HR and AI in Australia: Compliance Obligations for Hiring, Screening, and Performance

Australian businesses using AI tools in their HR function face a layered set of obligations under the Privacy Act, anti-discrimination law, and the Fair Work Act. These obligations apply regardless of whether the AI tool was built in-house or purchased from a third-party vendor. HR data is some of the most sensitive personal information a business handles. Getting AI use in HR wrong can result in discrimination complaints, OAIC investigations, and Fair Work proceedings, often at the same time. This guide explains what compliance looks like in practice for small and medium businesses.

Privacy Act obligations for HR AI use

Candidate and employee data is personal information under the Privacy Act 1988. The Australian Privacy Principles apply to how you collect, store, use, and disclose that data when AI tools are involved. For HR teams, the most relevant APPs are APP 3 (collection), APP 5 (notification), APP 8 (cross-border disclosure), APP 11 (security), and the new automated decision-making provisions taking effect December 2026.

Collection and notification (APPs 3 and 5)

Under APPs 3 and 5, the Privacy Act requires businesses to take reasonable steps to notify applicants of how their personal information will be used at or before the point of collection. The OAIC's guidance indicates that if an AI tool is used to screen or rank an application, that use should be disclosed in the job listing or application form. The notification does not need to be complex, but it should be accurate: what data is being collected, why, how it will be used (including AI processing), and who it may be shared with. See APP 5 guidance at oaic.gov.au.

Most recruitment privacy notices predate AI screening tools. If your standard privacy notice says nothing about AI or algorithmic processing, update it before using any AI tool in your hiring workflow. A privacy notice that describes only human review when AI is involved is not transparent and does not meet APP 5 requirements.

Cross-border data transfers (APP 8)

Most AI recruitment tools are operated by vendors with servers outside Australia. When candidate data is processed by an overseas AI vendor, APP 8 (cross-border disclosure of personal information) applies. Under APP 8, the OAIC's guidance outlines that businesses are expected to take reasonable steps to ensure the overseas recipient handles the information consistently with the Australian Privacy Principles. This means reviewing the vendor's privacy policy, their data processing agreements, and the jurisdiction where data is stored and processed. See the OAIC's APP 8 guidance at oaic.gov.au.

If you cannot confirm that an overseas AI vendor meets an equivalent standard, you remain liable for any breach of the APPs by that vendor. This does not mean you cannot use overseas vendors. It means you need to review their privacy posture and document that review before using them for HR data.

Automated decision-making: the December 2026 deadline

From December 2026, Privacy Act amendments require businesses to disclose in their privacy policy when they use automated decision-making that significantly affects an individual's rights or interests. Hiring, shortlisting, and performance review are among the clearest examples of decisions that significantly affect individuals. If your AI recruitment tool filters applicants before a human reviews them, that is automated decision-making under the new rules.

The required disclosures are: whether you use ADM, the types of decisions made, and the personal information used in making those decisions. APP 1.7 is a transparency requirement, not a right to contest a decision: it does not create a legal right for candidates or employees to demand human review of an automated decision, unlike the EU's GDPR. Some employers choose to offer a human review option anyway, as good practice or to reduce discrimination-complaint risk, but doing so is a business decision, not a legal obligation under APP 1.7.

Anti-discrimination risks from AI in hiring

AI hiring tools trained on historical hiring data can perpetuate and amplify existing workplace biases. If your historical hiring data over-represents a particular demographic in senior roles, an AI tool trained on that data may score candidates from underrepresented groups lower, regardless of their actual qualifications. This can constitute unlawful discrimination under the Age Discrimination Act, Sex Discrimination Act, Racial Discrimination Act, and Disability Discrimination Act.

The key principle in Australian discrimination law is that the discriminatory outcome matters, not the intent. An AI tool producing discriminatory shortlists is not a defence. Your business chose the tool and used its outputs. If a rejected candidate can show they were treated less favourably on the basis of a protected attribute, and that AI bias was a contributing factor, your business faces the claim.

Practical steps to manage this risk include: testing AI tool outputs for demographic patterns before full deployment, including human review as a mandatory step before any candidate is rejected based solely on an AI score, documenting the criteria used in AI screening decisions, and auditing AI hiring results annually against your workforce diversity data.

Fair Work Act considerations

The Fair Work Act contains provisions relevant to AI use in the workplace. The right to disconnect provisions provide that employees are not obliged to monitor AI-generated communications or respond to AI-triggered alerts outside their ordinary working hours unless agreed terms require it. If HR AI systems send notifications or require employee responses, check whether those requirements are covered by employment contracts or enterprise agreements. See Fair Work Commission guidance at fwc.gov.au.

If AI tools are being introduced that significantly change how work is done. AI performance monitoring, AI scheduling, AI workload allocation. Modern awards and enterprise agreements often include consultation obligations before implementing those changes. Review your applicable instruments with a qualified employment law advisor.

If you are introducing AI tools that significantly change how work is done (AI performance monitoring, AI scheduling, AI workload allocation), you may have consultation obligations under the Fair Work Act before implementing those changes. Modern awards and enterprise agreements often include consultation clauses triggered by significant changes to work processes. Review these obligations before rolling out HR AI tools to existing employees.

AI in performance management

AI tools used in performance management, including tools that monitor productivity, score work quality, or generate performance assessments, raise additional compliance considerations. Workplace surveillance laws vary by Australian state and territory. In New South Wales, the Workplace Surveillance Act 2005 imposes specific requirements for notifying employees of surveillance and obtaining consent. Other states have different frameworks. Before implementing AI performance monitoring, check the requirements in every state or territory where your employees are based.

Performance decisions informed by AI should still involve human judgement. An AI productivity score used as the sole basis for a performance improvement plan or termination decision creates significant unfair dismissal risk. The AI output should inform the conversation, not substitute for it.

What to do before using AI in your HR function

1. Update your privacy notice for job applicants. Add disclosure of any AI tool used in screening, ranking, or assessing applicants and what data it uses.
2. Review your AI vendor's data handling. Confirm where candidate data is stored, who has access, and whether the vendor meets equivalent privacy standards for APP 8 compliance.
3. Update your privacy policy for the December 2026 ADM requirements. For every AI tool that makes or substantially assists decisions about candidates or employees, add the required disclosures before December 2026: whether you use automated decision-making, the types of decisions, and the kinds of personal information used.
4. Consider a human review option. APP 1.7 does not legally require a human review pathway for automated decisions, but offering one for hiring or performance decisions can reduce complaint and discrimination risk. If you choose to offer it, document who handles requests and in what timeframe.
5. Test AI tool outputs for bias. Before full deployment, run the tool against a sample of historical candidates and review the output for demographic patterns. If patterns emerge, investigate before proceeding.
6. Check state-specific surveillance laws. For any AI tool monitoring employee activity or productivity, confirm you meet notification and consent requirements in each state where your employees are based.
7. Review Fair Work consultation obligations. If AI tools materially change work processes, check your modern award or enterprise agreement for consultation requirements before implementation.

Related reading: can staff upload customer data to AI tools, AI and the Privacy Act guide, AI data residency in Australia, OAIC guidance on AI for businesses, AI tools with Australian data centres, free AI staff policy template, AI vendor contracts and Privacy Act, AI data breaches and the NDB scheme, Claude AI review for Australian business, Notion AI review for Australian business, and Microsoft Copilot pricing in Australia.

Related reading: our AI use in hiring and Privacy Act obligations, our legal guide to AI recruitment tools in Australia, and our how to roll out an AI policy to your team.

Related reading: our how AI is changing the work of Australian bookkeepers and our whether 1Password Teams is worth it for small business.

Try our free AI Privacy Risk Scorer to score your current AI tool setup against Privacy Act requirements.

Try our free AI Compliance Checker to check whether your AI tools meet your compliance obligations.

Is it legal to use AI to screen job applications in Australia?

Yes, using AI to assist in screening job applications is not prohibited in Australia. Privacy Act obligations apply. Including providing a collection notice, addressing data security, and managing cross-border disclosure where applicable. The OAIC's guidance requires disclosure of AI use in the candidate privacy notice, and from December 2026, automated decision-making must be disclosed in the privacy policy with a pathway for candidates to request human review. Discrimination risk also applies, as AI tools producing biased shortlists can result in claims under Australian anti-discrimination law. See the OAIC's full AI guidance at oaic.gov.au and consult a qualified advisor for your specific circumstances.

Do we need candidate consent to use AI in screening?

The Privacy Act does not require consent as the primary basis for collecting and using personal information in recruitment. APP 3 allows collection where it is reasonably necessary for a legitimate business function, provided the required notification under APP 5 has been given. The OAIC's guidance under APP 5 requires notification to candidates that AI is being used in their assessment and how. Consent may be required in specific circumstances. Such as where sensitive information (health, criminal history) is being collected, or where state or territory law requires explicit consent for AI-based assessment. Check state and territory obligations in addition to the Privacy Act with a qualified advisor.

Can we use AI for performance reviews and dismissal decisions?

AI can inform performance review processes but should not be the sole basis for dismissal or formal performance management decisions. Using AI output as the only evidence in a dismissal decision creates unfair dismissal risk under the Fair Work Act, as it makes it difficult to demonstrate the dismissal was based on valid reasons that were fairly assessed. AI productivity scores and automated performance flags should feed into human-led review conversations, not substitute for them. Document human involvement in all significant performance decisions.

What should we include in our HR AI policy?

An HR AI policy should cover: which AI tools are approved for HR use, what candidate and employee data each tool can access, what decisions can be assisted by AI and what decisions require human sign-off, how the human review process works for automated assessments, what training HR staff must complete before using AI tools, how AI tool outputs are stored and for how long, and how compliance with this policy is monitored. See our HR AI Policy Template for a ready-to-use starting point.

Does state workplace surveillance law apply to AI tools?

Yes. State and territory workplace surveillance laws apply to AI tools that monitor employees, including AI productivity trackers, AI-based activity monitors, and AI systems that score employee outputs. The requirements vary by state. In New South Wales, the Workplace Surveillance Act 2005 requires employers to notify employees of surveillance at least 14 days before it begins and to specify the type of surveillance being used. Other states have different notice and consent requirements. Check the requirements for each state and territory where your employees work before deploying AI monitoring tools.