Clinical AI governance under TGA, AHPRA, OAIC, and ACSQHC.
AI scribes, diagnostic imaging, clinical decision support, and telehealth AI are reshaping patient care. The TGA's Software as a Medical Device grace period ended November 2024. Four regulators now apply to the same clinical workflow. Generic AI frameworks do not address the risks Australian healthcare organisations actually face.
Built for
What a healthcare engagement delivers.
Full engagement methodologyClinical AI inventory & SaMD classification
A documented map of AI scribes, imaging AI, decision support, and operational AI, each assessed against TGA Software as a Medical Device criteria.
"Before-while-after" governance
ACSQHC-aligned clinical governance covering use-case confirmation, deployment controls, and ongoing monitoring against the NSQHS Standards.
Practitioner-ready policies
AHPRA-aligned protocols for AI scribe consent, verification, bias awareness, and professional indemnity coverage in clinical settings.
Health data evidence pack
Privacy Act, APP 8 cross-border, and My Health Record breach documentation that the OAIC and System Operator can work through end to end.
Four pressures specific to clinical AI.
Patient safety, practitioner liability, health data sovereignty, and multiple overlapping Australian regulators make healthcare AI more complex than any other sector. The TGA SaMD grace period ended in November 2024, and the obligations are now live.
- 01In force
TGA Software as a Medical Device captures clinical AI.
The TGA's Software as a Medical Device (SaMD) grace period ended November 2024. Clinical decision support systems, AI scribes with diagnostic features, and predictive triage algorithms may require ARTG registration. The Therapeutic Goods Administration classifies AI software using IMDRF risk factors. Adaptive AI and LLMs create new classification questions, and post-market surveillance for AI that evolves after deployment is now expected.
Run a TGA SaMD classification - 02Active
AHPRA keeps the practitioner accountable.
AHPRA's August 2024 guidance is clear: practitioners are "ultimately responsible" for AI used in their practice. That covers checking AI scribe accuracy, understanding bias risks for Aboriginal and Torres Strait Islander communities, holding professional indemnity insurance that covers AI use, and verifying AI-generated clinical documentation. Nearly 1 in 4 GPs are already using AI scribes, and many organisations lack policies that consistently translate AHPRA obligations into practice.
Develop practitioner-ready policies - 03Active
Health data carries the strictest privacy load.
Health information is classified as "sensitive information" under the Privacy Act and the Australian Privacy Principles. AI scribes process consultation recordings. Diagnostic imaging AI analyses patient scans. The OAIC has issued dual AI guidance for developing and using AI products. APP 8 governs cross-border data flows to offshore AI providers. The National Health Privacy Rules 2025 add new requirements for claims information, and My Health Record mandatory breach notification applies to the OAIC and System Operator.
Assess privacy compliance - 04ACSQHC
ACSQHC sets the clinical governance pattern.
The Australian Commission on Safety and Quality in Health Care AI guides for clinicians build on the NSQHS Standards and set a "before-while-after" approach: confirm the clinical use case before implementation, build on existing patient safety and digital health governance during deployment, and keep monitoring once the tool is live.
Build ACSQHC-aligned clinical governance
Healthcare AI use cases that need governance.
Each AI application carries a different risk profile, regulatory expectation, and patient safety implication. The governance scope follows the use case.
SaMD, IEC 62304, and digital health standards.
Every Australian health tech business developing AI has to answer four technical questions: whether the tool is clinical decision support or a diagnostic device, how the IEC 62304 lifecycle applies, how it integrates over FHIR and HL7, and what post-market surveillance adaptive AI needs.
- 01
Clinical decision support vs diagnostic AI.
Classification depends on whether the AI provides clinical decision support or functions as a diagnostic tool. Software making suggestions for diagnosis or treatment is regulated by the TGA as SaMD, with pre-market approval and ARTG registration. Software that presents data without clinical interpretation can qualify for exemptions, and the TGA is reviewing those boundaries.
- 02
IEC 62304 medical device software lifecycle.
IEC 62304 defines the software development lifecycle for medical device software, including AI-enabled solutions, and compliance is required for TGA registration. The standard covers planning, requirements, architecture, implementation, verification, and maintenance. Adaptive AI presents a particular challenge because IEC 62304 processes were designed for static software models.
- 03
Digital health interoperability. FHIR and HL7.
AI operating within Australian healthcare infrastructure has to integrate using FHIR (Fast Healthcare Interoperability Resources) and HL7. For AI medical devices and clinical decision support, interoperability compliance is what lets outputs flow safely into electronic health records, clinical workflows, and My Health Record. The National Model Clinical Governance Framework requires digital health solutions to meet interoperability and clinical safety requirements.
- 04
Post-market surveillance and real-world performance.
TGA registration is where the compliance obligation starts. AI medical devices require ongoing surveillance to monitor real-world performance, detect adverse events, and manage updates that affect safety or efficacy. For adaptive AI that keeps learning from new data, real-world performance monitoring is the control that matters most, and it is where health technology businesses most often underinvest.
Bias and health equity
Algorithmic bias is a patient safety issue.
Bias in AI widens healthcare disparities and puts patients at risk. AHPRA guidance requires practitioners to address biases affecting Aboriginal and Torres Strait Islander communities and other diverse populations. We build bias detection and mitigation into every clinical AI governance framework.
Sources of bias
- AI trained on international datasets that do not reflect Australian populations
- Skin lesion classifiers trained mostly on images of white patients
- Proxy variables that systematically disadvantage particular groups
Mitigation strategies
- Training data review against Australian demographics
- Adversarial debiasing during development and validation
- Ongoing real-world monitoring across populations
Healthcare organisations we work with.
Engagements are scoped for the clinical and operational reality of each organisation, from a single-site GP practice to a multi-state hospital group or a health tech business preparing for TGA submission.
01
Hospitals & health districts
Public and private hospitals, local health districts, and state health departments deploying AI across clinical and operational settings. Governance built around NSQHS accreditation, ACSQHC clinical governance, and OAIC privacy obligations.
02
GP practices & specialist clinics
General practices, specialist medical centres, and allied health providers adopting AI scribes and clinical decision support. AHPRA obligations translated into protocols clinicians will actually use.
03
Health tech & digital health
SaMD developers, AI scribe providers, clinical decision support vendors, telehealth platforms, and health data analytics businesses. Includes TGA classification, investment-ready governance, and cross-jurisdictional EU + AU compliance.
04
Pathology, radiology & allied health
Pathology providers, radiology groups, and allied health organisations using diagnostic imaging AI and machine learning analytics. Risk management designed for the high-volume, high-stakes nature of imaging-driven decisions.
Tracks built for clinical and digital health.
Three tracks sized for healthcare regulation, scoped against the four-regulator environment. Engagements typically run six to twelve weeks with phased milestones.
Track A
Clinical governance
ACSQHC-aligned clinical governance, NSQHS Standards integration, human oversight protocols, and "before-while-after" implementation guides for clinical AI.
Track B
TGA & assurance
SaMD classification, ARTG registration strategy, post-market surveillance for adaptive AI, clinical evidence planning, and independent audit of clinical AI.
Track C
Privacy & EU readiness
OAIC health data alignment, APP 8 cross-border controls, My Health Record breach preparedness, and EU AI Act readiness for health tech entering European markets.
Healthcare AI is moving faster than governance.
Start with the AI Risk Calculator for a baseline view in under five minutes. From there we can map your clinical and operational AI against TGA, AHPRA, OAIC, and ACSQHC expectations, and outline the work needed to close any gaps.