Australia’s December AI Transparency Deadline: Do Your Meeting Reports Inform Significant Decisions?

An AI summary can start as a convenient record of a conversation and become evidence for a hiring, service-access, or pay decision. Australia’s approaching transparency requirement makes that transition worth examining.

On 30 September 2026, the Office of the Australian Information Commissioner published new automated decision-making resources. From 10 December 2026, covered entities must include specified information in their privacy policies when computer programs use personal information to make, or materially assist with, decisions that significantly affect individuals.

That does not mean every AI meeting summary triggers this requirement. The useful question is what the organisation does with the output.

This article explains the upcoming federal privacy-policy obligation as at 4 October 2026. It is general information, not legal advice. Recording permission is a separate question, covered in our Australia and New Zealand workplace-recording guide.

First establish whether your organisation and activity are covered

The requirement applies to APP entities. The OAIC’s key-concepts guidance explains that this includes agencies and organisations as defined in the Privacy Act, subject to exclusions. Do not assume that every Australian employer falls into the same category. State and territory authorities generally sit outside that definition of organisation and may have separate privacy regimes.

Most small businesses with annual turnover of A$3 million or less are outside the Act, but significant exceptions exist. Health-service providers and some businesses handling personal information can be covered regardless of size. Related businesses, Commonwealth contractors and businesses that opt in also need attention. Use the OAIC’s small-business checklist rather than treating turnover as the complete test.

Then assess the particular activity. Coverage of an organisation does not settle every exemption affecting the information it handles.

The employee-records caveat matters

The OAIC’s employee-records guidance describes an exemption for a private-sector employer’s acts or practices directly related to both a current or former employment relationship and an employee record it holds.

That requires its own assessment before concluding that an internal performance-report workflow attracts the new obligation. Conversely, it does not exempt everything said at work. The guidance excludes unsuccessful applicants’ information from the future-employment relationship exemption and explains that contractors handling another employer’s employee information cannot simply inherit that employer’s exemption. Volunteers are also outside the employee relationship described there.

Record whose information is involved, who handles it, and the activity being assessed. A meeting involving an employee, customer and recruitment consultant cannot safely be classified by the meeting organiser’s job title alone.

Apply the three conditions to the actual workflow

The OAIC’s September announcement identifies three conditions under APP 1.7. In practical terms, ask:

Has the entity arranged for software to make a decision, or perform something substantially and directly connected to making it?
Could that decision reasonably be expected to significantly affect an individual’s rights or interests?
Does the software use personal information about that individual for that work?

All three matter. A product’s “AI assistant” label answers none of them by itself.

Build the assessment around a named decision: shortlisting a candidate, allocating support, or changing someone’s contractual treatment. Then trace backwards to the transcript, summary, prompt, score and recommendation involved. Identify which output the person making the decision actually sees.

This is also a reason to review existing meeting archives. The 2024 amending Act, Schedule 1 Part 15 applies the amendment to decisions after commencement even where the software arrangement, processing or acquisition of information predates it. An older transcript does not automatically take a later decision outside scope.

Human approval does not settle the question

The updated APP 1 guidance treats “substantially” as involving a key contribution to human decision-making, with “directly” requiring a direct connection. An advisory output can qualify. The person clicking Approve need not be the only source of judgement.

The guidance also distinguishes software that merely documents a decision already made. Typing the agreed outcome into a document is different from relying on a generated assessment to reach that outcome.

The OAIC’s September fact sheet illustrates this using AI-generated remuneration recommendations. Director approval alone does not remove the substantial connection where managers rely on the recommendation. It contrasts that with deeper examination of inputs, additional evidence and documented independent reasoning, which could indicate a different result.

That example illustrates the decision-support test; it does not eliminate the employee-records coverage question discussed above. Nor does it establish a mechanical safe harbour based on the number of human reviewers.

For a meeting-report workflow, ask the reviewer to explain what they checked, what they disagreed with, and what evidence supported the final result. “A manager reviewed it” is too thin to explain the process.

Three meeting scenarios to assess

These are illustrative assessments, not regulator determinations about any particular product.

Project minutes used only as a record

A team agrees on a delivery date. Its assistant summarises the discussion, and participants correct the action list. Nobody uses the output to assess an individual or determine access to a significant service.

There may be no qualifying significant decision connected to that use. The assessment should say why. Revisit it if management later starts mining the same archive for individual performance judgements.

Interview summaries used to shortlist applicants

A recruiter asks an assistant to compare candidates’ interview answers and recommend who proceeds. The hiring manager mainly follows the generated comparison.

This warrants a close APP 1.7 assessment: identifiable candidates, employment access, and a report doing meaningful work in the selection process. A setting called “summary” does not make the comparison merely clerical. Review collection and use of applicants’ information separately from any existing-employee exemption.

Client consultations used to prioritise support

A service provider turns consultation transcripts into urgency summaries. Staff use those summaries to decide who receives scarce appointments first.

Inspect the consequence for the person waiting, how the summary selects or omits information, and whether staff consult the underlying record. This is a different workflow from generating notes solely so the client can remember the discussion. The OAIC guidance recognises that significance depends on circumstances, including vulnerability; a seemingly modest operational choice may have substantial effects for a particular person.

What belongs in the privacy policy

APP 1.8, inserted by the amending Act, requires information about three categories:

the kinds of personal information the relevant programs use;
the kinds of qualifying decisions made entirely through those programs; and
the kinds of qualifying decisions substantially and directly assisted by their operation.

For a meeting workflow, prepare an inventory before writing the disclosure: interview answers, attributed statements, client circumstances, generated evaluations, and the decisions those inputs inform. Distinguish actual uses from features the organisation has never enabled.

The OAIC fact sheet supports meaningful categories and accessible explanations rather than overwhelming technical detail. A general statement that “we use AI to improve services” leaves readers guessing about the information and decisions involved.

Have the process owner verify the description against a real, appropriately redacted example. If the workflow diagram and the written policy describe different processes, resolve that before publication.

Local processing changes the data path

Summit’s security architecture documents on-device transcription and a Local Models option for local AI processing. Selecting a hosted model instead sends relevant prompt content to the configured provider. Optional sync, integrations and exports require their own review.

Keeping processing on-device can reduce disclosure of meeting content to an external AI provider. It does not decide whether the organisation’s use of a report falls within APP 1.7. A locally generated recommendation can still influence a consequential decision.

Local records also need device access controls, appropriate retention and careful handling of exports. Summit’s architecture discloses that its local database and audio rely on operating-system protections rather than separate application-level encryption at rest.

The OAIC’s broader AI guidance addresses personal information in both inputs and generated outputs, including inaccurate inferences about identifiable people. Privacy-policy transparency does not replace assessment of collection, secondary use, accuracy and security.

A practical review before 10 December

Use the remaining preparation period to produce a small, reviewable record for each workflow:

Coverage: identify the entity, people affected and any activity-specific exemption requiring advice.
Decision: name the outcome and explain the possible consequence for the individual.
Information: list source records and generated personal information.
Reliance: show where the output reaches the decision-maker and what independent review occurs.
Disclosure: map the applicable categories to the privacy policy and check that the wording matches practice.
Ownership: assign someone to reassess the workflow when prompts, integrations or purposes change.

Start with hiring, access to essential services, and other consequential uses of conversation records. The most useful inventory follows meeting content all the way to the decision it informs.