Can an employer use AI on your application? What changes on 10 December 2026

From 10 December 2026, an Australian employer covered by the Privacy Act has to say in its privacy policy whether a computer program is making, or materially shaping, decisions about people. That's the whole of the new right. There's no appeal, and no explanation of your particular case.

It's still worth knowing, because today nothing requires an employer to tell you anything at all.

What actually changes

The Privacy and Other Legislation Amendment Act 2024 added a new clause to the first Australian Privacy Principle. It kicks in when three things are all true:

• The organisation has arranged for a computer program to make a decision, or to do something substantially and directly related to making one.
• That decision could reasonably be expected to significantly affect your rights or interests.
• Your personal information is used in running the program.

When all three hold, the privacy policy has to state the kinds of personal information those programs use, and the kinds of decisions they make or help make. Refusing to decide counts as a decision, and it applies whether the outcome helps you or hurts you.

What it gives you, and what it doesn't

Worth being blunt about this part. It's smaller than it sounds.

Does it cover job applications?

Carefully: the Act itself doesn't say so. It sets a general test, that the decision could significantly affect your rights or interests, and gives three worked examples. None of them is about hiring.

The regulator's own material is far more direct. When the Office of the Australian Information Commissioner listed what "arranging for a computer program to make a decision" looks like in practice, the first example on the list was a company buying in an AI system to screen and rank job applications, leading to a decision about who to employ. First on the list.

It goes further than that one line. The same paper treats limiting someone's access to employment opportunities as an effect serious enough to count. It then works through a case where a job site's algorithm pushes an engineering role towards men, because most of the employer's engineers are men, so a woman searching for that job never sees the ad at all. It asks whether her not receiving it should count as a "decision", and leaves the question open. It also points at the UK, where the Information Commissioner's Office audited the companies building AI recruitment tools in 2024 and published what it wanted changed.

So the regulator is plainly thinking about hiring. Keep the status of that in mind, though. This is a consultation paper from May 2026 with twelve open questions in it, and the OAIC hasn't answered them. It's the regulator thinking out loud rather than the regulator ruling, and anyone telling you the position is settled is ahead of them.

The part that surprises people: you are covered as an applicant

The Privacy Act has a carve-out for employee records. Skim it and it sounds like privacy law doesn't reach hiring at all. It doesn't work that way.

The exemption only covers a current or former employment relationship. If you applied and didn't get the job, you were never an employee, so it never covered you in the first place. The regulator says so outright rather than leaving you to work it out: the exemption doesn't apply to information about prospective employees who aren't subsequently employed.

So the people with the least say in the process are the ones the carve-out never touched.

Who it leaves out

This is the biggest limit on everything above. The OAIC's own guidance puts it plainly: most small businesses aren't covered by the Privacy Act, and a small business is one with an annual turnover of $3 million or less, counting income from all sources. So if you're applying to a small agency, a small practice or a startup under that line, this rule gives you nothing, because the Act itself largely doesn't reach them.

Western Australia is different, and earlier

From 1 July 2026, WA entities covered by its new privacy law have to do considerably more when an automated process makes a significant decision about you: notify you that it happened, give you information about how it works if you ask, and provide a way to request that a human intervene.

That's the thing people assume the national rule does. Read who it binds before you get your hopes up, though. It covers WA government agencies and departments, statutory authorities, the WA Police Force, local governments, government trading enterprises and some contracted service providers to government. Not private employers. So it's genuinely worth knowing if you're applying into the WA public sector, and it does nothing for you at a private company.

What to actually do with this

• Read the privacy policy before you apply for a role you care about. From December, the disclosure belongs there. An employer using these systems and saying nothing is telling you something.
• Answer the screening questions carefully. In every applicant tracking system whose documentation we could check, the automatic rejections run off your answers to structured questions, not off anything read out of your resume.
• Ask, if it matters to you. You can ask an employer whether automated decision-making was used. You can't compel an answer about your own case, and asking is free.
• Don't wait for a right that isn't coming. There's no appeal built into this. What you can still control is the same thing as always, a document strong enough that neither the software nor the person is looking for a reason to move on.

The short version

• From 10 December 2026, covered employers must disclose automated decision-making in their privacy policy. That's a disclosure rule and nothing more.
• It very likely reaches recruitment, though the Act doesn't name it and the regulator's guidance isn't finished.
• The employee records exemption doesn't cover you as an applicant, so you're inside the Act's protection rather than outside it.
• Employers turning over $3 million or less are mostly outside the Act entirely.
• Applying into the WA public sector is the exception. A different law gives you notification, information on request and a route to ask for a human, from 1 July 2026.

We'd like to help with the part you can control

None of this changes the document you send, and the document is the part you control. Send us your resume and the ad through the free review and a writer will tell you what they'd change, for nothing, whether or not you ever buy anything.

If you want the whole thing built properly, have a look at what we do. We'd love to make you the shoo-in.