← Back to insights Clinical AI

AI Scribes in Australia: TGA, Privacy Act and RACGP Guidance

Before introducing an AI scribe, Australian practices should check its functionality, patient consent, data handling and clinical review process. This guide explains what to verify and what evidence to request.

Kamna Singh Thakur • Nov 3, 2026 • 13 min read

AI Scribes in Australia: TGA, Privacy Act and RACGP Guidance

What should an Australian practice check before using an AI scribe?

Australian practices need to assess an AI scribe’s intended purpose, patient-data handling and clinical workflow. TGA status depends on functionality; privacy obligations extend beyond recordings; and clinicians must explain AI use, obtain informed consent and check the output. A supplier’s compliance claim alone is insufficient evidence for adoption.

Key takeaways

Start with the functions. A supplier’s intended-use and regulatory evidence should match the configuration your practice will use.
The review has concluded. Use the published October 2026 TGA findings rather than describing the review as ongoing.
Consent belongs in the consultation workflow. RACGP advises obtaining it at the beginning of each consultation.
Follow the whole data journey. Assess transcripts, outputs, access and secondary uses alongside the original recording.
Review remains clinical work. Practitioners retain professional accountability for checking AI-generated records.
Test before scaling. KastHunt recommends a scoped pilot with agreed functions, consent, review and monitoring arrangements.

The checks before your first consultation

An AI scribe may sit inside familiar practice software, but its introduction changes how consultation information is captured, processed and turned into a record. Before enabling it, establish:

What it does: documentation support, clinical recommendations, or both.
Where information goes: including transcription, model processing and support access.
How patients choose: explanation, consent, refusal and withdrawal.
Who checks the result: a defined review and correction process.
What changes later: new features, supplier terms and processing arrangements.

The practical workflow and supplier checklist below are KastHunt’s recommended implementation approach. They distinguish suggested controls from the legal and professional obligations identified in the linked guidance.

Who sets the requirements?

Organisation or framework	Main question it addresses	What to check
TGA	Does the product have a medical-device purpose?	Intended use, enabled functions and applicable regulatory pathway.
Privacy Act and OAIC guidance	How is personal information handled?	Collection, notification, use, disclosure, security and individual rights.
Ahpra and National Boards	How do professional duties apply when using AI?	Understanding, transparency, consent and clinical accountability.
RACGP	How should general practices introduce and use scribes?	Practice policies, patient communication, note review and ongoing assessment.

These sources have different roles. RACGP guidance is professional guidance for general practice; it should not be presented as legislation or a universal rulebook for every profession.

When is an AI scribe a medical device?

TGA status depends on intended purpose and functionality. Administrative documentation without new clinical suggestions may fall outside the device definition. Functions supporting diagnosis, treatment or triage may cross the boundary.

Example function	Regulatory distinction to examine
Transcribing or summarising the consultation	Administrative when it adds no new clinical conclusions.
Formatting information or matching explicitly stated terms to codes	May remain administrative; examine the intended function.
Suggesting a diagnosis, treatment or investigation	Likely to require medical-device assessment.

Clinician review or a disclaimer does not settle classification. Devices generally require ARTG inclusion before supply unless exempt; an exempt CDSS remains regulated. Request the supplier’s written rationale for the exact product configuration.

What changed in 2026?

The TGA published its review outcomes on 16 October 2026. Of 12 products examined, eight contained functions likely to meet the device definition, two needed further information and two appeared unlikely to be devices. This was a selected sample, not an estimate for the whole market. The review did not test safety, performance or privacy protections.

CDSS exemption amendments took effect on 1 November 2026. TGA says they clarify the exemption without changing its scope or introducing new regulatory requirements.

What does the Privacy Act mean for your practice?

An organisation providing a health service and holding health information is covered by the Privacy Act even if it is a small business. A small clinic should not assume that its turnover removes its obligations.

OAIC’s AI guidance covers personal information both entered into an AI system and generated by it. Deleting the recording therefore does not end the assessment: transcripts and generated notes may still contain patient information.

Follow the information through the whole system

Ask the supplier to map the journey from microphone to final record. Include speech recognition, model providers, temporary storage, logs, backups, integrations and support access.

Privacy area	Practical question
APP 1 — transparency	Does the privacy policy explain the practice’s information handling?
APP 3 — collection	Is the information necessary, and is sensitive information collected with consent or an applicable exception?
APP 5 — notification	Are patients told about relevant collection and handling arrangements?
APP 6 — use and disclosure	Is information used for care, or for an additional purpose requiring a separate basis?
APP 8 — overseas disclosure	Who can receive or access information overseas?
APP 10 — quality	How are inaccurate or incomplete outputs detected?
APP 11 — security	How is information protected, retained and disposed of?

Sources: OAIC’s APP guidance and AI product guidance.

Can patient information be processed overseas?

The Privacy Act does not impose a blanket Australia-only hosting requirement. APP 8 generally requires reasonable steps before overseas disclosure and can make the disclosing entity accountable for the recipient’s handling. Exceptions exist.

OAIC also distinguishes disclosure from limited arrangements in which information remains within the organisation’s effective control. Server location alone does not resolve that assessment.

For procurement, check processing and storage countries, subcontractors, access permissions and contractual restrictions. Australian storage can be one useful control, but does not establish compliance for the entire service.

Can the supplier train models on consultation data?

Do not assume consent to clinical documentation also authorises supplier training. APP 6 limits secondary uses and disclosures unless an exception applies. Review training, analytics and product-improvement terms separately.

How long should recordings and transcripts be kept?

Request separate retention periods for audio, transcripts, drafts, logs and backups. APP 11 requires reasonable security measures and, when information is no longer needed for a permitted purpose, reasonable steps to destroy or de-identify it, subject to applicable retention exceptions.

A supplier’s audio-deletion promise should therefore be checked alongside the practice’s medical-record obligations and the treatment of every other copy.

What should patient consent look like?

RACGP advises obtaining consent at the beginning of each consultation. Check whether your medical defence organisation requires written consent; where it does not, verbal consent should be documented.

An enrolment form, website notice or waiting-room sign can support the conversation. Build an explicit consent step before audio capture rather than relying on a passive notification.

A practical consent conversation

Before starting, explain:

The tool’s role in preparing draft documentation.
What information it captures and who processes it.
Relevant storage, retention and secondary-use arrangements.
How the clinician checks the draft.
How the patient can decline or ask for recording to stop.

These points should reflect the actual service configuration. Ahpra expects informed consent for AI scribes using personal patient data and ideally a record of the response.

Suggested opening wording:

“I’d like to use an AI tool to help prepare a draft of today’s notes. I’ll check and correct the draft. Before we start, I’ll explain how it handles your information. You can choose not to use it, and we can document the consultation in the usual way.”

This is an opening, not a complete consent form. Add the verified processing, storage, retention and disclosure information before asking for consent. Avoid promises such as “nothing is stored” unless they are supported for the exact service being used.

What must clinicians check?

Ahpra says practitioners remain responsible for safe care and must apply human judgement to AI outputs, including checking the accuracy and relevance of scribe-generated records.

For a practice review checklist, we recommend checking:

Patient and speaker attribution.
Medicines, doses, allergies and negation.
Findings that were observed versus discussed.
Unsupported diagnoses, statements or plans.
Missing information, uncertainty and follow-up instructions.

APP 10 also requires reasonable steps to ensure relevant personal information is accurate, current and complete.

RACGP cautions against relying on scribes to establish whether Medicare requirements have been met: suggested MBS items need independent verification.

Do state and public-sector requirements also apply?

Check the setting as well as the country. Applicable health-record, privacy and recording requirements can vary by jurisdiction. AJGP’s medicolegal discussion highlights particular complications where a telehealth patient and clinician are in different jurisdictions.

Before rollout, record the practice’s location, patient locations, public- or private-sector status and relevant contractual or health-service policies. Public-sector requirements should not be described as automatically applying to every private clinic, and private practices may still have additional obligations.

What evidence should you request from a supplier?

Use this as a procurement worksheet. The items below are recommended evidence requests, not a statement that each named document is legally mandatory in every setting.

Check	Ask the supplier for	Suggested owner
Product scope	Intended-use statement, feature list and configuration details	Clinical lead
Regulatory position	Written rationale and ARTG or exemption evidence where applicable	Clinical lead / procurement
Data journey	Diagram covering audio, text, models, integrations and third parties	Privacy / IT lead
Location and access	Storage and processing locations, subcontractors and support access	Privacy / IT lead
Retention	Separate schedules for audio, transcripts, drafts, logs and backups	Practice manager
Secondary use	Contractual terms for training, analytics and product improvement	Privacy lead
Patient choice	Demonstration of consent, refusal and stopping capture	Practice manager
Review controls	Demonstration of editing and approval before finalisation	Clinical lead
Changes and incidents	Notification process for material changes and incident escalation	Practice manager / IT

A reassuring answer should be traceable to a contract, technical document or demonstrated control. If a supplier cannot explain an important data flow, resolve it before patient information enters the system.

How to introduce an AI scribe

The following is KastHunt’s recommended rollout approach.

Before choosing

Define the documentation problem, permitted functions and success measures. Compare supplier evidence against the intended workflow. Conduct a privacy impact assessment proportionate to the risks and involve clinical, privacy and IT owners.

Before go-live

Approve the configuration, patient information and consent process. Train staff using synthetic consultation examples, test the review and correction steps, and establish a fallback for patients who decline or when the service fails.

Include the supplier in the incident-response plan. Under the Notifiable Data Breaches scheme, eligible breaches require notification to OAIC and affected individuals; the assessment includes likely serious harm and whether remedial action prevents that risk. Not every incident is automatically notifiable. 14

During the pilot

Measure review time, correction types, omissions, patient concerns and workflow friction. Set a note-audit frequency appropriate to risk and scale rather than presenting a fixed monthly interval as a legal rule.

For multi-site groups, establish a common minimum standard with documented local variations. Reassess when features, model providers, data locations or terms change.

How KastHunt approaches AI-scribe implementation in Australia

KastHunt’s starting point is the clinical workflow: what needs documenting, who contributes information, where it goes and who approves the record. For an Australian pilot, we recommend agreeing the permitted functions, patient information, consent, review responsibilities and EHR handoffs before wider rollout.

Where EveStella fits

EveStella by KastHunt Consulting is an ambient AI scribe for structured, review-ready documentation across intake, front-desk interactions, nursing and consultations. Its published workflow includes source-linked drafts, templates and clinician sign-off before notes enter the record.

Deployment options include the client’s own environment. Agree the complete processing architecture, region, retention and access arrangements during scoping; hosting location alone does not establish whole-workflow compliance.

The same supplier evidence checklist applies to EveStella. Review the supplied configuration and its documented regulatory position alongside the practice’s obligations.

A useful pilot should demonstrate how the tool fits your practice’s responsibilities, as well as how it produces a draft.

Explore EveStella

Is your practice ready to introduce an AI scribe?

Before the first consultation, your team should be able to explain what the tool does, how it handles patient information, how consent works and who checks the final note.

KastHunt helps healthcare teams map workflows and scope clinical AI pilots. Discuss EveStella against your practice’s documentation needs, EHR environment and Australian data-handling requirements.

Book a Discovery Workshop

Frequently asked questions

Does an AI scribe need TGA approval in Australia?

Not every AI scribe requires inclusion in the Australian Register of Therapeutic Goods (ARTG). Its regulatory status depends on its intended purpose and functions. A tool that documents a consultation without adding new clinical conclusions may fall outside the medical-device definition. A tool that suggests diagnoses, treatments or investigations may be regulated.

Some clinical decision support software qualifies for an exemption from ARTG inclusion but still has regulatory obligations. Ask the supplier for its written assessment covering the exact features your practice will use. Clinician review alone does not remove device obligations.

Do patients need to consent at every consultation?

RACGP advises obtaining consent at the beginning of each consultation involving an AI scribe. Explain what the tool does, how it handles patient information and that the patient can decline. Document their response in the clinical record.

Check your medical defence organisation’s expectations about written consent. Where written consent is not required, RACGP allows for verbal consent that is recorded in the notes. An enrolment form or waiting-room notice can support patient awareness, but should not replace the consultation-level consent process.

Must all information stay in Australia?

The federal Privacy Act does not impose a blanket requirement that all patient information remain in Australia. However, overseas disclosure generally engages APP 8, which requires reasonable steps to protect information and can leave the practice accountable for the overseas recipient’s handling. Exceptions and distinctions between “use” and “disclosure” require assessment.

Check processing locations, subcontractors and overseas support access—not just where the final note is stored. Applicable state laws, public-sector policies and contractual requirements may impose additional restrictions.

Does deleting the audio remove privacy obligations?

No. Deleting the recording addresses only one part of the information lifecycle. Patient information may remain in transcripts, draft notes, final records, logs or backups. Privacy obligations also apply to personal information generated by the AI system.

Ask the supplier what remains, who can access it and when each copy is deleted. Retention arrangements should account for applicable medical-record requirements. APP 11 requires reasonable security measures and appropriate destruction or de-identification when information is no longer needed, subject to retention exceptions.

Who is responsible for an incorrect AI note?

The practitioner retains professional responsibility for checking the accuracy and relevance of AI-generated documentation. Before approving a note, review medicines, doses, allergies, findings, diagnoses and follow-up instructions, and correct omissions or unsupported statements.

Ahpra makes clear that using AI does not transfer the practitioner’s professional accountability to the software. This does not mean suppliers or healthcare organisations can never have separate responsibilities or legal liability; those questions depend on the circumstances.

Is client-controlled hosting enough to establish compliance?

No. Hosting the scribe on your servers or in your cloud account can support control, but it does not establish compliance by itself. The assessment must also cover patient information, permitted uses, third-party access, model processing, retention and security.

For example, a locally hosted application may still send information to an external transcription or language-model service. Review the complete architecture and contracts, alongside consent, clinical review and incident-response arrangements. Assess each data flow rather than relying on the hosting label.

Can EveStella support an Australian practice’s documentation workflow?

EveStella by KastHunt Consulting supports structured, clinician-reviewed documentation across consultations and wider care-team workflows. Its published features include source-linked drafts, configurable templates, highlighted details for review and clinician sign-off before notes enter the record. Deployment options include the client’s own environment.