December 2026: What Every School Leader Needs to Know

By December 2026, Australian schools will face two major privacy-related changes that will affect how they use AI and other digital tools. These are not just compliance updates. They are leadership issues, governance issues, and risk management issues.

For schools already using AI-enabled platforms, the message is simple: now is the time to get ahead of the change, not wait for it.

Two changes, one critical deadline

Two significant reforms are due to take effect in December 2026:

• The Children's Online Privacy Code, being developed by the Office of the Australian Information Commissioner.
• New Privacy Act transparency requirements for automated decision-making.

Together, these reforms will increase expectations on schools to understand what tools they are using, what student data those tools access, and how decisions affecting students are being made.

Schools will need more than good intentions. They will need visibility, documentation, and governance.

1. The Children's Online Privacy Code

The Children's Online Privacy Code is being developed under the amended Privacy Act and is due to come into effect on 10 December 2026.

Its purpose is to strengthen privacy protections for children in digital environments, including online services and AI-powered education tools likely to be accessed by children.

For school leaders, the key issue is not whether a tool is marketed as "educational." The question is what student data it collects, how that data is used, who it is shared with, and whether the school can confidently explain those data flows.

If students are using platforms without proper oversight, schools may be exposed to unnecessary privacy and governance risk.

2. Automated decision-making disclosure

The second change concerns automated decision-making.

From December 2026, organisations will need to disclose certain uses of automated decision-making in their privacy policies. This does not apply to every AI tool. It applies where a computer program, using personal information, makes or directly supports a decision that could reasonably be expected to significantly affect an individual's rights or interests.

In a school setting, this may include:

• Assessment or grading support
• Behaviour monitoring
• Student wellbeing triage
• Timetabling or placement decisions
• Administrative systems that influence student outcomes

The important point is that AI-assisted does not mean low-risk. If a system materially shapes decisions about students, the school should be able to explain that clearly and confidently.

What schools should be doing now

The biggest mistake schools can make is assuming there is still plenty of time.

There isn't.

The months between now and December 2026 will pass quickly, and schools that leave preparation too late may find themselves scrambling to identify risks, update policies, review vendors, and brief their boards.

A practical readiness plan should include:

• An inventory of all AI and digital tools in use
• A clear map of what student data each tool collects, stores, or shares
• Privacy impact assessments for higher-risk tools
• Contract reviews for vendors handling student data
• Updated privacy notices for parents and students
• A governance process for approving new tools and reviewing existing ones
• Board-level oversight of AI and privacy risk

The Australian Framework for Generative AI in Schools

Schools are not starting from zero.

The Australian Framework for Generative AI in Schools already provides an important set of principles, including transparency, accountability, fairness, privacy, security, safety, and human and social wellbeing.

But principles are not implementation — this is the framework gap schools have to close themselves. For a picture of what closing it looks like, see what mature AI governance actually looks like.

That means school leaders should use the Framework to guide values and decision-making, while also putting in place the practical systems needed for compliance, vendor management, and ongoing oversight.

Why this is an opportunity

There is a real upside to doing this well.

Schools that build strong AI and privacy governance now will not only reduce risk. They will also be better positioned to use AI confidently and responsibly. Good governance makes innovation easier, not harder, because it gives leaders clarity about what is safe, what is approved, and where the boundaries are.

That creates faster decision-making, better accountability, and greater trust with parents, staff, and students.

What Arvoe can help with

This is exactly where Arvoe can support school leaders.

Arvoe helps schools build the structure, visibility, and governance needed to adopt AI responsibly. That can include:

• AI and digital tool audits
• Privacy and risk assessments
• Governance frameworks for school leadership teams
• Vendor and contract review support
• Board briefing materials and executive reporting
• Practical guidance for policy, process, and implementation

If your school is using AI tools and you are not yet confident about what data they touch, how they are being governed, or whether you are ready for December 2026, now is the time to act.

The next step

December 2026 will reward schools that prepare early.

The schools that move now will be the ones best placed to protect student privacy, respond confidently to compliance obligations, and adopt AI with clarity and control.

If your school needs help assessing where you stand — or building the governance required to get ready — Arvoe can help you move from uncertainty to confidence.

Not sure where your school stands? Take our [free AI governance self-assessment](/#assessment) — it takes 5 minutes and gives you an instant maturity score across 8 dimensions.