AI governance in Australian healthcare.

Software with a diagnostic, screening or treatment-suggesting purpose can meet the medical device definition in section 41BD of the Therapeutic Goods Act 1989. Such a kind of device must be included in the Australian Register of Therapeutic Goods before supply in Australia unless an exemption applies, and the manufacturer must apply the conformity assessment procedures matching the device classification.

Clinical decision support software that meets the medical device definition must be in the ARTG unless it falls within the specific CDSS exemption introduced in the software reforms. Exempt CDSS is still a medical device: it stays under TGA oversight for advertising, adverse-event reporting and notification. Deployers must confirm which category a decision-support tool sits in before clinical use.

Health information is sensitive information under section 6(1) of the Privacy Act 1988, so stricter handling rules apply. Under APP 6, sensitive information used or disclosed for a secondary purpose must be directly related to the primary purpose within the individual reasonable expectation. Training or running AI on patient records is a use that must satisfy these limits and the consent rules for collection.

From 10 December 2026 an APP entity that uses personal information in a computer program to make, or substantially help make, a decision that could reasonably be expected to significantly affect an individual must describe this in its privacy policy, including the kinds of information used and the kinds of decisions made. Health triage, eligibility and risk-scoring tools are squarely in scope.

The My Health Records Act 2012 controls collection, use and disclosure of information held in the My Health Record system and sets prohibited purposes. Part 4 restricts unauthorised collection, use and disclosure and Part 5 creates offences and civil penalty provisions for unauthorised access. AI features that read from or write to My Health Record must respect these access controls and the prohibition on non-permitted purposes.

Whatever technology assists care, the registered practitioner remains responsible for safe, quality care under the applicable Code of conduct. AHPRA guidance requires practitioners to understand an AI tool well enough to use it safely and to address accountability, transparency of use and informed consent, including telling patients when an AI scribe or tool is used. Blind reliance on model output does not discharge the duty.

The Clinical Governance Standard requires accredited health service organisations to run a clinical governance framework so patients receive safe and high-quality care. The governing body is accountable for the systems that deliver, monitor and account for safety and quality. Introducing an AI tool into care is a change these systems must risk-assess, monitor for performance drift and govern like any other clinical intervention.

In New South Wales the Health Records and Information Privacy Act 2002 binds every organisation that collects, holds or uses health information, in both public and private sectors. Organisations must comply with the Health Privacy Principles in Schedule 1 covering collection, use, disclosure, security, access and correction. AI processing of NSW health records must meet these principles on top of the Commonwealth Privacy Act.

The Guidance for AI Adoption, published 21 October 2025, evolves the Voluntary AI Safety Standard into 6 essential practices for safe and responsible AI governance across deployers and developers. Although voluntary, it is the benchmark Australian regulators point to for accountability, risk management, data governance, testing, transparency and human oversight, and it prepares health organisations for likely future mandatory rules.

Inventory every clinical and administrative AI tool and classify each against the TGA medical device definition in section 41BD, recording ARTG number, exemption basis or non-device status.

For any decision-support tool, confirm whether it is regulated, exempt CDSS or excluded, and keep evidence of the reasoning and the supplier ARTG entry.

Update the privacy policy before 10 December 2026 to describe automated decisions affecting patients, the information used and the kinds of decisions made.

Map all AI processing of patient data against the Privacy Act APPs and any applicable state health records law such as the NSW HRIP Act or the Victorian Health Records Act.

Embed each AI tool in the clinical governance framework with named accountability, pre-deployment risk assessment and ongoing monitoring for accuracy drift and automation bias.

Set informed-consent and disclosure practice so patients are told when an AI scribe or decision tool is used, in line with AHPRA guidance.

Adopt the 6 essential practices from the October 2025 Guidance for AI Adoption and record testing, human oversight and incident escalation for each deployed system.