An aged care AI platform or ACQS compliance software must work inside a tighter regulatory stack than general healthcare: the Aged Care Act 2024, the Strengthened Aged Care Quality Standards (ACQS), Aged Care Quality and Safety Commission enforcement, SIRS reporting clocks, the Privacy Act and state guardianship law. Map every AI use case to each instrument before deployment, with a clinician or manager approving outputs.
Key takeaways
- The Aged Care Act 2024 commenced on 1 November 2025 (Department of Health, Disability and Ageing, 2025), with the Strengthened Quality Standards, and makes the provider accountable for any care decision AI informs.
- Five use cases carry the most risk: resident monitoring, clinical documentation, care-minutes rostering, family-facing chatbots and predictive risk analytics.
- SIRS clocks do not pause while you work out whether AI caused an incident. You need traceability from output to model to reviewer.
- Consent for residents lacking capacity sits with the substitute decision-maker under state law, not automatically with family.
What does the Aged Care Act 2024 mean for AI in aged care?
The Aged Care Act 2024 (Cth) replaced the Aged Care Act 1997 and commenced on 1 November 2025, after commencement was deferred from 1 July 2025. It is a rights-based, person-centred Act written in response to the Royal Commission into Aged Care Quality and Safety Final Report (2021). The Commission (ACQSC) has stronger enforcement powers, and the Strengthened Aged Care Quality Standards apply.
AI in aged care is regulated more tightly than in a typical general practice because the regulator operates under post-Royal Commission scrutiny, many residents have diminished decision-making capacity, and funding (AN-ACC, care minutes) is tied to evidence of care delivered.
This guide is for the CEO, CIO and quality and compliance lead of a multi-site provider across residential, home care and community services. It sits beside our guides on healthcare practice AI, financial services AI compliance and AI in government contracts.
What should ACQS compliance software and an aged care AI platform cover?
There is no single "AI in aged care" law. Seven instruments interact, and a provider needs a control mapped to each. Any ACQS compliance platform you buy or build should make this map auditable.
| Instrument | What It Triggers for an AI Use Case | Impact | |
|---|---|---|---|
| Aged Care Act 2024 (Cth) | Rights-based framework. Provider obligations, statement of rights, Code of Conduct. | AI must support the resident's rights. The provider remains accountable for any care decision AI informs. | Board-level accountability |
| Strengthened Aged Care Quality Standards | Revised standards covering the person, the organisation, care and services, and the environment. | AI-touched processes must show compliance against each applicable standard at quality audit. | Audit-grade evidence |
| ACQSC enforcement powers | Compliance notices, directions, civil penalties, sanctions and registration consequences. | An AI-related quality failure can attract enforcement action. | Real penalty exposure |
| Serious Incident Response Scheme (SIRS) | Priority 1 incidents reported within 24 hours, priority 2 within 30 days. | AI-attributable incidents, such as a missed alert or a wrong recommendation acted on, sit inside SIRS if a reportable category is met. | Reporting clocks |
| Privacy Act 1988 | Resident health information is sensitive information. APP 6, APP 8, APP 11 and the Notifiable Data Breaches scheme apply. | AI processing needs a lawful basis, vendor controls and a breach pathway to the OAIC. | Privacy by design |
| State guardianship law | Substitute decision-making legislation in each state and territory. | Where a resident lacks capacity, AI-supported decisions sit under substitute decision-maker authority. | Consent governance |
| WHS Acts and Fair Work | Worker safety, including psychosocial risk and monitoring practices. | AI rostering or worker-monitoring tools must respect WHS, Fair Work and enterprise agreements. | Worker protection |
Two layers need emphasis. The Act's statement of rights and Code of Conduct apply to the provider, its workers and its governing persons, so AI that affects care is the provider's conduct. And the SIRS priority 1 clock starts on awareness of the incident.
When assessing an aged care AI platform, ask the vendor to show how each feature maps to these instruments, where data is processed, and how every output is logged and approved.
Which AI use cases in aged care carry the most risk?
| Use Case | Regulatory Triggers and Required Control | Impact | |
|---|---|---|---|
| 1. Resident monitoring (falls, sleep, behaviour) | Cameras, bed sensors, wearables, AI inference on behaviour patterns. | Privacy Act, Quality Standards (dignity, restrictive practices), guardianship consent. Control: documented consent pathway, substitute decision-maker sign-off, restrictive practice review. | Consent and restrictive practice review |
| 2. Clinical documentation and handover | Voice-to-text progress notes, handover summaries, care plan updates. | AHPRA obligations for registered nurses, clinical record accuracy. Control: clinician review and sign-off before the record is final. | Clinician sign-off |
| 3. Rostering against care minutes | AI rostering to meet the 215 care-minute target, including 44 RN minutes. | Care minutes requirements, Fair Work, WHS psychosocial risk, enterprise agreements. Control: AI rosters as recommendations, rostering manager approves. | Care-minute auditability |
| 4. Family and resident-facing chatbots | Visit booking, FAQs, care queries, complaints intake. | Consumer law, accessibility for older users, privacy, complaints handling. Control: scope limits and escalation to staff. | Scope-bounded chatbot |
| 5. Predictive risk analytics | Models flagging residents at elevated risk of deterioration or falls. | Clinical decision support, bias risk for CALD and Aboriginal and Torres Strait Islander residents, audit evidence. Control: model risk file, bias testing, override logging. | Model risk file |
See also ACCC consumer guarantees and AI for chatbots and Fair Work compliance and AI for worker monitoring.
Where does automation in aged care help with care minutes?
From 1 October 2024, residential aged care homes have been required to deliver an average of 215 minutes of direct care per resident per day, including 44 minutes from a registered nurse (Department of Health and Aged Care, 2024). Most homes also have a 24/7 RN requirement.
That has three consequences for AI and automation in aged care:
- Rostering AI must protect evidenced care minutes. If a roster pushes a home below target, the funding and regulatory consequences fall on the provider.
- Care delivered must be evidenced. Automated time capture, mobile charting and roster integration help, provided evidence integrity is auditable.
- Worker monitoring draws WHS and Fair Work scrutiny. Tools tracking location, idle time or task completion must respect worker rights and psychosocial risk obligations.
Model the funding exposure from your own AN-ACC classifications and Aged Care Financial Report data against current department guidance. Use our AI vendor selection questions when assessing rostering vendors.
- Care minutes evidenceCaptured as care is delivered
- Quality audit packsAssembled from source records
- SIRS investigationsFull trace from AI output to reviewer
- Staff time on paperworkReturned to residents
How does SIRS apply when AI is involved?
SIRS covers eight reportable incident types: unreasonable use of force, neglect, unlawful sexual contact or inappropriate sexual conduct, psychological or emotional abuse, stealing or financial coercion by a staff member, inappropriate use of restrictive practices, unexpected death, and unexplained absence from care. Priority 1 incidents must be reported within 24 hours and priority 2 within 30 days.
AI changes how an incident can occur, such as a missed sensor alert, a flawed handover summary or a roster that left a unit short. It does not change the obligation.
- DetectIncident identified by staff, family, sensor alert or AI flag
- TriageQuality and clinical lead assess SIRS category and priority
- Notify ACQSCPriority 1 within 24 hours, priority 2 within 30 days
- InvestigateDocument AI role: model, output, who acted, override status
- RemediateCare plan changes, staff support, vendor escalation, model review
- Close-outFinal report, plus OAIC notification if a privacy breach occurred
If you cannot say which model produced an output, what inputs it had, who reviewed it and whether an override was used, your AI governance is not ready for production. See AI agent governance, data access and human override.
How do privacy and substitute decision-making apply?
Resident health information is sensitive information. AI use touches APP 1, 3, 5, 6, 8 and 11, and the OAIC's Notifiable Data Breaches scheme applies where a breach is likely to cause serious harm.
Consent is the aged care complication. Where a resident lacks capacity, consent sits with the substitute decision-maker under state law, for example the NSW Guardianship Act 1987, the Victorian Guardianship and Administration Act 2019 or the Queensland Powers of Attorney Act 1998. Family members are not automatically substitute decision-makers.
Four questions every provider should answer:
- What resident information does each AI tool process, and is it sensitive?
- Is the vendor processing data offshore, triggering APP 8?
- Where consent is needed and capacity is lacking, is the substitute decision-maker documented?
- What is the breach pathway across internal incident, OAIC and SIRS?
Running AI on your own infrastructure in Australia simplifies the APP 8 question. See our data sovereignty guide.
What control stack does aged care AI need?
- Pre-deploymentRisk and ethics reviewUse-case risk assessment, model risk file, bias testing, privacy impact assessment, vendor due diligence, board sign-off for clinical AI
- Pre-deploymentConsent and rights designConsent pathway per use case, substitute decision-maker workflow, restrictive practice review where monitoring is involved
- Pre-deploymentClinical governanceQuality and clinical governance committee approval, staff briefing, clinical risk register entry
- Live operationHuman approval and overrideClinician signs every clinical AI output; overrides logged; AI never final author of a clinical record
- Live operationMonitoring and auditCare minutes evidence verified, model performance logged, audit pack maintained
- Live operationWorker safeguardsPsychosocial risk review of AI rostering, Fair Work consultation, enterprise agreement compliance
- Incident responseSIRS, OAIC, internalSIRS triage within the 24-hour clock, OAIC notification where required, full AI traceability
- Incident responsePost-incident reviewModel recalibration, training updates, board reporting, close-out
See operating AI agents in production for the monitoring discipline beneath this.
Which regulator is your AI use case exposed to?
What does the AI use case do?
- It directly affects care delivery (clinical decision support, falls, medication, monitoring)Aged Care Act 2024, Strengthened Standards, ACQSC, SIRS, AHPRA. Treat as clinical AI: model risk file, clinician sign-off, board review.
- It monitors workers (rostering, location, idle time)Fair Work Act, WHS psychosocial risk, enterprise agreements. Consultation may be required.
- It processes resident information offshorePrivacy Act APP 8, OAIC and the NDB scheme. Vendor controls become primary evidence.
- It informs decisions for residents lacking capacityState guardianship law and the statement of rights. Substitute decision-maker consent pathway required.
- It is family or resident-facingConsumer law, accessibility, privacy. Scope-bound it and document escalation to staff.
- It generates reports for ACQSC, AN-ACC or My Aged CareAccuracy obligations and Commonwealth fraud control. Auditability of inputs and outputs is the central control.
Readiness checklist for the CEO and quality lead
If you cannot answer "yes, with evidence" to most of these, your AI use cases are not ready for production.
- Do we have an inventory of every AI tool across residential, home care and community services, including pilots?
- Is each use case risk-classified against the Strengthened Quality Standards?
- Does each clinical AI use case have a model risk file, including bias testing?
- Does a clinician sign the final record for every clinical AI output?
- Does each tool processing resident information have a consent pathway and APP 8 vendor controls?
- Is there a substitute decision-maker workflow distinct from family preference?
- Does our SIRS process cover AI-attributable incidents with full traceability?
- Do care minutes evidence systems hold up to audit, including AI rostering tools?
- Have rostering and monitoring tools been reviewed against Fair Work, WHS and enterprise agreements?
- Does the board or clinical governance committee review AI at least quarterly?
- Is there an exit plan for each tool, covering data return, deletion and continuity of care?
- Is an accountable role named and trained for each AI tool?
See also our AI security checklist and automation business case template.
How Solve8 can help
We help multi-site aged care providers map AI use cases to the regulatory stack and build automation that runs on your infrastructure in Australia, with a clinician or manager approving outputs. See our healthcare work and AI strategy service, or talk to us.
Verify obligations against current Department of Health, Disability and Ageing and ACQSC publications before relying on them. This article is general information, not legal or clinical advice.
