AI Regulation in Pharmacy: The New Rules and What Is Coming

This article is general information, not legal advice. AI regulation in Australia is developing quickly, and some measures below are proposed rather than in force. For decisions about your pharmacy, get advice specific to your situation.

AI regulation sounds like a problem for big technology companies, not a community pharmacy. But because pharmacy sits in health, a regulated and trust-sensitive field, the rules matter here sooner than in most industries. The reassuring part is that the direction is clear, and choosing the right kind of AI keeps you on the safe side of it.

This guide explains where AI regulation in Australia stands, the two rulebooks most relevant to a pharmacy, and what they mean when you choose an AI tool.

Australia is moving to regulate AI

Australia does not yet have a single, dedicated AI law. Existing laws, including privacy, consumer, discrimination, and sector-specific rules, still apply to AI uses.

In October 2025, the National AI Centre introduced six Essential AI Practices. The voluntary guidance evolved the earlier Voluntary AI Safety Standard and is designed to help organisations adopt AI safely.

For a pharmacy, two rulebooks matter most: the health-specific rules from the TGA, and the general AI rules taking shape for high-risk settings.

When is pharmacy software a medical device?

The Therapeutic Goods Administration regulates software-based medical devices, under rules that took effect in 2021. The key question is what the software does.

Software intended to perform a clinical or diagnostic function, such as recommending treatment, may be regulated as a medical device. A strictly administrative tool has a different intended purpose, but the exact product and use still need assessment.

The line to watch is clinical advice. An AI that starts giving patients clinical recommendations could cross into medical-device territory, which is a strong reason to choose tools that escalate clinical questions to a pharmacist rather than answer them.

The six Essential AI Practices

The broader guidance is practical rather than pharmacy-specific. Its six practices cover accountability, risk assessment, data governance, testing and monitoring, human control, and transparency.

These practices are voluntary, but they provide a useful implementation checklist. They do not replace the Privacy Act, TGA requirements, professional obligations, or advice for a pharmacy’s specific use case.

What this means when choosing an AI receptionist

You do not need to become a regulatory expert to make a good choice. A few principles keep you aligned with where the rules are heading:

Favour tools that keep clinical judgement with the pharmacist and escalate anything clinical, so you stay clearly on the administrative side of the medical-device line. Prefer providers who are transparent about how the system works and what data it uses. And look for Australian hosting and clear accountability, which support both privacy and the emerging AI standards.

How Krepko approaches this

Krepko uses Kat as a bounded example of administrative request ownership. In a defined pilot, Kat can capture a call or request and preserve its relevant context. It can flag consent or identity steps, create a ticket, and assign follow-up to the pharmacy team.

This example does not determine Kat’s regulatory classification or establish legal compliance, medical-device status, or clinical safety. The pharmacy must still assess the intended use, data flows and controls for its specific case.

Regulation will keep evolving, and the responsibility to comply sits with your pharmacy. Choose a system scoped to approved work, keep a person accountable, and verify the provider’s complete data flow. For patient-data obligations specifically, see our guide to AI, privacy and compliance for pharmacies.