Commonwealth agencies would be barred from automating any decision that requires judgement, under a bill now before the House of Representatives. They would also have to publish the rules, weightings and test results behind every high risk system.
The bill would go considerably further than the transparency obligation already on the way. From 10 December 2026, Australian Privacy Principle 1.7 requires privacy policies to disclose the use of automated decision-making.
The Automated Decision-Making (Safeguards and Transparency) Bill 2026 was introduced by Kate Chaney, the independent member for Curtin, on 7 September. It is a private member's bill.
It implements recommendations 17.1 and 17.2 of the Royal Commission into the Robodebt Scheme, which reported in July 2023. The government accepted both and has legislated neither.
APP 1.7 is triggered where a computer program solely makes a decision, or does something substantially and directly related to making it. Personal information must be used in the program's operation. The decision must be one that could reasonably be expected to significantly affect a person's rights or interests. It binds agencies and private entities alike.
Commonwealth agencies also sit under the Digital Transformation Agency's Policy for the responsible use of AI in government, at version 2.0 since 15 December 2025. It requires accountable officials, published transparency statements, AI use-case registers, impact assessments and mandatory foundational AI training across the APS. It covers non-corporate Commonwealth entities, excluding Defence and the national intelligence community, with its first mandatory requirement due on 15 June 2026.
Both are disclosure and governance instruments. Neither requires that a human can override an automated result, and neither creates a review right for the person affected.
Chaney told the House that automation is spreading across government without rules. There is no requirement that a human can override an automated decision, and no requirement to test tools before use.
She called that gap "a failure by the Albanese Labor government". Recent decisions to automate matters affecting older Australians and people with disability had made it worse.
"It appears that this government is willing to wait for the next robodebt to happen rather than listen to community, to the experts, to civil society and to the robodebt royal commission and act now," she said.
Chaney said the government's own consultation drew 20 responses and closed nearly two years ago, with no legislation since. Her office published a media statement that day.
What could not be automated at all
Clause 18 sets out six outright prohibitions. Automation would be banned where it would likely produce unlawful action, or where the action requires an evaluative determination.
An evaluative determination means a discretion being exercised, an evaluative judgement being made, or a state of mind being formed. The definition comes from the National Disability Insurance Scheme Act 2013.
Automation is also prohibited where a plain English and technical explanation of the system's outputs cannot be produced. Explainability becomes a precondition for deployment.
The other prohibitions cover undue influence on a discretion, unjustified human rights impacts, and serious damage to public confidence in government administration.
An action counts as automated if a computer program takes it, or does something "substantially and directly related to" taking it. That is the same test the Privacy Act applies. The memorandum says the wording stops agencies recording a human as the decision maker to avoid the rules.
No action could be automated until a risk assessment is published on a new Commonwealth Automated Tools Register. Each assessment must classify the automation as high risk or not.
High risk classification is mandatory where the action could reasonably be expected to significantly harm a person, the community or the environment.
Where an action is automated and a law requires notice, the notice must say so and name the responsible officer and review rights. Clause 26 requires a meaningful explanation of the rules and facts applied, and what would have changed the outcome.
Extra duties for high risk systems
A human decision maker must hold the power to substitute a different action where the automated result is not correct or preferable. Internal merits review must be completed within four weeks, or two where regulations prescribe.
External review by the Administrative Review Tribunal and judicial review must both be available. The rules, algorithms, weightings and testing must be published.
The Commonwealth Ombudsman would maintain the register and review every high risk system at least once every three years.
Chaney said an automated tool has had the final say on aged care support packages for the best part of a year. "Human decision-makers have been unable to override a result when they believe it to be incorrect," she said.
Between 2015 and 2019 the Robodebt scheme raised debts against more than 400,000 Australians. IDM has previously reported on the aftermath of the royal commission and on agencies unable to account for the AI they run.