AI Receptionist Privacy Rules in Australia: What Changes on 10 December 2026

From 10 December 2026, Australian businesses that use a computer program, including an AI receptionist, to make or materially shape a decision significantly affecting someone's rights or interests have to say so in their privacy policy, but the Privacy Act's small-business exemption, which covers any business with annual turnover under $3 million, means most solo and small trades operators running an AI receptionist today aren't bound by that new rule. That gap between "the law changed" and "my business has to do something" is where most of the confusion sits, and it's worth working through rather than assuming either "this doesn't apply to me" or "I need a lawyer tomorrow."

The trigger for this piece is real and dated. The Office of the Australian Information Commissioner (OAIC) released its final guidance on the new Australian Privacy Principle 1.7–1.9 automated decision-making (ADM) transparency obligation on 30 September 2026, an updated set of APP 1 Guidelines plus a dedicated fact sheet and flowchart. Law firm Allens published its own analysis of that guidance two days later, on 2 October 2026. None of that is in dispute. What's less settled, and what general-compliance coverage tends to skip, is where a trades business running an AI receptionist actually sits against it: the answer depends less on the technology itself than on what it's allowed to decide.

APP 1.7's automated decision-making disclosure: what it requires

Strip away the legal phrasing and the obligation is narrow. An APP entity (a business or agency covered by the Privacy Act) has to add specific content to its privacy policy when three things are all true at once: it has arranged for a computer program to make a decision, or to do something substantially and directly related to making one; that decision could significantly affect an individual's rights or interests; and personal information about that individual is used in running the program. When all three line up, the privacy policy has to disclose the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds of decisions where the program does a substantially related task.

That's it. The obligation is transparency only: it doesn't hand anyone a right to contest a decision, and it doesn't require direct notification of the affected person. It just means the privacy policy has to say, in enough detail that a reader understands it, what's happening to their information. Allens' 2 October analysis frames this as a disclosure exercise, not a new consent or review mechanism.

The flowchart below walks through where an AI receptionist sits against that test, because "significantly affects rights or interests" and "under or over the small-business threshold" are two separate gates, and a trades business can clear one and still fail the other.

Two things matter in that diagram. First, the diamond itself: a tool that just records a message for a human to act on isn't making a decision about the caller, so it clears the first gate regardless of turnover. Second, clearing the turnover gate (being under $3 million) doesn't mean the first gate was ever reached; it just means the exemption would shield the business if it had been.

Australia's AI receptionist privacy rules: who's actually exempt today

The Privacy Act's small-business exemption is long-standing, not something new in this round of changes. A business with annual turnover of $3 million or less is generally outside the Act altogether, with a short list of standing exceptions regardless of size: health service providers, businesses that trade in personal information (buying or selling mailing lists, for instance), Commonwealth contractors, credit reporting bodies, and a handful of other specific categories, per Lawpath's explainer on the exemption. A solo plumber or a five-person electrical outfit turning over well under $3 million, doing none of those carved-out activities, sits outside the Privacy Act's reach entirely, so APP 1.7's new disclosure duty, which only binds APP entities, doesn't reach them either. That's the practical reason most trades operators can exhale: today, for most of them, this deadline changes nothing they're legally required to do.

Two qualifiers matter, though, and this is where "you're exempt, don't worry about it" content tends to stop short.

First, the exemption itself isn't settled policy. The Australian Government's formal response to the 2023 Privacy Act Review agreed in-principle to remove it altogether, subject to further consultation, a change that, if legislated, would pull every trades business into scope regardless of turnover. As of this writing that's a stated direction, not a passed law, with no commencement date set. But a business exempt purely because of a threshold under active reform review is in a different position than one whose activity could never trigger the obligation at all.

Second, and specific to AI receptionists: the exemption only matters once a decision clears the "significantly affects rights or interests" bar at all. A tool that takes down the caller's details and hands the message to a human to call back, in whatever order they choose, isn't making a decision about the caller; it's capturing information for someone else to decide on. That's the model most AI receptionists, including basic message-taking setups, run on, and most of why this obligation barely touches the category today.

A tool that triages, deprioritises, or auto-declines callers does something categorically different. If it decides a caller sounds like a low-value job and bumps their callback to the bottom of the queue, or declines to book them in at all, it has made a decision that changes what happens to that person, rather than just capturing information for someone else to decide, and that's closer to the decision APP 1.7 is built to catch, independent of turnover. This isn't hypothetical: ServiceM8's own Phone Agent documentation states it can "filter spam and sales calls" as part of handling an inbound call, a real, shipped example of an AI receptionist making a call-level decision rather than just logging a message.

Run the 4-question self-assessment

None of the above is useful as abstract legal theory. Run these four questions against your own setup, in order, and stop as soon as one of them gives you a clear answer:

1. Does your AI receptionist do anything to a call besides recording it? If it only takes a message, a name, and a callback number for a human to action in whatever order they like, you're likely clear of the "decision" trigger regardless of anything else on this list.
2. If it does more than that, could the action change what actually happens to the caller? A skipped callback, a job that's quietly never logged, a caller auto-declined or told to try someone else: these are outcomes a human never got the chance to weigh in on.
3. Is your business's annual turnover over $3 million, or does any of the standing exceptions apply to you — a health-service business, one that trades in personal information, a Commonwealth contractor, or one of the other listed categories? If yes, the small-business exemption doesn't shield you regardless of what question 1 and 2 found.
4. Even where the law doesn't currently require it, could you explain out loud, to a caller, exactly what your AI receptionist decided about their call and why? If the honest answer is "I'm not sure," that's a signal worth acting on before a regulator, or a customer, asks the same question, independent of the exemption.

A "no" on question 1 and a "no" on question 3 means you're in the clear today, full stop. A "yes" anywhere else means it's worth reading the next section with your own setup specifically in mind.

Two businesses, same law, different answers

These two examples are hypothetical, built to show how the same rule lands differently depending on what the AI receptionist is actually allowed to do. Neither describes a real Fixa customer.

Hypothetical 1 — a solo plumber, message-taking only. A single-operator plumbing business runs an AI receptionist purely to answer calls while the owner is on a job: it takes the caller's name, number, and problem description, texts a confirmation, and leaves every booking decision to the owner. Turnover sits well under $3 million. Against the self-assessment: question 1 stops it dead, since the tool makes no decision about any caller, it only records what they said. Question 3 would exempt the business anyway, but never has to get there, because the first gate above was never cleared. Nothing in APP 1.7 applies to this setup on 10 December 2026, unless the tool's job changes.

Hypothetical 2 — a multi-crew electrical business, auto-declining low-priority callers. A growing electrical contractor configures its AI receptionist to triage inbound calls: urgent jobs get booked immediately, mid-priority jobs get queued for a callback, and calls classified as low-value get a polite auto-decline with a suggestion to email instead, with no human ever reviewing that call. Suppose turnover has grown past $3 million. Against the self-assessment: question 1 doesn't stop it, since the tool does more than record. Question 2 confirms it: an auto-declined caller never gets the callback a human might have chosen to make. Question 3 confirms turnover is over the threshold. This business clears every gate and lands in scope from 10 December 2026: its privacy policy needs to say an automated process triages and in some cases declines inbound calls, and what personal information feeds that.

Same law, same deadline, two businesses a handful of staff apart in size, and only one of them has anything to actually change in its privacy policy, because of what its AI receptionist is configured to decide, not because of the technology running underneath it.

What a compliant disclosure actually has to say

For a business that does land in scope, whether because it's over the turnover threshold today, falls under one of the standing exceptions, or simply wants to get ahead of where the exemption reform is heading, the content requirement itself is short and specific. The OAIC's guidance breaks it into three required elements, plus the practical step of actually publishing them before the obligation starts.

That last node matters as much as the first three: this is a disclosure obligation with a hard date, not a one-time review. The content has to actually be live in the published policy by 10 December, and it has to stay accurate as the tool's configuration changes. A business that later reconfigures its AI receptionist to start auto-declining calls it previously just logged needs to update the disclosure at that point, not treat the original update as a box ticked once and left alone.

Frequently asked questions

Does APP 1.7 mean I need a lawyer before 10 December 2026?

Not necessarily. If your AI receptionist only takes messages, or your turnover sits under $3 million with no standing exception applying, the obligation most likely doesn't reach you. If it auto-declines or otherwise acts on calls with no human reviewing the outcome, and turnover is over the threshold, it's worth getting someone who knows privacy law to check your actual policy wording rather than relying on a general article.

My AI receptionist just takes messages. Am I completely off the hook?

For this specific obligation, most likely yes, since the "decision" trigger in APP 1.7 isn't met: a message handed to a human to action isn't a decision the program made about the caller. That said, "off the hook for APP 1.7" isn't "off the hook for privacy law generally": storing a caller's personal information still falls under other, longer-standing Australian Privacy Principles if your business isn't otherwise exempt.

If I'm under $3 million turnover, do I ever need to think about this again?

Worth checking back on rather than filing away permanently. The exemption is subject to a government reform process that has, at the in-principle level, proposed removing it altogether. Nothing is legislated yet, but a threshold under active review is less durable than one that isn't on anyone's agenda.

What counts as a decision that "significantly affects" someone's rights or interests?

The OAIC's guidance doesn't give trades-specific examples, but the test is about outcome, not industry: does the automated step change what actually happens to the person, in a way they didn't weigh in on? A caller who's auto-declined, deprioritised without knowing it, or routed somewhere other than where a human would have sent them has had something decided about them. A caller whose message was simply recorded for a callback hasn't.

Does this obligation apply to how Fixa handles calls?

Fixa's design is to answer calls, capture the job detail, and write it straight into ServiceM8 as a job card for the business to action, not to auto-decline or silently deprioritise callers unless the business's own configuration chooses that. Whether APP 1.7 reaches any particular business, Fixa customers included, still depends on that business's turnover and how it configures the tool, not on the vendor.

Where can I actually read the rule instead of a summary of it?

The OAIC's own APP 1.7–1.9 transparency fact sheet and updated APP 1 Guidelines, published 30 September 2026, are the primary source, with Allens' 2 October 2026 analysis as a readable walkthrough of the same material, both linked in Sources below.

Before 10 December, do this

• Run the 4-question self-assessment above against your actual configuration — not what the marketing page says the tool can do, but the specific triage, decline, or routing rules you've turned on.
• Check your current annual turnover against the $3 million threshold, and note whether a standing exception (health services, trading in personal information, Commonwealth contracting, and the others) applies regardless of size.
• If you land in scope, update your privacy policy with all three disclosure elements before 10 December 2026, and set a reminder to revisit it whenever you change what the AI receptionist is allowed to decide on its own.

The $3 million line that exempts most trades businesses today is the same line a live reform process has already proposed erasing, so the more durable move isn't memorising today's exemption boundary. It's knowing, in plain language, exactly what your AI receptionist is allowed to decide without you, so that whenever the boundary moves, the answer doesn't have to change.

Sources

• OAIC — New resources on transparency for use of AI and automated decision-making (30 September 2026)
• OAIC — Small business and the Privacy Act ($3 million turnover threshold)
• Allens — Mandatory automated decision-making disclosure requirements are coming: key takeaways from the OAIC guidance (2 October 2026)
• IAPP — Australia's government responds to the Privacy Act Review Report (in-principle agreement to remove the small-business exemption)
• Lawpath — Are small businesses covered by the Privacy Act? (standing exceptions to the exemption)
• ServiceM8 Help Centre — Introducing the ServiceM8 Phone Agent (spam/sales call filtering)