AI governance in Australian retail and consumer businesses.

Personalisation engines, loyalty analytics and customer profiling all handle personal information, so the 13 Australian Privacy Principles apply. Retailers must collect only what is reasonably necessary, be transparent about handling, secure the data and give access and correction rights. AI that enriches or combines customer records raises collection, use and disclosure risk and must map to a lawful basis under the Act.

The Privacy and Other Legislation Amendment Act 2024 adds an automated decision making duty. From 10 December 2026 a retailer whose computer program uses personal information to make or substantially help make a decision that could significantly affect a customer must describe the kinds of information and decisions in its privacy policy. Algorithmic pricing, credit or account decisions and fraud blocking are in scope.

The Voluntary AI Safety Standard sets 10 guardrails, and the Guidance for AI Adoption published 21 October 2025 distils 6 essential practices covering accountability, risk management, data governance, testing, transparency and human oversight. Voluntary today, it is the benchmark regulators and courts point to for reasonable AI governance and a practical way to show retail AI is deployed within existing law.

Section 18 of the Australian Consumer Law bans conduct in trade or commerce that is misleading or deceptive or likely to mislead. AI generated product copy, review summaries, chatbot answers, drip pricing and strike through discounts can all mislead, whether or not intended. Retailers are liable for what their models tell customers, so outputs that touch price, availability or product claims need review before they reach shoppers.

Section 21 prohibits unconscionable conduct in supplying goods or services to consumers. Manipulative interface design, dark patterns, pressure countdowns and AI that exploits known vulnerabilities or steers customers against their interests can cross this line. The prohibition looks at the whole circumstances, so personalisation that targets weaker bargaining positions carries real exposure alongside the general misleading conduct duty.

Since 9 November 2023 proposing, using or relying on an unfair term in a standard form consumer or small business contract is prohibited and carries penalties. Loyalty terms, subscription conditions and app clauses generated or auto updated by AI must be fair and balanced. Automatically renewing or hard to exit arrangements, a stated ACCC concern as subscription traps, are a prime target for challenge.

The ACCC 2025 to 2026 priorities announced 20 February 2025 target misleading pricing and surcharging in retail and supermarkets, deceptive online reviews and influencer claims, and subscription traps in online sales. AI systems that set dynamic prices, add surcharges, summarise reviews or drive in app purchases sit squarely in these enforcement zones and should be governed with that scrutiny in mind.

The OAIC has found that AI-driven facial recognition deployed in retail stores without notice or valid consent breaches the Privacy Act. In a determination published 18 September 2025, the Commissioner found Kmart contravened the Act by using the technology to tackle refund fraud, following an earlier finding against Bunnings use of the technology in its stores. Retailers must not rely on the unlawful-activity exemption without a genuine, proportionate assessment.

AI driven marketing that sends commercial email or SMS must comply with the Spam Act. Every message needs consent, must identify the sender with correct business details, and must carry a functional unsubscribe that does not force a login or extra data. Personalisation and send time optimisation do not remove these duties, and ACMA has imposed multi million dollar penalties for unsubscribe failures.

Inventory every retail AI use, from dynamic pricing and personalisation to chatbots and in store cameras, and rank each by consumer and privacy risk.

Review AI generated pricing, discounts, surcharges and product claims against ACL section 18 before they reach customers, and log the human sign off.

Halt or fully re paper any in store facial recognition or biometric tool without a lawful basis, consent and notice, following the Bunnings and Kmart findings.

Update the privacy policy now to describe automated decisions that significantly affect customers, ready for the 10 December 2026 transparency duty.

Audit loyalty terms, subscription flows and app clauses for unfair terms and subscription traps, and remove one click in but hard to exit designs.

Confirm every marketing send has provable consent, correct sender identity and a working no login unsubscribe to meet Spam Act duties.

Adopt the 6 essential practices from the Guidance for AI Adoption, assigning owners for accountability, testing, data governance and human oversight.