What the RACGP's New AI Criteria Ask of Your Practice

The RACGP's 6th edition Standards for general practices are out, and for the first time artificial intelligence is named in them.

If you use an AI scribe, an AI triage tool, or anything that touches patient information and produces an answer, this is now part of what your practice is expected to have thought about.

One thing on timing before anything else. At the time of writing, accreditation assessments are still being run against the 5th edition, and no transition date has been published. That is a gift, not a reprieve. You have a window to get this in order before it is being assessed rather than after. Confirm the current position with your accrediting body rather than taking my word for it — this is exactly the kind of detail that moves.

Here is what the AI criteria actually ask, in plain English.

Informed consent and transparency

Tell patients how AI tools use their health information. Not buried in a form nobody reads — actually tell them.

The part practices underestimate is what happens when a patient says no. They can withdraw at any time, and when they do, you have to:

• document it, so it is visible to whoever sees them next
• stop using AI in their care, unless it is clinically necessary and they have re-authorised it
• offer an alternative pathway, which means the alternative has to exist before you need it
• explain the implications respectfully — what changes for them, without making it sound like a punishment for asking

That last one matters more than it looks. A patient who withdraws consent and gets treated as a nuisance tells other patients.

Privacy Act 1988 and the Australian Privacy Principles

This is the one that catches practices out, and it is worth being blunt about it: a lot of tools sitting on desks in Australian practices right now do not clear this bar.

The usual failure is data residency. The information does not stay in Australia. It goes to a server somewhere else, under someone else's law, and in a lot of cases nobody in the practice has ever checked.

Grammarly is the example I use, because it is so ordinary that it never gets audited. It is a US company running on US infrastructure. Paste a patient's history into it to tidy up the wording, and that history has left the country. Nobody thinks of it as a clinical system. That is exactly why it is a problem.

The question to ask about every tool is the same: where does the data physically live, and who can reach it?

Accountability

Governance and risk management, which in practice means: someone's name is against this.

Accountability always sits with a person, never with the tool. "The AI suggested it" has never been a defence and it is not becoming one. If a decision was made with AI in the loop, a clinician owns that decision.

Third parties

Patients have to be informed about external providers handling their data.

Most AI tools are a stack, not a product. The scribe you bought may run on a model hosted by someone else, in an environment run by a third party again. You cannot inform patients about a chain you have not mapped, so map it — ask the vendor directly, in writing, and keep the answer.

Questioning the output

AI is probabilistic. It is probably right, not definitely right, and those are very different things in a clinical setting.

The requirement is that you have a way to interrogate why you got the answer you got. If a tool produces a summary, a code, or a suggestion and there is no way to see what it was working from, you cannot review it — you can only accept it or reject it on vibes. That is not clinical oversight.

Cultural safety and Indigenous data sovereignty

Two questions, and they are not the same question.

Is the tool appropriate and relevant to the population it is being used on? A model trained on one population can be quietly worse on another, and "quietly" is the dangerous part — it does not announce a lower accuracy rate, it just gets more things wrong for some patients than others.

And who owns the data, and where does it live? Indigenous data sovereignty is a specific principle with specific expectations, not a subheading under privacy. If your practice serves Aboriginal and Torres Strait Islander communities, this needs a real answer, not a vendor brochure.

Monitoring and review

Not set and forget.

A tool that was appropriate at install can drift — the vendor changes the model underneath you, the population you serve changes, the way your staff use it changes. Someone has to look at it on a schedule and be willing to turn it off.

Regulation

If a tool meets the definition of a medical device, it needs to be on the ARTG and comply with TGA guidance.

Plenty of software vendors are careful to describe their product in language that stays clear of that definition. Whether they are right is a question worth asking them directly, and worth asking before you deploy rather than during an assessment.

Where to start

If you do nothing else this month, do these four things.

1. Write down every tool in the practice that touches patient information and produces an answer. Include the ones nobody thinks of as clinical systems. That is where the surprises are.
2. For each one, find out where the data is stored and processed. In writing, from the vendor.
3. Draft the consent wording and the alternative pathway. You need both before a patient asks, not after.
4. Put a name against each tool. One person who owns it, reviews it, and can switch it off.

None of that requires a project. It requires an afternoon and a willingness to hear an answer you do not like about a tool you already paid for.

This is a general walkthrough of what the criteria ask, not legal or clinical advice, and it is not a substitute for reading the Standards or talking to your accrediting body.

If you want a hand working out which of your tools clear the bar and which do not, come and have a chat with us — we do this work with health providers across WA. Or get this kind of thinking weekly.