In the statutes and guidance we read, nothing in force in Australia requires a clinic to tell a caller they are speaking with an AI agent; the national safety standard asks for it and is voluntary. Every private clinic is under the Privacy Act. Five states and territories need every principal party's consent before a party records a call, and three let a clinic record its own call; a recorded opening notice, with the caller then continuing, is implied consent under the wording of all of them. A plain reminder is not spam; a message or call that promotes services needs consent.
What to do
This is a guide for clinic owners, not legal advice. Every line points to the law or the regulator's own page, checked on 2026-10-20. Where we could not confirm something, the page says so.
Recording is governed by each state or territory's listening or surveillance devices Act; five of them need every principal party's consent, express or implied, before a party records, and three let a party record its own call but restrict what it can later do with the recording. The federal interception law bars listening to or recording a communication while it passes over the telecommunications system without the knowledge of the person making it; on its own text a communication stops passing over the system once the intended recipient's service has received it. Whether a hosted AI vendor's platform counts as the clinic's own service is a legal question the Act does not answer. A clear recorded notice at the start of the call, with the caller then continuing, is implied consent under the wording of every state Act we read; a caller who objects or hangs up has not consented.
We found nothing in force in Australia that requires telling a caller they are speaking with an AI agent: not in the Privacy Act, the Spam Act, the Do Not Call Register Act, the telemarketing standard, the state recording Acts, or the Ahpra, dental and GP guidance, which are guidance rather than law. The Voluntary AI Safety Standard asks organisations to disclose when they use AI, and it is voluntary. The mandatory guardrails proposed in 2024 were not legislated; the National AI Plan of December 2025 relies on existing laws. The finding rests on the statutes read, not an exhaustive search of every state Act.
A business that provides a health service and holds health information is not a small business operator, so every private clinic is covered whatever its turnover. Sensitive information, which includes health information, may be collected only with the person's consent and where reasonably necessary for the clinic's functions, unless an exception applies. The Commissioner's guidelines say consent cannot be inferred from notice alone and that silence is hard to rely on, so a recorded notice that offers a clear alternative, such as speaking to a person, is the stronger design. Before disclosing personal information to an overseas recipient the clinic must take reasonable steps to ensure the recipient does not breach the principles; where an overseas recipient is not itself subject to the principles and breaches them, that breach is treated as the clinic's. Information no longer needed must be destroyed or de-identified unless a law requires it to be kept. An eligible data breach, one a reasonable person would conclude is likely to result in serious harm, must be notified to the Commissioner and to affected people as soon as practicable; where there are reasonable grounds only to suspect a breach, the clinic must take all reasonable steps to complete its assessment within 30 days.
A plain appointment reminder is not a commercial electronic message under the Spam Act, because its purpose is not to offer or promote goods or services; the regulator's own page lists appointment reminders among messages that are generally not spam. A reminder that adds a promotion becomes commercial and needs consent, which may be express or reasonably inferred from conduct and the business relationship; the regulator says inferred consent needs a provable, ongoing relationship with marketing directly related to it, and is less reliable than express consent. A telemarketing call under the Do Not Call Register Act is a voice call, including one with a recorded or synthetic voice, whose purpose includes offering or promoting goods or services; routine reminder and follow-up calls fall outside that definition, and the Act has no health-sector exemption, so a recall call that also promotes services is a grey area. The telemarketing standard sets calling hours (weekdays 9 am to 8 pm, Saturdays 9 am to 5 pm, no Sundays or national public holidays), requires the caller to identify itself at the start of the call (a given name is not required when the call uses only a recorded or synthetic voice), requires a way during a recorded or synthetic voice call for the recipient to ask for caller details, and requires the call to end at once when asked.
The Dental Board of Australia points to the Ahpra guidance of 22 August 2024 and has no separate AI standard that we found. The Australian Dental Association's policy statement on AI in dentistry says the extent of an AI system's contribution to clinical decision making should be clearly recognised and understood by practitioners and patients, that any application in clinical care must be supervised by a dental practitioner, and that data should be obtained with appropriate permissions and stored securely. It has no rule about telling patients they are speaking to an AI and says nothing about phone or reception agents.
The Ahpra and National Boards guidance says practitioners should inform patients about their use of AI, obtain informed consent for AI tools that need personal patient data, and that consent is particularly important for AI that records private conversations. It addresses practitioners using AI in clinical practice, mainly scribing, and does not mention reception, booking or phone agents. The GP college's guidance on conversational AI asks GPs to obtain informed consent when using patient-facing AI tools, for example as part of intake, and to be transparent about the tool in the practice privacy policy.
Each state or territory has its own page with the law, the sections and what we could not confirm.
| State or territory | Recording notice | AI disclosure | Health privacy law | Dental regulator statement |
|---|---|---|---|---|
| New South Wales | Yes | No | Health Records and Information Privacy Act 2002clinic is the health service provider | Partly |
| Victoria | Partly | No | Health Records Act 2001clinic is the health service provider | Partly |
| Queensland | Partly | No | Privacy Act 1988 (Commonwealth)clinic is the APP entity | Partly |
| Western Australia | Yes | No | Privacy Act 1988 (Commonwealth)clinic is the APP entity | Partly |
| South Australia | Yes | No | Privacy Act 1988 (Commonwealth)clinic is the APP entity | Partly |
| Tasmania | Yes | No | Privacy Act 1988 (Commonwealth)clinic is the APP entity | Partly |
| Australian Capital Territory | Yes | No | Health Records (Privacy and Access) Act 1997clinic is the record keeper | Partly |
| Northern Territory | Partly | No | Privacy Act 1988 (Commonwealth)clinic is the APP entity | Partly |
From 10 December 2026, a clinic whose privacy policy must cover automated decisions will need to describe them if a computer program makes, or substantially drives, a decision that could significantly affect a person's rights or interests. That is a privacy-policy duty, not a spoken disclosure on a call, and whether a booking or triage routing by an AI phone agent counts is unsettled.
Aida opens every call with the recording notice your province or state needs, and says it is the practice's AI agent wherever you want it to. Request a demo with your clinic's rules in mind.
Notice
in the opening line
Approved
answers only
Staff
keeps control