The Australian government issued a formal warning this week about AI scribe tools in medical practices. The health department raised concerns about data leaving the country, inadequate patient consent, and suppliers claiming privacy compliance they can’t actually back up.

Doctors are the headline. But if you’re a bookkeeper, physio, solicitor, or consultant recording client conversations with any AI tool, this warning is for you too.

The technology is the same. The privacy risks are the same. The gap in regulation is the same.

Here’s what you need to know before you hit record.

What the government actually said

The federal health department’s briefing documents, obtained by Guardian Australia under freedom of information laws, found that some AI scribe suppliers “may be unaware their cloud platforms send data outside Australia.” The department also noted that many providers market themselves as privacy-compliant “with limited transparency,” and that oversight of the tools falls across a patchwork of regulators with no clear lead agency.

The Office of the Australian Information Commissioner confirmed in May it has been “tracking closely” the rollout of AI scribe technology. Privacy Commissioner Carly Kind specifically flagged deficiencies in consent protocols.

That’s a government-wide alarm, not just a health sector one.

The small business parallel

Think about your own client conversations.

Your accountant uses Otter.ai to record your end-of-year review. Your physio runs Heidi through their iPad during your consult. Your business coach runs every session through Fireflies.

Each of those tools records, transcribes, and often stores audio and text. Where? On whose servers? Under what jurisdiction? For how long?

These are not hypothetical questions. They’re the exact questions the health department raised about tools already in use by 40% of Australian GPs.

If you’re using AI scribe tools in allied health or professional services, you’re in the same boat as the GP down the road. The Privacy Act applies to your business if turnover exceeds $3 million annually, and in some cases below that threshold where health information is involved.

Five questions to ask your AI tool vendor today

Before you record another client conversation, get written answers to these:

1. Where is data stored? Is it on Australian servers, or does it transit overseas? Some US-based tools automatically route data through American data centres, putting it under US law.

2. Who has access? Does the vendor’s own team review transcripts for quality control? Some do. Your clients may not know this.

3. How long is data retained? Thirty days? Forever? Check whether you can delete a specific recording on request, and whether deletion is permanent.

4. Is this covered by your privacy policy? If you haven’t updated your privacy policy to mention AI transcription tools, you likely don’t have valid consent under the Privacy Act.

5. What’s their breach protocol? If their system is compromised and client data leaks, how quickly do they notify you? Do they have a documented response plan?

If a vendor can’t answer these in plain English, that’s your answer.

What this means for tools like Lyrebird, Heidi, Otter.ai, and Fireflies

Lyrebird and Heidi are both Australian-built tools designed specifically for the healthcare context. They’ve thought harder about consent workflows and data residency than most. That doesn’t mean they’re without risk, but they’re starting from a better position than a generic US transcription tool marketed at businesses broadly.

Otter.ai and Fireflies are US companies. Their default data storage is overseas. Both offer enterprise plans with different compliance settings, but the standard subscription most small businesses use doesn’t come with those protections baked in.

This is worth knowing before you sign a client engagement letter and hand over their financial details to a bot.

The legal exposure isn’t theoretical

We’ve written about how AI tools can create legal risk for Australian businesses. A notifiable data breach involving client health or financial information triggers obligations to both the OAIC and affected clients, plus reputational damage that no PR exercise fixes.

Regulators are paying attention. Get your house in order before they come knocking at yours.

The bottom line

Recording client conversations with AI tools isn’t inherently wrong. It saves time, improves accuracy, and reduces admin load. But “it’s convenient” is not a privacy policy.

Check what your tool does with the data. Update your consent process. Make sure your clients actually know (not just via a buried clause) that their words are being processed by software.

The government said GPs need to do this. You do too.

📬 Get the SmallBizAI.au Weekly

Practical AI news for Australian small businesses — every week, free.

Sources: