An automated message can persuade a customer to abandon a claim. Discover why new privacy rules require insurers and brokers to examine how technology shapes decisions long before final approval.

By Anna Lopata – ANZIIF Senior Writer

A homeowner lodges a storm damage claim and uploads photographs. A computer estimates the repair cost, calculates that it falls below the policy excess and sends a message explaining this. The customer withdraws.

Nobody has declined the claim. Yet if the estimate was wrong, the customer may have abandoned a claim that would have paid out.

Fiona Morgan, founder of AI Fully Informed, an independent AI advisory practice for Australian firms, says this fictional scenario illustrates why understanding automated decision-making means looking beyond the final approval or rejection.

“If the estimate is too low, the customer could withdraw from a claim that would have been paid,” she confirms.

Speaking at a recent ANZIIF webinar, Morgan explained how privacy changes are prompting insurers and brokers to examine the less visible ways technology influences customer outcomes.

A privacy policy starts behind the scenes

From 10 December 2026, entities covered by the Australian Privacy Principles must include additional information in their privacy policies where computer programs use personal information to make, or do something substantially and directly related to making, decisions reasonably expected to significantly affect an individual’s rights or interests.

The disclosure must describe the kinds of personal information involved, the kinds of decisions made solely by computer programs and those where a computer program does something substantially and directly related to making them.

For insurance businesses, identifying those activities requires more than an inventory of AI products. Morgan points out that the technology could be a rules engine or even a spreadsheet that ranks people.

Her approach starts with the business process: what can happen to a person, where decisions occur and what contributes to them.

“It’s much more about the workflow than the specific software,” she says. “It’s how [the software] fits into what it is that you specifically do at your firm.”

The customer chose, but what shaped the choice?

Morgan’s fictional storm claim demonstrates the difficulty of separating customer choice from automated influence.

The photo estimating tool produces a figure. An automated message communicates that the repair cost is below the excess. The customer may reasonably conclude that continuing is pointless.

Whether that withdrawal falls within the disclosure requirements needs legal consideration, Morgan explains. Her recommendation is to document the steps and their contribution, rather than assume that a customer’s choice settles the question.

Another example involves a system requesting information, sending reminders and closing the claim when the customer fails to respond. An apparently administrative process has produced a consequential outcome.

“Not doing something like letting a claim close can count as well,” Morgan says.

The legislation expressly includes refusing or failing to make a decision, and covers beneficial as well as adverse effects. Automatic acceptance therefore deserves attention alongside rejection.

A human signature does not tell the whole story

A claims officer’s involvement can create an impression that the decision is entirely human.

But consider what sits in front of that officer: a computer-generated repair estimate, a classification of the cause of loss or a flag suggesting an exclusion applies.

The officer may have authority to disagree. The question is how much those outputs influence their judgement.

“The fact that a person makes the final call does not, on its own, put the tool’s involvement outside the scope of the disclosure requirements,” Morgan says. “What matters is how important the tool’s output was in that decision.”

OAIC guidance published in September says a decision can be in scope whether the program’s output is advisory or determinative, and even where a person reviews it.

That makes actual working practices important. How much a decision rests on a tool’s output depends on what staff actually do, which may not match the written procedure.

Brokers make decisions before insurers see the risk

The insurer’s responsibility for underwriting does not remove the broker’s need to examine their own processes.

Morgan gives the example of a placement platform that sends a risk only to insurers whose appetite matches the client’s occupation and postcode.

The broker may choose from the resulting options, but the software has already determined which insurers never receive the submission. For an individual client, that filtering could affect the cover or price available.

“If your platform decides which insurers ever see a client’s risk, that’s your decision, not the insurer’s,” Morgan says.

The obligation won’t catch every broker. Where clients are all companies, most of the client-facing side falls away, but sole traders, named directors and group personal accident schemes bring individuals back in, and recruitment applies to everyone.

Her broader point is to examine where the brokerage itself makes decisions, including claims triage, renewals, complaints and recruitment.

Responsibility also cannot simply be handed to the software supplier.

“The obligation sits with the business using the program to make the decisions about people,” Morgan says.

A vendor cannot assess every customer’s workflow or know how heavily each business relies on its outputs.

Ask the people doing the work

Morgan recommends mapping each process from beginning to end, recording possible outcomes and identifying the decisions along the way.

For each decision, businesses should establish who makes it, which tools contribute, what personal information is used and where it comes from.

Staff conversations are essential because formal procedures may omit unofficial tools or workarounds.

“If there is technology being used for decision making, even if it’s not in the official process, it still needs to be recorded, so it can be assessed like everything else.” she says.

Morgan stresses that her expertise is in AI products and technology. The exercise of recording processes equips a privacy lawyer to assess uncertain cases and prepare appropriate disclosures.

“What it does is it gives your privacy lawyer what they need to make the calls.”

Put transparency where customers can see it

Completing the mapping exercise may reveal processes that need updating, staff who need training or assumptions that require checking. Software updates and changes in working practices can also alter the assessment.

But Morgan encourages businesses to consider what customers should understand beyond the required privacy disclosure.

“If transparency and trust matter to you, you may want to include [it] in claims letters or other documents too,” she says.

Disclosure alone does not establish that an estimate is accurate or a process fair. Understanding where automation influences outcomes gives businesses a clearer basis for examining both.

Morgan’s closing challenge is practical: consider whether a privacy policy is enough, and whether the explanation reaches the person whose options have already been shaped.