METHOD AND EVIDENCE
Clear rules. Traceable sources.
Version 1.0 · Checked 23 September 2026
This builder combines your answers with fixed, reviewable wording. No answer is sent to an AI service. Tool names and ticked checks are self-reported, never verified approvals.
What the different sources mean
- Law: legal requirements depend on the business, information and activity. Team size alone does not establish Privacy Act coverage.
- Regulator guidance: explains obligations and expected practice; a recommendation is not automatically a separate statutory duty.
- Voluntary guidance: National AI Centre practices inform proportionate governance. This builder does not certify compliance.
- Professional standards: check the applicable accreditation edition, profession and setting. This is not a clinical-governance system.
- Techora defaults: conservative starting rules, such as public-data use and a six-month review recommendation. You explicitly choose recommendations; unanswered facts remain unresolved.
Healthcare needs a separate process
Patient-data and clinical AI require a use-specific assessment, procedures and professional sign-off. RACGP states it does not recommend specific commercial AI scribes. Its page header says 29 June 2026 while its significant-update section says October 2025; both are recorded below.
Privacy by design
The standalone application has no submission endpoint, analytics, external fonts, account or tracking code. Answers stay in local browser storage, expire after seven days from the last edit and are removed on the next opening. Use the clear control on shared devices. Other scripts on the same website origin could access browser storage: hosting integration must preserve this tool’s isolation. Web-host access logs can still record page requests. Copies you print, download or copy are under your control.
Source register
Dates are publication/update dates where available. Every source was checked on 23 September 2026. The full Ahpra page and National AI Centre policy-template attachment were reviewed, as well as their linked official resources.
S01 · Essential AI practices
National AI Centre · Voluntary government guidance
No page date displayed · Accessed 2026-09-23
AI governance should address purpose, risk, accountability, oversight and transparency. Existing laws still apply; this is not a certification scheme.
S02 · Guidance for AI adoption: foundations
National AI Centre · Voluntary government guidance
Download published 5 May 2026 · Accessed 2026-09-23
Six practices cover accountability, impacts/contestability, risk, information/registers, testing/monitoring and human control. The builder maps to all six at a small-business level; a policy alone does not implement them.
S03 · Guidance on privacy and the use of commercially available AI products
OAIC · Regulator guidance on applicable privacy law
Published 21 October 2024; header updated 17 January 2025 (body also retains 21 October 2024) · Accessed 2026-09-23
Assess product suitability and privacy risks. Privacy duties can apply to AI inputs and outputs. OAIC recommends against personal, particularly sensitive, information in public generative AI. Notices are not themselves consent.
S04 · Artificial intelligence for small business
ASD / ACSC · Government cybersecurity guidance
Published and updated 14 January 2026 · Accessed 2026-09-23
Data use can depend on subscription and settings. Review supplier handling, ownership, access, training and incident processes; verify outputs and keep human oversight. AI introduces prompt-injection and supply-chain risks.
S05 · Small business
OAIC · Regulator guidance on legal coverage
No page update date displayed · Accessed 2026-09-23
The small-business exemption has exceptions, including health service providers. Headcount does not determine Privacy Act coverage. The builder does not decide applicability from team size or industry alone.
S06 · What is health information?
OAIC · Regulator explanation
No page update date displayed · Accessed 2026-09-23
Health information includes identifiable information about health and health services; it is not limited to diagnoses. Read with the Privacy Act definition of sensitive information (S18).
S07 · False or misleading claims
ACCC · Regulator explanation of Australian Consumer Law
No reliable page update date displayed · Accessed 2026-09-23
Business communications and advertising claims must not mislead; claims need substantiation. AI assistance does not make invented claims or testimonials acceptable.
S08 · Protection from discrimination at work
Fair Work Ombudsman · Regulator explanation of employment law
No page update date displayed · Accessed 2026-09-23
Protections cover employees and prospective employees; adverse action on protected grounds can be unlawful. The builder’s ban/assessment gates for people decisions are conservative design rules, not a claim that all AI hiring assistance is illegal.
S09 · Considerations when using artificial intelligence to create IP
IP Australia, IP First Response · Government good-practice guidance
No page update date displayed · Accessed 2026-09-23
Uploading protected works may infringe rights; provider terms may permit retention/reuse. Consider secrecy and ownership risks and do not assume AI output carries clear rights or copyright protection.
S10 · Artificial intelligence (AI) scribes
RACGP · Professional guidance; not product endorsement
Page header: 29 June 2026; publication section: first August 2024 / significant update October 2025 · Accessed 2026-09-23
RACGP does not recommend specific commercial products. GPs must check and correct generated notes. Consent at each consultation, recording-law checks and MDO/legal advice are relevant. Source displays two update dates; both are preserved here.
S11 · Meeting your professional obligations when using Artificial Intelligence in healthcare
Ahpra and National Boards · Professional regulator guidance
Page reviewed 22 August 2024 · Accessed 2026-09-23
Practitioners remain accountable for safe use, accuracy and relevance of documentation, informed consent, privacy, bias and cultural safety. Understand suitability and data handling, and confirm indemnity arrangements. Full page reviewed in browser. For current device distinctions, use the newer TGA source S13.
S12 · AI Clinical Use Guide – Guidance for clinicians
Australian Commission on Safety and Quality in Health Care · National clinical safety guidance
Version 1.0, August 2025 · Accessed 2026-09-23
Before, during and after use, clinicians should evaluate suitability and evidence, discuss limitations and consent, review outputs and contribute to monitoring. Smaller organisations may need to establish governance and non-AI alternatives.
S13 · Digital scribes
Therapeutic Goods Administration · Regulator guidance on medical-device law
Updated 30 January 2026 · Accessed 2026-09-23
Transcription/translation without analysis is distinguished from diagnostic or treatment interpretation. Intended purpose and new functions matter to medical-device requirements. Clinicians remain responsible for consent and accuracy. No product status is decided by this builder.
S14 · When to report a data breach
OAIC · Regulator guidance on NDB legal duties
No page update date displayed · Accessed 2026-09-23
Notification depends on the scheme’s applicability and the statutory breach criteria. Report incidents internally promptly, assess them and determine notification duties rather than treating every AI mistake as automatically notifiable.
S15 · Privacy and managing health information in general practice
RACGP · Professional privacy guidance
First October 2019; updated September 2025 (publication-information page) · Accessed 2026-09-23
Covers confidentiality, informed consent, capacity, collection, secondary use, overseas transfers, privacy notices, corrections and health-records legislation. Separate health-information procedures are needed.
S16 · Information security in general practice
RACGP · Professional security guidance
First November 2022; updated July 2025 (publication-information page) · Accessed 2026-09-23
Supports information-security roles, access controls, third-party risk, workforce culture, continuity, backups and recovery. A general AI policy does not replace this programme.
S17 · Standards for general practices, 6th edition: F11 Artificial intelligence
RACGP · Professional accreditation standard; applicability must be checked
6th edition page accessed; no publication date shown in page extract · Accessed 2026-09-23
F11 addresses AI governance, clinician accountability, patient information, consent withdrawal and evaluation. The related contents include F8 security, F9 privacy, PP4 consent and clinical governance. Practices must confirm the edition and transition rules applicable to their accreditation.
S18 · Privacy Act 1988
Australian Government, Federal Register of Legislation · Legislation
Latest version displayed: C2026C00227, compilation 104, 4 June 2026 · Accessed 2026-09-23
Legal basis includes coverage/exemptions, sensitive information, Australian Privacy Principles in Schedule 1 and breach duties. The builder does not assert that every small business is covered or provide a complete applicability assessment.
S19 · Australian Privacy Principles
OAIC · Regulator explanation of statutory principles
No page update date displayed · Accessed 2026-09-23
The APPs address personal-information handling including transparency, collection, use/disclosure, quality, security, access and correction. Apply the relevant law and exceptions to the actual business and use.
S20 · Chapter 8: APP 8 Cross-border disclosure of personal information
OAIC · Regulator interpretation of legal duties
Updated 3 October 2025 · Accessed 2026-09-23
Before overseas disclosure, covered entities generally need reasonable steps to protect information and may remain accountable, subject to exceptions. Overseas storage, access and disclosure need assessment; Australian hosting alone does not prove safety.
S21 · Create an AI policy / AI policy guide and template
National AI Centre · Voluntary policy guidance
Template download listed as published 22 April 2026 · Accessed 2026-09-23
Web guide and full DOCX reviewed. Topics include scope and definitions, human-centred use, accountable ownership, risk screening, acceptance criteria, monitoring, fairness and inclusion, transparency/contestability and records, human control, roles, incidents, formal approval and review. Roles and procedures must be tailored to the business.
S22 · Guidance for AI adoption: implementation guidance
National AI Centre · Voluntary government guidance
No page update date displayed · Accessed 2026-09-23
Higher-risk/complex uses need deeper risk, impact, supply-chain and monitoring processes. The builder routes such uses to separate assessments and does not claim to implement the full framework.
S23 · Be clear about AI-generated content
National AI Centre · Voluntary government guidance
No page update date displayed · Accessed 2026-09-23
Disclosure should help people understand meaningful AI involvement. The builder’s optional label-all rule is a business choice; it is not presented as a universal legal requirement.
LNSW · Surveillance Devices Act 2007
NSW Parliamentary Counsel · Legislation; jurisdiction reference
Current official consolidated PDF endpoint accessed · Accessed 2026-09-23
Regulates listening devices and private conversations. Consent and exceptions require scenario-specific advice. No blanket national recording permission is generated.
LVIC · Surveillance Devices Act 1999
Victorian Government · Legislation; jurisdiction reference
Version 048, in force 10 December 2025 · Accessed 2026-09-23
Relevant to Victorian surveillance/recording. Its application to capture, use, disclosure and remote consultations must be checked by an adviser.
LQLD · Invasion of Privacy Act 1971
Queensland Parliamentary Counsel · Legislation; jurisdiction reference
Current consolidated page; date not extracted · Accessed 2026-09-23
Contains listening-device rules and exceptions. Recording and later use/disclosure are distinct questions; the builder makes no one-party/all-party legal conclusion.
LWA · Surveillance Devices Act 1998
Western Australian Parliamentary Counsel · Legislation; jurisdiction reference
Consolidation current from 5 April 2023 displayed · Accessed 2026-09-23
Applicable surveillance-device legislation must be checked before recording and disclosing consultation material.
LSA · Surveillance Devices Act 2016
South Australian Government · Legislation; jurisdiction reference
Current authorised legislation landing page; update date not extracted · Accessed 2026-09-23
Relevant surveillance-device law; check consent, exceptions and subsequent handling for the particular consultation.
LTAS · Listening Devices Act 1991
Tasmanian Government · Legislation; jurisdiction reference
Current consolidated page; update date not extracted · Accessed 2026-09-23
Relevant listening-device legislation. A clinical consent process must also address applicable recording and disclosure requirements.
LACT · Listening Devices Act 1992
ACT Parliamentary Counsel · Legislation; jurisdiction reference
Current R10, effective/published 11 February 2022 · Accessed 2026-09-23
ACT listening-device legislation is in force. Obtain advice on its application rather than importing another jurisdiction’s rule.
LNT · Surveillance Devices Act 2007
Northern Territory Government · Legislation; jurisdiction reference
Official consolidated PDF as in force 1 June 2026 · Accessed 2026-09-23
Regulates surveillance devices and communication/publication of resulting information. Check all locations for cross-border use.
D01 · Conservative small-team starting rules
Techora builder design · Design defaults, not legal findings
Version 1.0 · 23 September 2026 · Accessed 2026-09-23
Public/synthetic inputs by default; no credentials; prior tool approval; human checks; no autonomous high-impact decisions; separate clinical approval; six-month recommendation; clear unresolved actions; seven-day local draft storage. Users explicitly accept optional recommendations.
Keeping this current
Techora should appoint an owner to recheck this register before publication, at least every six months and after material changes. The builder displays a stale-source notice after 183 days. Neither a new date nor a vendor’s marketing claim is a substitute for reviewing the evidence.