What AI governance actually looks like for a multi-clinic allied health business

Three regulatory changes landed in the last few months, and all of them touch how a healthcare business uses AI. The commentary around them has been louder than it needs to be. None requires a large technology project. All of them require someone in the organisation to own the answer.

For a single clinic that is manageable. For a multi-clinic allied health business it is a different problem, because the risk compounds with every site. A single unapproved AI tool adopted by one clinic creates exposure across the whole network. This is a note on what practical AI governance actually looks like at that scale, and where to start.

Why this is live now

Three changes are worth knowing, described plainly and without the alarm.

The Privacy Act, from 10 December 2026. New provisions in Australian Privacy Principle 1 require a covered organisation to describe, in its privacy policy, where personal information feeds computer programs that make, or substantially and directly support, decisions that could significantly affect a person. The OAIC published its final transparency guidance on 30 September 2026. The duty applies to APP entities, and health service providers are covered regardless of turnover, so most allied health businesses are in scope. It is a disclosure duty, not a ban, and not a requirement to declare every use of AI. It also applies to tools already in use, not just new ones. We wrote a plain-English walkthrough of exactly this in how to write an AI policy before 10 December.

The RACGP Standards, 6th edition. The RACGP released its 6th edition on 26 August 2026, with a new criterion, F11, on the use of AI. It has two parts: F11.A, that AI is used safely and in line with existing standards, and F11.B, that the practice assesses and evaluates the AI it uses. Two things matter for an allied health network. First, F11 sits in the standards for general practices, so it binds the GP clinics in your network that use AI, not your allied health practices. Second, accreditation still runs on the 5th edition, and no transition date to the 6th has been announced, so F11 is not assessed at accreditation today. The direction of travel is clear, though, and a practice preparing for accreditation in 2027 is better served building toward it now than retrofitting it later.

The TGA clinical decision support exemption, from 1 November 2026. The TGA amended the exemption that lets some clinical decision support software avoid ARTG registration. The TGA describes the change as clarifying the exemption rather than expanding or narrowing it. In broad terms, software keeps the exemption only where it helps a clinician reach a decision rather than making one, does not process a medical image or signal, does not replace clinical judgement, does not make the diagnosis or treatment decision itself, and shows the clinician the guidelines, calculations or logic behind its recommendation. Software that drives a clinical decision rather than informing it may now need registration. If any tool sits in a clinical workflow, it is worth asking the vendor to confirm its ARTG status in writing. The TGA's own guidance on clinical decision support software is the authority here.

None of these is a reason to panic. Together they are a reason to be deliberate.

The scale problem

A multi-clinic business is not a small practice with more rooms. Every site is a place where a clinician can sign up for an AI scribe, a scheduling assistant or a documentation tool without anyone centrally knowing. The business carries the privacy and clinical risk of all of it, whether or not head office approved it.

That is the real governance question at scale. It is not whether AI is on the strategy. It is whether anyone can say, today, what AI is in use across the network, who approved it, and what it touches.

What good governance actually looks like

It does not require a large team or a complex programme. At this scale it comes down to four things.

1. A register of AI tools in use

A single, current list of the AI and automated tools used across the network, including the ones individual staff adopted on their own. This is the foundation. Everything else depends on knowing what you actually have. Keep it updated as new tools are adopted, rather than refreshing it once a year.

2. A clear policy on what staff can and cannot use

One document that tells people what they may use, what they must never put into a public AI tool, and how to raise a new tool for approval. It names an accountable person. It fixes the few positions that are not safe to leave to personal judgement: no customer or patient information in public AI tools, human review before AI output reaches a patient, and a clear stance on staff using unapproved tools. The rest can be tailored to how your clinics actually run. We set out the structure, with example wording, in how to write an AI policy before 10 December.

3. A privacy policy that reflects actual practice

If the Privacy Act covers you, and it almost certainly does, your privacy policy needs to describe your use of automated decision-making by 10 December. The honest version of this is short. Either you use automated systems in decisions that significantly affect people, and you describe that, or you do not, and you say so and review it if that changes. The work is deciding which statement is true for you today, which brings you straight back to the register.

4. A board-level view of AI risk

AI risk is not only an IT question, and a board that treats it as one will be surprised later. The board needs a view of what AI the business relies on, what could go wrong, and who owns it. The ASD and the AICD have set out the questions directors should be asking, and we worked through practical answers to them in the questions your board is asking about AI.

The board already tends to have AI on the agenda. What is usually missing is the governance underneath the conversation. These four things are that governance.

Start with the audit

The most useful thing a multi-clinic business can do in the next month is audit what AI is actually in use, clinic by clinic. That one piece of work drives everything else. It tells you whether your privacy policy needs updating before 10 December. It surfaces any clinical tool whose ARTG status should be checked with the vendor. And it is the raw material for the AI use policy that supports future accreditation.

It does not need a platform to begin. It needs someone to own it, a simple template, and a fortnight of honest answers from each site.

Where a platform helps, and where it does not

Writing the register and the policy is organisational work, and no tool does it for you. What a platform earns its place on is the part that decays: keeping the register current, keeping the policy aligned as the standards move, and keeping dated evidence against each control so the answer to "how do you know?" is a record rather than a memory.

That is the gap our Verified AI Policy and the wider platform close. The Verified AI Policy runs a short guided interview, drafts a policy for your business, and will not issue a certificate until every required clause is present and consistent, checked against the standards you choose, including the Australian Privacy Principles and the principles of ISO/IEC 42001. A qualified reviewer stands behind it. Where a business is not covered by the Privacy Act, we describe the policy as aligned to the principles voluntarily, because we never claim more than is true. You can see how this fits an allied health setting on our governed AI for healthcare page.

Do this next

If you would rather talk it through, our free webinar, AI and the Privacy Act: what to do before 10 December, walks through the Privacy Act change with time for your questions. And if it would be useful, we are happy to run a focused session on what an AI audit looks like for a multi-clinic allied health business, and what a proportionate governance programme looks like at your scale. No demo, no product walk-through, just the practical answer to the question you came in with.

This is general information, not legal advice. If you are unsure whether the Privacy Act covers you, or how any of these changes apply to a specific tool or decision, confirm it with a qualified adviser.

Common questions

Does the 10 December 2026 Privacy Act change apply to an allied health business? Most likely yes. The new transparency duty in Australian Privacy Principle 1 applies to APP entities, and health service providers are covered regardless of turnover. From 10 December 2026, a covered organisation's privacy policy must describe where personal information feeds automated systems that make, or substantially and directly support, decisions that could significantly affect a person. It is a disclosure duty, not a ban.

Does RACGP criterion F11 apply to allied health clinics? F11 sits in the RACGP Standards for general practices, 6th edition, so it binds general practices that use AI, not allied health practices. If your network includes GP clinics, it applies to those. For allied health, F11 is not a binding standard, but it is a clear signal of where sector expectations are heading, and the same building blocks answer it.

What is the simplest first step? Audit what AI is actually in use across every clinic, including tools individual staff have adopted on their own. That single list drives the privacy policy update, any vendor checks, and the AI use policy. None of it needs a technology platform to begin. It needs someone to own it.

Do we need a new system to manage this? No. Governance at this scale is a register, a policy, an honest privacy policy and a board-level view of AI risk. A platform helps keep the register current and the evidence dated once the basics are in place, but the starting work is organisational, not technical.