Australia

The strictest line of the six, so it effectively sets the bar for the whole product. Regulation is triggered by the manufacturer's intended purpose, assessed objectively from how the product is designed, described, marketed and used. The February 2026 AI guidance explicitly names chatbots that use large language models to apply clinical triage protocols as in-scope. The clinical decision support carve-out is narrow and oriented to clinician-facing tools, not patient-facing symptom interpretation.

Health information is sensitive information, which raises the bar to collect and use it. APP 11 governs security, and APP 8 governs cross-border disclosure: send identifiable patient data to an overseas recipient and the entity remains accountable for how that recipient handles it, unless the patient consents or the destination is whitelisted. The 2024 reforms added a statutory tort for serious invasions of privacy, in force from June 2025, and automated-decision-making transparency obligations landing by December 2026. Australia has no EU adequacy decision, and a country-whitelist mechanism is still under development.