AI governance for high-impact industries
Automated decisions about credit, healthcare, employment and customers carry the greatest risk and attract the most scrutiny. This page explains how the December 2026 privacy changes and broader AI governance expectations may apply in your sector.
The same law applies differently in each sector
From 10 December 2026, organisations covered by the Privacy Act will need to explain in their privacy policies when computer programs make, or substantially and directly support, decisions that could significantly affect individuals using their personal information.
Whether this applies, and what good governance looks like, depends on your industry, the decisions you automate and the data you use. The sectors below are where AI most often affects people in significant ways.
Financial services & lending
Lenders, banks, insurers and super funds often rely on models and rules engines for decisions that directly affect customers. These are among the use cases most likely to need a closer look as new transparency requirements for automated decisions take effect in December 2026.
AI decisions to look at
- Credit and loan approvals, limits and pricing
- Fraud and anti-money laundering alerts that block or delay transactions
- Insurance underwriting, premium pricing and claims triage
- Hardship, collections and account closure decisions
Key considerations
- Privacy Act obligations, including disclosure of relevant automated decisions from 10 December 2026
- Existing responsible lending, insurance and consumer protection obligations
- Regulator expectations on AI governance, operational risk and information security such as those of ASIC and APRA
- Explainability for customers, complaints handling and external dispute resolution
How we help
- Inventory of models and rules engines that make or support customer decisions
- Mapping which decisions may need to be disclosed in your privacy policy
- Controls for human review, overrides and model monitoring
- Reporting on AI use for the board and risk committee
Healthcare & aged care
Health information is sensitive information under the Privacy Act, so AI tools in clinics, hospitals, allied health and aged care need careful governance. This includes AI scribes, triage, scheduling and care planning tools.
AI decisions to look at
- Triage, prioritisation and appointment scheduling
- Clinical documentation, AI scribes and summarisation
- Care planning, risk alerts and resident monitoring
- Support for eligibility, funding and service allocation decisions
Key considerations
- Stricter handling rules for sensitive health information and patient consent
- Professional obligations when practitioners use AI (see Ahpra guidance)
- Some AI software may be regulated as a medical device by the TGA
- Aged care quality, safety and record keeping expectations
How we help
- Review of AI tools and vendors handling patient or resident data
- Clinical safety and human oversight checkpoints
- Updates to consent processes, transparency and privacy notices
- Staff guidance on approved and prohibited AI use
HR & recruitment
Recruiters and employers increasingly use AI to screen CVs, score interviews and manage rosters. Decisions about who gets hired, shortlisted or scheduled can significantly affect individuals, and candidate information may not be covered by the employee records exemption.
AI decisions to look at
- CV screening, ranking and shortlisting
- Online assessments and automated scoring of video interviews
- Rostering, shift allocation and performance analytics
- Workforce monitoring and productivity tools
Key considerations
- Privacy obligations for job applicants and contractors
- Anti-discrimination and fair work obligations when tools may embed bias
- Transparency with candidates about how AI is used
- Vendor accountability for third-party HR platforms
How we help
- Review of screening and assessment tools for bias and fairness
- Clear information for candidates and updated privacy notices
- Human review points before adverse hiring decisions
- Due diligence questions for HR technology vendors
Retail & e-commerce
Retailers use AI for personalisation, dynamic pricing, loyalty, fraud prevention and customer service. When automated systems refuse orders, suspend accounts or change what customers are offered, governance and transparency matter.
AI decisions to look at
- Fraud screening, order cancellation and account suspension
- Dynamic pricing, offers and loyalty tiering
- Returns and refund eligibility
- Customer service chatbots and automated complaint handling
Key considerations
- Privacy Act obligations for customer data, profiling and direct marketing
- Australian Consumer Law, including avoiding misleading conduct in automated offers and chatbots
- Transparency where automated decisions significantly affect customers
- Security of customer data shared with AI vendors
How we help
- Mapping the AI your customers interact with and the decisions it drives
- Chatbot accuracy, escalation and disclosure controls
- Updates to your privacy policy and customer notices
- A practical AI usage policy for marketing and customer experience teams
Common questions by sector
Do the December 2026 changes apply to every business in these industries?
No. They apply to organisations covered by the Privacy Act that use computer programs to make, or substantially and directly support, decisions that could reasonably be expected to significantly affect individuals’ rights or interests using personal information. Whether a specific decision is in scope needs case-by-case assessment.
Our AI tools come from a vendor. Are we still responsible?
Generally, yes. Using a product from another company does not remove an organisation’s own privacy and governance responsibilities. Vendor due diligence, contract terms and ongoing monitoring are important parts of AI governance.
What if my industry is not listed?
These are common examples, not an exhaustive list. Education, government services, utilities, telecommunications, real estate and professional services can also use AI in ways that affect people. Contact us to discuss your situation.
Not sure which of your decisions are in scope?
Use our free scope check, or tell us about your organisation and we will suggest a practical first step.