From 10th December 2026, your privacy policy needs to say where a computer program, including AI tools, makes or substantially and directly influences a decision that could significantly affect someone’s rights or interests.
What that means is that you need to walk through all the decisions made about a person, consider whether that decision could significantly affect that person’s rights or interests, and understand to what extent a computer program contributes to that decision. For everything that falls in scope you need to update your privacy policy with the details. This includes decisions about clients, where they are individuals, but also recruitment practices.
I can lead that mapping for you.
I’m Fiona Kate Morgan, founder of AI Fully Informed. I’ve led AI product work in regulated environments at NatWest and the BBC, and co-founded NatWest’s AI ethics board. I now work independently with mid-market professional services firms in Australia. I hold an MSc in AI from Brunel University.
How ready is your firm for the 10th December deadline?
A few short questions about how your firm handles new clients. This will help you understand whether your processes might fall under the new ADM rules.
This looks at how new clients are handled as one concrete example, not a full audit. Other processes, document review tools that flag risk, e-discovery, recruitment shortlisting, can trigger the same requirement even where intake doesn't. This is not legal advice.
Your answers aren't collected or stored. We track anonymous, aggregate use of this tool, like how many people start it, through the site's usual analytics.
What’s involved. AUD 2,500 per firm, for assessments booked by 19 November 2026
I lead the assessment, so you don’t need to learn the rules or work out the scope yourself. We start with a short call to agree which workflows to look at. Then I spend 30 minutes to an hour with someone from each workflow, mapping what actually happens and where software is involved. There’s an optional short survey for the wider team handling client and candidate decisions. After that I research the tools, identify the decisions and work out what’s in scope.
At the end you get a written assessment covering the decisions made and what feeds them, suggested changes to your privacy policy, and a written record of how you reached your position. I present it back to you and your lawyer.
What I need from you. A short scoping call with one main contact, then 30 minutes to an hour with one person from each workflow (depending on how large it is). The sooner those sessions are booked, the more time there is before 10 December.
What AUD 2,500 covers. One client-facing workflow, from first contact through to the decisions you make about that client, and one recruitment workflow. Each additional workflow is AUD 1,000, and we’ll confirm the number on our first call before you commit.
Suggested privacy policy wording is a recommendation rather than legal sign-off. Final review of your privacy policy sits with your own lawyer. But I support your lawyer while they update it, answering any questions they have about the workflows I’ve worked through.
Ready to get it done?
Email fiona@aifullyinformed.com or book a 30-minute call with Fiona and I’ll take it from there.
If you’re not sure where you stand
Book a free 15-minute question and we’ll work out whether this is the right next step.