WA Health Artificial Intelligence Policy MP 0193/25 and Standard 8.5: Principle 5, reliability and safety: before implementation the AI system is trained on fit-for-purpose data, tested with local, ethical, de-identified or synthetic data, piloted where residual risk is moderate or higher, evaluated against high quality evidence, used under appropriate conditions by trained people and accompanied by use-case guidance; in operation documented monitoring and evaluation plans verify acceptance criteria and detect drift, incorrect or biased results, with independent audits where risk warrants and clear reporting avenues; complex or high-risk implementations use an established AI risk framework (NIST AI RMF 1.0 and AI 600-1, or AS ISO/IEC 23894:2023); in health care settings suitable clinicians are key stakeholders, deployment stays under the responsible Clinical Executive, the clinician is the final decision-maker, users hold the qualifications and work within scope, the algorithms pass rigorous multi-modal clinical validation covering discrimination and calibration accuracy with internal and external testing, and an auditable clinical safety plan sets audit methods, frequency, oversight, patient safety event notification and active governance monitoring; the Safety and Quality area is consulted and the ACSQHC Clinical AI Usage Guidance applied; high-risk or statewide technologies go through the Health Technology Governance Policy; software as a medical device is confirmed as ARTG-included or exempt with the sponsor; and an ICT Patient Safety Risk Assessment captures hazards such as misunderstood outputs, evolving behaviour, over-reliance, unsafe or biased algorithms, unrepresentative data, hacking, inappropriate context, hallucination, absent validation and erosion of the clinician-consumer relationship

What does 8.5 require?

Prior to implementation WA health entities must ensure the AI system is trained on fit-for-purpose data, tested with local, ethical and de-identified or synthetic data, piloted to verify correct operation where residual risk is moderate or higher, evaluated using high quality standards of evidence, used under appropriate conditions by appropriately trained or qualified people, and accompanied by application-specific guidance or training conveying the approved use cases and any risks, limitations and mitigations. Throughout operation there must be documented monitoring and evaluation plans that verify the system continues to meet its acceptance criteria and detect performance shifts and incorrect or biased results, regular independent audits where the risk warrants a comprehensive audit plan, and clear avenues for staff to report risks and notify issues and incidents; complex or high-risk implementations refer to an established AI risk management framework such as the NIST AI Risk Management Framework 1.0 and its generative AI profile AI 600-1 or AS ISO/IEC 23894:2023. Where AI is used in health care settings, suitable clinicians are involved as key stakeholders throughout design, implementation and oversight; the system stays deployed under the supervision of the responsible Clinical Executive; the clinician is the final decision-maker carrying the decision and its assessed risk; staff hold the qualifications and credentials to use the technology within their scope of clinical practice; the algorithms have undergone rigorous, multi-modal clinical validation before deployment, including evaluation of discrimination accuracy and calibration accuracy with internal and external testing; and an auditable plan sets out how clinical safety is assessed and managed on an ongoing basis, with routine audit methods, frequency and oversight responsibility, processes for notifying patient safety concerns and events, and a governance body actively monitoring clinical safety. Applicants consult their Safety and Quality area and comply with all applicable standards, regulations, codes, guidelines and scopes of practice including the ACSQHC Clinical AI Usage Guidance under the Clinical Governance, Safety and Quality Policy Framework; new or significantly extended technologies that are high risk to patient safety or have statewide planning implications go through MP 0072/17 Health Technology Governance Policy; AI intended for a medical purpose may be software as a medical device requiring Therapeutic Goods Administration approval, so the sponsor confirms that the product is included in the Australian Register of Therapeutic Goods or is exempt; and where the system could affect patients directly or indirectly an ICT Patient Safety Risk Assessment and Report captures and manages hazards such as staff misunderstanding output limitations, unawareness that outputs evolve, over-reliance on AI as decision-maker rather than support, unsafe or biased algorithms, inadequate or unrepresentative or dated training data, vulnerability to hacking, use in an inappropriate setting that skews responses, hallucinated responses, absence of ongoing validation, monitoring or governance, and replacement of the clinician and consumer relationship.