when the transparency obligation applies. In broad terms, the entity arranged for a computer program to make, or do a thing substantially and directly related to making, a decision; the decision could reasonably be expected to significantly affect an individual’s rights or interests; and personal information about that individual is used in the program’s operation. Classification is fact-specific and should be confirmed by privacy/legal advisers.

What must an APP entity disclose under APP 1.8?+

APP 1.8 requires privacy-policy disclosures about the kinds of personal information used in the operation of relevant computer programs, the kinds of decisions made solely by those programs, and the kinds of decisions for which a substantially and directly related thing is done by the programs. Grouping can be appropriate if disclosures remain meaningful to a reasonable person.

Are human-in-the-loop or advisory AI decisions in scope?+

Often they can be. A decision is not automatically out of scope because a human makes the final call. Where a computer program does a thing substantially and directly related to making a decision, APP 1.8(c) may be relevant. Assess reliance, override practice, and the program’s role in the decision pathway for each use case.

Does Decision Keep make decisions or provide legal compliance?+

No. Decision Keep is an evidence layer. It does not make decisions about individuals and does not provide legal advice. It helps APP entities capture and verify tamper-evident decision records and receipts so they can support internal governance, privacy-policy disclosures, audits and responses to requests with defensible evidence.

What evidence is useful for APP 1.7–1.9 readiness?+

Useful evidence can include the decision/system identifier, model or rules version, time received/signed, input references (not raw personal information by default), routing outcome, human-review context where relevant, and a verifiable receipt showing the record has not been altered. The key test is whether you can produce trustworthy evidence for a specific decision later.

Prepare evidence before 10 December 2026

Book a demo to map Decision Keep to your automated-decision inventory and see how signed receipts, decision records and offline verification can support APP 1.7–1.9 evidence workflows.

Book a demo AI decision audit trail guide