AI governance in Australian aged care.

Section 179 imposes a CIVIL PENALTY duty (not a strict-liability offence): a registered provider must ensure, so far as reasonably practicable, that its conduct does not cause adverse health or safety effects for people receiving its funded aged care services. Breaching the duty without reasonable excuse in a way that amounts to a serious failure, resulting in death or serious injury or illness, carries a civil penalty of up to 4,800 penalty units for a body corporate under section 179(5), on top of the compensation pathway in section 186.

The strengthened Aged Care Quality Standards commenced 1 November 2025, moving from eight standards to seven. Standard 2 makes the governing body accountable for quality systems, risk and oversight; Standard 5 sets requirements for safe and quality clinical care. Any AI supporting clinical decisions, medication or care planning must fit governed clinical oversight, with the board answerable for how automated tools affect care and safety outcomes.

The Commission registers providers and can impose conditions tied to registration categories, backed by risk-based monitoring, serious-incident oversight and enforcement action. Providers must keep meeting obligations and conditions to stay registered. Introducing AI into a funded service can engage governance, notification and continuity-of-care conditions, so map each AI tool against your registration category before deployment and keep evidence for Commission supervision.

Restrictive practices must be a last resort, and providers must obtain informed consent from the older person or a restrictive practices substitute decision-maker before use, following the consent hierarchy in the Aged Care Rules 2025. Consent must be informed, voluntary and current. AI-driven monitoring, sensors, alarms or software that restricts or tracks a resident can amount to a restrictive practice and trigger these consent and behaviour-support duties.

Registered providers must identify, manage and report reportable incidents to the Commission under the Serious Incident Response Scheme, with Priority 1 incidents reported within 24 hours and Priority 2 within 30 days. The Act and Aged Care Rules 2025 updated SIRS from 1 November 2025. Where AI monitoring or clinical tools contribute to harm, medication error or neglect, that incident still falls inside the scheme and must be captured and notified.

The Australian Privacy Principles govern how providers collect, use, disclose and secure personal information. Health information is sensitive information, so collection generally needs consent and heightened protection. AI systems that ingest resident records, care notes or biometric data must have a lawful basis, data-minimisation, security controls and clear handling limits, and providers stay accountable for personal information passed to AI vendors and models.

From 10 December 2026 the Privacy and Other Legislation Amendment Act 2024 requires APP entities to disclose in their privacy policy where personal information is used in automated decisions that could reasonably be expected to significantly affect an individual. Aged care providers using AI to make or substantially help decisions on eligibility, funding, care allocation or risk scoring must document the kinds of information and decisions involved before that date.

Access to and handling of information in a My Health Record is tightly limited by the My Health Records Act 2012, administered by the Australian Digital Health Agency. Unauthorised collection, use or disclosure, where a person knows or is reckless, attracts civil penalties and possible criminal liability. AI tools that read from or write to My Health Record, or repurpose that data for analytics or training, must stay strictly within authorised participation and access rules.

The Voluntary AI Safety Standard, updated by the October 2025 Guidance for AI Adoption, sets six practices for safe and responsible AI, covering accountability, risk management, data governance, testing, transparency and human oversight. It is voluntary but the government-endorsed baseline regulators expect. For aged care, adopting these practices helps evidence the due diligence and governed oversight the Act, Standards and Privacy Act already demand.

Build an inventory of every AI and automated tool touching residents, care decisions or health data, and map each to its registration category, the strengthened Quality Standards and the statutory duty.

Assign board-level and clinical-governance ownership for AI oversight under Standard 2, with documented human review of any AI output that affects clinical care.

Update privacy policies before 10 December 2026 to disclose automated decisions that significantly affect individuals, listing the kinds of personal information and decisions involved.

Screen AI monitoring, sensors and software for restrictive-practice triggers and confirm informed consent from the person or substitute decision-maker before use.

Lock down My Health Record and sensitive health data flows so no AI system collects, uses, discloses or trains on that information beyond authorised access.

Wire AI-related harm, medication errors and near misses into SIRS reporting so Priority 1 incidents reach the Commission within 24 hours.

Adopt the six practices in the October 2025 Guidance for AI Adoption and keep an audit trail of testing, data governance and vendor due diligence for Commission supervision.