AI Consulting Services and Cyber Security Consulting for Australia’s New Automated Decision Rules
Key takeaways
- Under new Privacy Act rules commencing 10 December, covered organisations must explain when computer programs use personal information to make, or substantially help make, significant decisions about people.
- Many organisations lack a complete list of where AI and automation touch personal data.
- AI consulting services map those uses and set governance, while security advisers test whether the data behind them is protected.
- Running both workstreams together avoids building two inventories of the same systems.
AI governance has moved from a strategy topic to a compliance date. ASD's latest Annual Cyber Threat Report (2025-26) reports 1,524 incidents responded to, up 21.6% on the previous year, and dedicates attention to the security impact of rapidly advancing AI. At the same time, new Privacy Act transparency rules for automated decisions are taking effect.
What the New Rules Require
The change adds new obligations to Australian Privacy Principle 1 through the Privacy and Other Legislation Amendment Act 2024. Disclosure is required when three conditions are met.
- A computer program makes a decision, or does something substantially and directly related to making it.
- The program uses personal information.
- The decision could reasonably be expected to significantly affect an individual's rights or interests.
Examples include automated credit limits, claims triage, rostering tools and AI-assisted recruitment screening. The rule applies to decisions made from 10 December onward, even if the system was built years earlier.
Where AI and Security Work Overlap
The AI side and the security side of this work look at the same systems from different angles. Running AI consulting services and cyber security consulting as one programme means one inventory, one owner list and one board update.
|
Workstream |
AI focus |
Security focus |
|
Inventory |
Which tools make or shape decisions |
Which systems hold the personal data |
|
Access |
Who can change models and prompts |
Who can reach the underlying data |
|
Vendors |
Which SaaS tools embed AI features |
Third-party data handling and breach terms |
|
Testing |
Bias and accuracy checks |
Prompt injection and data leakage tests |
|
Reporting |
Privacy policy disclosures |
Risk register and board updates |
A Six-Week Readiness Plan for Mid-Market Teams
Focus on the decisions with the highest impact on customers and staff rather than every script and macro.
- Weeks 1 and 2. List every tool that uses personal data to make or support decisions, including AI features inside existing SaaS platforms.
- Weeks 3 and 4. Apply the three-part test, then run a security review of the systems that pass it.
- Weeks 5 and 6. Update the privacy policy, assign an owner for each system and brief the board on residual risks and next steps.
Shadow AI deserves a specific check. Staff often connect free AI tools to customer data without IT approval, and those tools rarely appear in formal registers. Australian IT providers such as Nexon now run AI readiness and governance work alongside security advisory, which reflects how tightly the two disciplines have become linked.
What This Means Beyond Compliance
The new rules are a starting line, not a finish. Teams that build a single register of AI-driven decisions now will find later reforms, and future cyber security consulting reviews, far easier to absorb.
References
- Australian Signals Directorate. (2026). Annual cyber threat report 2025-26. https://www.cyber.gov.au/publication/annual-cyber-threat-report-2025-26
- Privacy and Other Legislation Amendment Act 2024 (Cth). https://www.legislation.gov.au
