AI resume screening in Australia comes with two sets of rules. From 10 December 2026, organisations covered by the Privacy Act must describe some automated decisions in their privacy policy. Separately, the Fair Work Ombudsman says an employer can't take adverse action against a prospective employee for discriminatory reasons, and that includes not hiring them.
Neither rule bans screening software. The OAIC expects the privacy-policy duty to typically stay with the employer who uses the tool, and the Fair Work rule is about the employer's own decision not to hire. The benefits case is in the post on AI candidate matching in logistics, so this article sticks to the rules. It is general information, not legal advice. Check the linked government pages or get advice for your own situation.
Does the Privacy Act apply to your business?
Most small businesses are not covered by the Privacy Act, but some are. The OAIC's small business page defines a small business as one with annual turnover of $3 million or less, counting all income from all sources.
Regardless of turnover, the same page lists health service providers, businesses that trade in personal information, Commonwealth contractors and businesses related to one the Act covers. A small Melbourne maintenance contractor that belongs to a larger group could be caught through that connection, so check the OAIC's checklist before assuming. Being outside the Privacy Act does not change the discrimination rules below.
What does the Privacy Act automated decisions rule require from 10 December 2026?
A covered employer must add specific information to its privacy policy when three conditions are met, according to the OAIC's announcement:
- The employer has arranged for a computer program to make a decision, or do something substantially and directly related to making one.
- The decision could reasonably be expected to significantly affect the rights or interests of an individual.
- Personal information about that person is used in the program's operation.
The policy must then state the kinds of personal information used, the kinds of decisions made solely by programs, and the kinds where a program does something substantially and directly related to the decision.
The OAIC fact sheet counts rule-based processes, machine learning, ordinary software and generative AI chatbots as computer programs. It lists recruitment software used to sort candidate profiles and make hiring decisions among decisions generally in scope. An automatic CV filter, a ranking score or a pre-screening chatbot could therefore be caught.
Does a human check on the shortlist take you out of scope?
Not automatically. The OAIC fact sheet says a decision may be in scope even where the program's output is subject to human review. It adds that machine learning or generative AI outputs used for significant decisions are generally in scope unless subject to extensive human oversight and control.
Its example turns on what reviewers do: managers who rely on a generated recommendation as a key factor are in scope, while staff who interrogate the output, review the underlying data, use additional evidence and document why they diverged could show the output was not substantially related to the decision.
For example, a Melbourne warehouse gets 300 applications for 10 packing roles, and the manager reads only the 30 highest-scored. In effect the software has screened out the other 270, and an OAIC example treats a ranking used to decide who not to contact as in scope.
How can bias in resume screening software arise without asking about age or sex?
A tool can score details that stand in for a protected attribute, or learn from past hiring that was already uneven. The Australian Human Rights Commission's Human Rights and Technology summary says algorithmic bias arises where an AI-informed tool produces outputs that result in unfairness or discrimination, often through statistical bias, and that it has arisen in recruitment.
Protected attributes under the Fair Work Act, as the Fair Work Ombudsman lists them, include age, sex, race, physical or mental disability, pregnancy, and family or carer's responsibilities, and not hiring someone counts as adverse action. These examples are illustrative only:
- Work-history gaps. Marking down a gap can disadvantage people who took time out for caring responsibilities or pregnancy.
- Graduation year. A preference for recent dates can signal age.
- Past-hire patterns. A tool trained on past hires can repeat that pattern.
Screening on genuine requirements is different. Employers are told to focus on the essential requirements of the job, as the Commission's recruitment guide sets out, such as a current forklift licence or night-shift availability when the ad says so. The Fair Work Act protection is framed around an employer's reasons for acting, and federal and state discrimination laws apply as well, as the Commission's quick guide to discrimination laws explains, so whether a given scoring rule is discriminatory is a legal question for advice.
What should you ask a software vendor?
Ask any vendor these questions in writing. The OAIC expects the transparency duty to typically stay with the employer using the tool, and says providers should give clear high-level information to help.
- Inputs. What does the tool read and score, and does it infer anything that is not on the CV?
- Sensitive data. Does it use voice, face or health information? The OAIC says this should be clear in the policy where it is used.
- Reasons. Can it show, for each rejected applicant, which requirement was not met?
- Testing. Has it been tested for different results by age, sex and other groups, and can you see the evidence?
- Control. Can you switch off automatic rejection and keep a log of overrides?
- Disclosure. Will the vendor describe what it does with personal information, and can an applicant ask for another way to apply?
Using an agency to short-list is another route, and the guide to in-house recruitment versus using an agency weighs the trade-offs. The Commission's guide adds that an employer who hires an agent to short-list must make sure the agent knows its discrimination obligations. For wider hiring law, see the post on legal considerations when hiring blue collar workers.
How do you audit 20 past rejections?
Check 20 recent rejections, some made by the software alone, against the requirements in the job ad.
- Pick the sample. Take 20 rejections from one or two recent roles, for example 10 automatic and 10 by a person.
- Write the reason. Give each one sentence tied to a stated requirement, such as "no current forklift licence". If the only reason is a low score, mark it unexplained.
- Get a second read. Someone who did not make the original call reads each CV and says whether they would have shortlisted. Count the disagreements.
- Look for patterns. Check work-history gaps, names, suburbs and dates. Do not ask applicants for age or sex to run the audit; the Commission's guide says not to seek irrelevant personal information.
- Record and act. Write down what you found and changed, since the guide says to keep records of your decisions. Repeat after any settings change.
Twenty cases cannot prove a tool is fair. Several unexplained rejections or disagreements are a reason to pause automatic rejection and question the vendor, though that is a judgement call, not a legal test.
Related Resources
- OAIC guidelines on privacy policies (APP 1)
- OAIC on what counts as personal information
- Human Rights and Technology final report
- Australian Government guidance for AI adoption
- Permanent recruitment from Chandler Personnel
- Trades and services recruitment
Frequently Asked Questions
Is it legal to use AI to screen resumes in Australia?
Using it is not banned by any of the government pages cited here, but rules still apply. Covered employers whose tools meet the OAIC's three conditions must describe them in their privacy policy from 10 December 2026, and the Fair Work Ombudsman's discrimination rules apply to hiring. Get advice for your own setup.
Do small businesses have to follow the automated decision rule?
Only if the Privacy Act covers them. Most businesses with turnover of $3 million or less are outside it, but exceptions apply, such as health service providers and businesses related to a covered business.
Do I have to tell each applicant that software rejected them?
The OAIC fact sheet describes the new duty as information in the privacy policy and does not mention a notice to each applicant. Other privacy duties may still apply, so check the Act's wording or get advice if you need certainty.
Who is responsible if a vendor's tool is biased?
For the privacy-policy duty, the OAIC says the obligation typically stays with the employer using the tool, and the Fair Work rule concerns the employer's own action. Ask a lawyer how your vendor contract shares risk, and ask for testing evidence before you sign.
Keep People in Charge of AI Resume Screening
Screening software can save time, but the rules above still apply to the employer using it. Before 10 December 2026, work out whether the Privacy Act covers your business and whether any tool you use meets the OAIC's three conditions. A named person should be able to explain every rejection against the job's real requirements. This week, run the 20-rejection audit on your last hiring round.
