From 10th December 2026, your privacy policy needs to disclose where a computer program, including AI tools, is used to make a decision that could significantly affect someone’s rights or interests. The change has been public for about two years but like with most things that have a long deadline, most people haven’t got around to doing anything about it yet.
What that means is that you need to walk through all the decisions made about a person, consider whether that decision could significantly affect that person’s rights or interests, and understand to what extent a computer program contributes to that decision. For everything that falls in scope you need to update your privacy policy with the details. This includes decisions about clients, where they are individuals, but also recruitment practices.
I can do that mapping for you.
I’m Fiona Kate Morgan, founder of AI Fully Informed. I’ve led AI product work in regulated environments at NatWest and the BBC, and co-founded NatWest’s AI ethics board. I now work independently with mid-market professional services firms in Australia. I hold an MSc in AI from Brunel University.
How ready is your firm for the 10th December deadline?
A few short questions about how your firm handles new clients. This will help you understand whether your processes might fall under the new ADM rules.
This looks at how new clients are handled as one concrete example, not a full audit. Other processes, document review tools that flag risk, e-discovery, recruitment shortlisting, can trigger the same requirement even where intake doesn't. This is not legal advice.
Your answers aren't collected or stored. We track anonymous, aggregate use of this tool, like how many people start it, through the site's usual analytics.
What’s involved. AUD 2,500 per firm, available until 19 November 2026
I run the assessment, so you don’t have to free up a team or block out hours of your own time. I map out your process in collaboration with a team member, there’s an optional short survey for the people handling client and candidate decisions, then I identify the decisions, research the tools, and categorise what is in scope.
At the end you get a written assessment, including all the decisions made and what feeds them, suggestions of the changes needed to update your privacy policy and documentation to use in the case of an audit.
What AUD 2,500 covers. One client-facing process, from first contact through to the decisions you make about that client, and one recruitment process. That’s the whole job for most firms I work with. If there is more than one client pathway to cover, each additional one is AUD 1,000.
Suggested privacy policy wording is a recommendation rather than legal sign-off. Final review of your privacy policy sits with your own lawyer. But I support your lawyer whilst they update it, answering any questions they have about the processes I’ve worked through.
Ready to get it done?
Email fiona@aifullyinformed.com or book a 30-minute call with Fiona and I’ll take it from there.
If you’re not sure where you stand
Book a free 15-minute question and we’ll work out whether this is the right next step.