Your AI Recruiting Stack Has a 10 December Deadline

From 10 December 2026, organisations covered by the Privacy Act (broadly, businesses with annual turnover over $3 million, plus some smaller ones) need to say in their privacy policy where software uses personal information to make, or substantially help make, decisions that significantly affect people. Hiring decisions sit squarely in that frame.

Allens put the runway at about ten weeks when the OAIC released its final guidance on 30 September. By now it's closer to nine.

Ten weeks goes quickly when nobody owns the job.

A quick note before I go further. I'm a recruiter, not a lawyer, and this isn't legal advice, so check the detail with your privacy or legal adviser. What I can tell you is where hiring tools tend to hide.

What's actually in scope

The OAIC's fact sheet uses recruitment as a worked example. Recruitment software used to sort through candidate profiles and make hiring decisions is in. So is an AI video-interview tool that scores candidates. It also names targeted job advertising.

Three points from the Allens analysis stood out.

It isn't only AI. The rules can capture everyday software, including spreadsheets and chatbots. A scoring formula in a shared spreadsheet can count.

A human in the loop doesn't get you out. If the tool's output is a key input into the decision, having a person sign off doesn't take it out of scope.

It's your obligation, not your vendor's. The disclosure sits with the organisation using the tool. Your vendor may need to give you information, but the privacy policy is yours.

That's the part that often gets missed. Most mid-size organisations didn't build their hiring stack. They bought it, one feature at a time.

Where I'd start

Map the whole hiring process. From the job ad to the offer, list every tool that touches a candidate's personal information. That means the applicant tracking system, screening and assessment platforms, video interview software, job ad targeting, scheduling chatbots, and the spreadsheet someone uses to rank applicants.

Ask each vendor four questions. What personal information does the tool use? Does it rank, score, filter or reject anyone? Which of those steps happen without a person? Can you give us a plain-English description we can use in our privacy policy?

Be honest about how the output is used. If your team rarely overrides the shortlist the tool produces, treat the tool as part of the decision.

Update the policy in plain English. Describe the kinds of personal information used and the kinds of decisions involved. Candidates should be able to read it without a glossary.

Who should own it

Not IT on its own, and not legal on its own. People and Culture runs the hiring process and knows where the tools actually sit, so I'd have them lead, with your privacy or legal adviser signing off and IT confirming what each system does.

If nobody in your organisation has an AI governance remit, this is a good prompt to fix that. My AI governance specialist salary guide sets out what that remit looks like and what it costs. For many mid-size businesses a few months of specialist help is enough, which is where AI consulting talent fits.

Where I'd leave it

If you do one thing this month, make it the list of every tool that touches a candidate. In my experience that's where the surprises turn up, usually a screening feature someone switched on a year ago or a spreadsheet nobody thinks of as software. Once you have the list, the privacy policy update is fairly straightforward.

If you'd like a second pair of eyes on how your hiring process is set up before 10 December, I'm happy to have a chat.