Automated decision-making and public reporting under the Freedom of Information Act

Foreword

Automated decision making (ADM) has been widely adopted by many government agencies and is currently used in many service delivery contexts such as social services, migration, biosecurity, aged care and veterans’ entitlements.^[1]

ADM provisions have been incorporated into many statutes over the past 25 years so that the Australian public can benefit from the increased efficiency and consistency in decision-making that ADM can provide. However, public examples of failures of oversight of ADM, such as those outlined by the Robodebt Royal Commission, have highlighted the need for transparency about the use of ADM by government. The benefits of utilising ADM technology in government will only be realised if risks are appropriately mitigated and trust is built with the Australian community.  A key enabler of trust is transparency and by leading the way in transparency ‘the government can build public trust in the technology and ensure its benefits are shared widely across society’.^[2]

The Office of the Australian Information Commissioner (OAIC) is an independent regulatory agency comprising part of the Commonwealth integrity framework.^[3] The Commonwealth Integrity Strategy commits to: transparency and accountability of actions and decisions being improved; and enhancing public trust and confidence in the Commonwealth public sector.^[4] This report seeks to highlight whether agencies, that are authorised to use ADM, are being transparent about their use through the public reporting requirements contained in the Freedom of Information Act 1982 (FOI Act) and in doing so, provide regulatory guidance to agencies.^[5]

The FOI Act promotes access to government held information through 3 pathways: mandated proactive release, informal release and release in response to a formal application. Part II of FOI Act mandates that agencies must proactively publish information to foster transparency and open government through the Information Publication Scheme (IPS). The IPS establishes the right of access to government information which should be publicly available, accurate, up to date, complete and available free of charge where possible. It requires agencies to publish a range of information, including information about what the agency does and the way it does it. This mandatory requirement sits squarely with the use of ADM.

Additionally, the FOI Act specifically requires agencies to publish their operational information, which is information that assists the agency to exercise its functions or powers in making decisions or recommendations that affect members of the public.^[6] For example, the agency’s practices relating to its decisions and recommendations affecting members of the public.^[7] This obligation is fortified by s 10 of the FOI Act which seeks to ameliorate harm that can be silently conferred upon an individual, or in the case of ADM a collective, when agencies fail to publish operational information.

The FOI Act provides that a person must not be subject to any prejudice because of the application of a rule, guideline or practice in unpublished information, if the person could have lawfully avoided the prejudice had they been aware of the unpublished information.^[8]

In a contemporary context, operational information should be interpreted to include information about the use of ADM systems which support decision making and recommendations, including the rules and procedures that agencies apply in making decisions. This observation was expressed in 2021 when the digital environment was far less advanced than it is today.

To avoid prejudice to individuals, the FOI Act may therefore require additional information to be published. What would be required could vary in each case, depending on the complexity of the system. However, it would be easy to imagine examples where the data underpinning the system may also need to be released so that individuals can see what is and is not being considered in the decision-making process.^[9]

The currency of published information is secured under the FOI Act which requires all agencies to ensure that the information they publish under the IPS is up to date.^[10] The community therefore has a right to expect that as the use of ADM increases and its underpinning data sets constantly evolve, an agency’s response to their requests for information will reflect the most up to date information.

With the increasing use of emerging forms of automated systems such as Artificial Intelligence (AI), and the more basic ADM which includes examples like benefit or tax calculators, it is timely to assess how transparent agencies are about its use.^[11] The benefits of transparency in this otherwise opaque process include: the preservation of conferred human rights; the legal right to contest government decisions; increasing participation in government decision making to promote better informed decision-making; increasing scrutiny and discussion and review of Government’s activities.

More broadly, transparency mitigates the risks of misuse and misinformation. Trust in government service delivery is also enhanced and ultimately trust in government is promoted through proactive release of information. A community that is better informed can participate more effectively in democratic processes and proactive release of such information enables individuals to understand why and how decisions affecting them are made. The right to access information as a single source of truth has never been more important in our contemporary context of declining trust.

Relevantly, the 2025 Commonwealth Integrity Strategy measures of transparency and accountability of actions and decisions include: the percentage of the population who believe that information on public services is easily available, and the percentage of population who find it likely that the Commonwealth would explain decisions or reforms.^[12]

To support trust in government, leaders must proactively champion behaviours that demonstrate their commitment to openness and accountability, including making operational information available at the earliest opportunity.

This report is provided to promote awareness within the Australian community of the use of ADM by government agencies and to assist agencies in identifying and providing information which is required to be published under the FOI Act. We intend to provide this report to agencies and update Part 13 – Information Publication Scheme of the FOI guidelines so that ADM is expressly included as an example of ‘operational information’. In doing so we will inject clarity and certainty for agencies and the community regarding the operation of the Australian access to information scheme in the context of digital government.

This report is not intended to comment on the use of ADM or the mechanisms of ADM, we are aware that the Attorney-General’s Department (AGD) has a larger policy remit in this area, we confine our comments to the realisation of the IPS requirements in a contemporary decision-making environment.

Executive summary

The use of ADM can have significant impacts on individuals’ rights and interests. As agency use of ADM becomes more common, it is important to assess the safeguards and transparency that protect individuals who are affected by these decisions. This report advances agency and community awareness of mandatory publication requirements and contributes to the promotion of integrity in the Australian Public Service (APS).

Part II of FOI Act mandates that agencies must proactively publish information to foster transparency and open government through the IPS. Section 8(2)(c) requires agencies to publish, as far as practicable, details of the functions of the agency, including its decision‑making powers and other powers affecting members of the public. Section 8(2)(j) requires agencies to publish their operational information, which is information that assists the agency to exercise its functions or powers in making decisions or recommendations that affect members of the public.^[13]

In October 2025, under section 8F(c) of the FOI Act, the OAIC conducted a desktop review to assess how transparent agencies are about their use of ADM.

We identified 23 government agencies that have statutory authorisation to use ADM. We reviewed each of the identified agencies’ websites, AI transparency statements,^[14] IPS agency plans and performed keyword searches to try to identify whether agencies disclosed if they were using ADM. Our threshold was whether a member of the public, who wanted to know if an agency was using ADM, could reasonably do so by performing relatively simples searches on the agency websites.^[15]

We found that all reviewed agencies published IPS information on their website. However, inclusion of ADM information through proactive release under the IPS and on their agency website was limited:

• 100% (23) of agencies complied with the requirement to publish IPS information,
• 17% (4) of agencies authorised to use ADM disclosed that they use ADM in a decision-making process in their IPS information,
• 39% (9) of agencies (in addition to the 4 above) made reference to ADM in their IPS information but did not confirm that they used it,
• 43% (10) of agencies did not mention ADM in their IPS information,
• The agencies that disclosed in their IPS information that they used ADM were not clear about how they used it, and
• 0% (0) We did not find any agency that had any published guidelines or policies on ADM.

We recommend that:

These recommendations form a baseline for consultation and revision of the FOI Guidelines. The OAIC will update Part 13 – Information Publication Scheme of the FOI guidelines so that ADM is expressly included as an example of ‘operational information’. This will involve consideration of information to better assist the public to understand how ADM is being used and how it may impact them. This regulatory guidance will assist agencies to understand their obligations under section 8(2) of the FOI Act and ultimately improve transparency and trust about the use of ADM by government agencies. ^[16]

What is meant by ADM and where is it in use?

ADM is “the use of technology, commonly referred to in Commonwealth legislation as a ‘computer program’, to automate a decision-making process”.^[17] In its consultation on ADM, AGD stated “[m]ost Commonwealth ADM is delivered through relatively simple rules‑based systems. An example of this approach is a system which calculates a rate of payment in accordance with a set of pre-determined rules, based on a formula set out in legislation”. ^[18]

The use of ADM to make decisions is generally limited to situations where the power or authority to take that action is contained in legislation. One of the earliest examples of an ADM provision is section 6A of the Social Security (Administration) Act 1999 (Social Security Act), introduced in 2001. This provision permits a broad use of ADM where the “Secretary may arrange for use of computer programs to make decisions…for any purposes for which the Secretary or any other officer may make decisions under the social security law”. Since then, similar provisions that permit the use of ADM usually via an authorised computer program, have been added to various statutes in force across the Commonwealth Government. This report acknowledges the work currently underway within the AGD in respect of ADM and compliments that work by highlighting the extant requirements under the FOI Act.

A desktop review has identified 64 statutes that contain ADM provisions. These statutes cover a wide range of functions and services performed by a range of agencies.

The importance of government transparency and the IPS

The intention of the FOI Act is to increase the understanding that the information held by the government is to be managed for public purposes as it is a national resource. Furthermore, as far as possible, government entities are to facilitate and promote public access to information. The FOI Act outlines that this can be achieved through either requiring agencies to publish the information (the IPS) or through providing an avenue for the documents to be accessed.

Section 7A of the FOI Act sets out that each agency must publish a plan showing how it proposes to implement the IPS as well as how each agency must publish a range of information. This includes information about what the agency does and the way it does it, as well as information dealt with or used in the course of its operations, some of which is called ‘operational information’.

This requirement for transparency around how agencies come to decisions and recommendations that affect the public is critical to facilitate public understanding and trust in the government. Without the background knowledge of how decisions are being made, the results can only be taken at face value and cannot be fully interrogated for fairness and accuracy, ultimately the results are not contestable.

The Robodebt scheme relied heavily on ADM around ‘income averaging’ to recover overpayments from welfare recipients. The subsequent Royal Commission into the scheme found it did not comply with the income calculation provisions of the Social Security Act. The findings underscored the need for clear oversight and transparency when agencies use ADM.

The Australian Public Service Commission (APSC) recently released their Trust in Public Services 2025 Annual Report, in which a common theme of those reporting increased trust, was greater transparency and communication.

Proactive disclosure informs the community, increases participation and enhances decision-making. It builds trust and confidence, improves services delivery and promotes efficiency by reducing the administrative burden on departments and agencies and the need for individuals to make formal information access requests.^[19]

The importance of information to civic participation is recognised in the Open Government Partnership (OGP), of which Australia is a member. The OGP calls for openness in government and greater civic participation in public affairs, reinforcing a right to information, as per Article 19 of the International Covenant on Civil and Political Rights.

In 1982 when the FOI laws were first introduced in Australia, the conversation was about the need for people to have access to government information, to enable informed democracy and to reverse the presumption that information in the hands of government was not available to the general public.

The FOI Act is to be interpreted through its objects. In a digital government environment the objects of the FOI Act remain relevant irrespective of the technology in use. This requires the regulator to provide regulatory guidance and advice reflective of that contemporary environment to acquit our significant statutory and independent responsibility. Our approach also supports Outcomes 3 and 4 of the recently released Commonwealth Integrity Strategy^[20] which contains indicators of public trust in availability of information and transparency.

How did the OAIC undertake the review?

Objective

This report seeks to highlight the requirements of the IPS in a contemporary digital government context and foster better practice through awareness raising and guidance regarding agencies’ IPS obligations.

The objective of this report is to identify whether agencies were being open and transparent about their use of ADM and help them improve their transparency by making recommendations. Our test for transparency is whether an individual would be able to determine if an agency is using ADM by looking at IPS information.

Ensuring timely access to government information, strengthening the information governance of the APS, as well as rebalancing power and information asymmetries and rights preservation in new and emerging technologies are priorities for the OAIC. Transparency about the use of ADM supports all of these priority issues.

Methodology

We identified 12 portfolios that administer 64 statutes that contain provisions authorising delegates to use ADM, in 23 government agencies. Our report deidentifies agencies reviewed in recognition of the need for clarity in regulatory guidance. Further it does not contain adverse regulatory comment specific to any agency. However, we have highlighted positive practices and practices which provide context as examples to inform the practices of other agencies.

Authority to use ADM does not mean that ADM is used by the agency. Accordingly, this report does not assume a lack of transparency about the use of ADM in circumstances where there is no evidence of its use (notwithstanding authority to use it).

To provide a broad review of agency transparency about the use of ADM we looked at the agencies’:

• websites for an indication of whether they proactively disclosed that they were using ADM;
• AI transparency statements; and
• IPS agency plans.

We also performed keyword searches.

Our threshold was whether a member of the public, who wanted to know if an agency was using ADM, could reasonably do so by performing relatively simple searches on the agency’s website.

We did not seek information from any of the reviewed agencies to confirm if they, or agencies that they administer, were using ADM to make decisions. However, if agencies were authorised to use ADM but did not disclose its use on their website, we looked for external evidence that it was in use (e.g. media articles or independent reviews, submissions or reports).

Appendix A sets out our methodology in more detail, including the detailed criteria we used to rate agency performance against our criteria.

Agency ratings

We assessed the agency websites, linked articles, submissions and media articles to assign each reviewed agency a rating:

1. ‘Better practice’ (agency discloses its use of ADM and outlines what decisions it makes or how it uses ADM to make decisions, in a way that is easy for the public to understand and that would align with the requirement under the FOI Act to publish ‘operational information’);
2. Positive practice’ (agency discloses its use of ADM but does not outline what decisions it makes or how it uses ADM to make decisions);
3. ‘Partial reference’ (agency refers to ADM but does not disclose information about its use);
4. ‘No evidence of use’ (agency did not disclose use of ADM and no external evidence of use); and
5. ‘No reference’ (agency did not disclose use of ADM but external evidence of use).

To see the detailed results for each agency against the criteria see Appendix B

Legislative requirement:

The FOI Act stipulates under s 8(1) that an agency must prepare an IPS plan which outlines what information the agency proposes to publish as well as how and for whom. It should also include information on how else the agency will comply with Part II of the FOI Act.

Section 8(2) sets out the types of information agencies mush publish as part of their IPS, which includes decision-making powers and other powers affecting members of the public (s 8(2)(c)) and operational information (s 8(2)(j)).

Operational information is further defined under section 8A of the FOI Act; it includes information held by the agency to assist it to perform or exercise its functions or powers in making decisions or recommendations affecting members of the public — or any particular person or entity, or class of persons or entities.^[21] This ensures that members of the public are adequately informed about the rules, policies, principles and procedures that agencies apply in making decisions or recommendations that affect them.

ADM has been recognised as operational information in legal publications (referred to above) and in the practices of some agencies we reviewed. We consider that the use of ADM is operational information.

Furthermore, under section 9A of the FOI Act, agencies must have regard to section 3(1) which states that Commonwealth agencies “are to give the Australian community access to information held by the Government of the Commonwealth” by publishing this information and by providing for a right of access to documents.

Section 10 of the FOI Act reinforces that objective by providing that a person must not be subjected to any prejudice that could have been avoided by the person had they been aware of operational information that should have been but was not published in the IPS.

We note the OAIC guidelines on the IPS^[22] do not currently state that agencies are required to disclose their use of ADM as part of their ‘operational information’ and they do not reference ADM in relation to decision making powers.

Why is this important?

Publishing information about the use of ADM is an important part of upholding the right of access to government information, which should, under the FOI Act be publicly available, accurate, up to date and complete, available free of charge where possible. The findings in this report highlight that these legislative requirements warrant further thought from agencies to encompass all operational information, including about use of ADM. However, the findings also demonstrate the regulatory clarity, including an update to the Guidelines issued by the Information Commissioner would assist agencies in meeting these requirements in the context of new and emerging technology.

Only 4 agencies stated that they used ADM sufficient to meet the base line requirements of their obligation to publish operational information. Therefore 17 agencies authorised to use ADM do not disclose that they use ADM in their IPS. From information available beyond the agency IPS publications, and public facing information more broadly it is likely that ADM is in use but not disclosed for the purposes of the IPS, by a further 2 agencies.

Based on these findings none of the agencies demonstrated practices to fully enliven the legislative intention to:

“…publish a range of information including information about what the agency does and the way it does it, as well as information dealt with or used in the course of its operations, some of which is called operational information.”^[32]

If an agency uses ADM, in the context of agency FOI obligations better practice is to have:

• a specific reference to the use of ADM by the agency; and
• published guidelines, policies and/or rules that provide an accessible resource detailing when, where and how ADM is being used.

What we recommend

For agencies with the authority to use ADM

This report provides guidance to help agencies develop policies and procedures around ADM and IPS compliance. This will ensure they meet their IPS obligations under section 8(2) of the FOI Act and promote transparency about how decisions that affect the public are made and thereby increasing trust in the government.

For the OAIC

We will review and update Part 13 – Information Publication Scheme of the FOI guidelines so that ADM is expressly included as an example of ‘operational information’. This will involve further detail about information regarding ADM that an agency would be required to include to better assist the public to understand how ADM is being used and how it may impact them. This will assist agencies to understand their obligations under section 8(2) of the FOI Act.

Informed by this review we consider the inclusion of further information, consistent with our recommendations would support agencies in meeting the objects and specific requirements of the FOI Act.

Who is the report directed to?

This report is provided to promote awareness within the Australian community of the use of ADM by government agencies and to assist agencies in identifying and preparing information which is required to be published under the FOI Act. The report also serves the commitments contained in the recently released Commonwealth Integrity Strategy and in particular Outcome 3: Transparency and accountability of actions and decisions are improved; and Outcome 4: Public trust and confidence in the Commonwealth public sector are enhanced.

We intend to provide this report to agencies and update Part 13 – Information Publication Scheme of the FOI guidelines so that ADM is expressly included as an example of ‘operational information’.

This report contains the regulator’s advice to agencies to be refined through consultation and the augmentation of our FOI Guidelines as they relate to the IPS and our independent statutory functions in relation to the IPS. The report does not traverse the policy domains of agencies.

We note that AGD is leading the development of a whole of government framework to provide additional transparency obligation on agencies regarding their use of ADM, including clear safeguards for its use. This is in response to the Robodebt Royal Commission’s recommendation 17.1:

“The Commonwealth should consider legislative reform to introduce a consistent legal framework in which automation in government services can operate.

Where automated decision-making is implemented:

• there should be a clear path for those affected by decisions to seek review
• departmental websites should contain information advising that automated decision-making is used and explaining in plain language how the process works
• business rules and algorithms should be made available, to enable independent expert scrutiny”

In addition, the Privacy and Other Legislation Amendments Act (POLA Act) has added a requirement for an entity to include in its privacy policy, information about whether ADM has been used to substantially and directly make a decision that significantly affects the rights or interests of an individual, and whether the ADM uses the individual’s personal information.^[33]

However, IPS obligations for agencies to provide transparency about operational information, decision making and other powers affecting members of the public are extant. As the ADM framework and Privacy Act obligations commence, agencies should ensure they meet the obligations of these regimes as well as the IPS.

Appendix A: Detailed Methodology

For each agency we reviewed its website to determine if they published IPS information by searching for “IPS” and “information publication scheme” using the agency website search function.

To determine if the agency IPS information referred to the use of ADM or ADM rules and guidelines we:

• used the agency website search function to look for “ai transparency statement”, “ai”, “artificial intelligence”, “transparency statement”, and search engine results for “[agency name] ai transparency statement”. We reviewed any AI transparency statement found for references to automated decision making;
• conducted a Google Advanced Search to look for the exact word or phrase “automated decision” and narrowed the results by the agency website; and
• conducted a Google Advanced Search for the exact word or phrase “decision” and any of these words “automate, automation, automated, adm” and narrowed the results by the agency website.

When determining if this information was accessible to the public, we recorded the website pathway and looked at the number of search results and the result rank when searching for “automated decision”.

To search for external evidence of the use of ADM we conducted a Google Advanced Search for the exact word or phrase “automated decision”, “agency name” and did not narrow the results.

Criteria

To give each of the 23 reviewed agencies a rating, we applied the following criteria under the groupings to ascertain and evidence of:

• the adoption of the IPS by the agency in compliance with the FOI Act (criteria 1);
• references to the use of ADM as ‘operational information’ to be published under the IPS (criteria 2 and 3);
• references to the use of ADM in the IPS by the agency (criteria 4); and
• references to the use of ADM in publications external to the agency (criteria 5)

Criteria 1: Does the agency publish information on their website as part of their IPS requirements?

Criteria 2: Does the IPS information refer to the agency’s use of ADM and provide information in an appropriate format to make it accessible to the public?

Criteria 3: Does the IPS information include rules, guidelines or practices for how decisions are made using ADM?

Criteria 4: Does the IPS information refer to ADM in any context? This may include reference to ADM only in relation to AI. It may also include references to ‘decision making processes’ that may contextually infer ADM.

Criteria 5: Is there evidence that the agency uses ADM from external (non-agency) sources?

Appendix B: Results for the 23 reviewed agencies against the criteria