All Resources

AI Rules for Healthcare Facilities Engineering

Most AI arriving in the plant room, CMMS and BMS sits outside the TGA. Here is where the regulatory lines sit for hospital engineers and facilities managers in 2026.

Health
Article
AI Rules for Healthcare Facilities Engineering

Written by Shane Scriven

Connect with us to learn more
Connect on LinkedIN
Email
Share
Artificial Intelligence
Insight
Risk Management

Most writing about AI in health is aimed at clinicians. It covers diagnostic algorithms, ambient scribes and decision support. Meanwhile AI is arriving in the plant room, the CMMS and the building management system, usually through a software update nobody asked for.

Chiller and air handling unit analytics now predict failures. Fault detection and diagnostics platforms tune BMS control loops. CMMS vendors offer generative AI that drafts work orders and summarises maintenance history. Security systems run computer vision. Asset tracking, occupancy sensing and smart ward platforms collect data about people as well as equipment.

Facilities and engineering teams buy, install, network and maintain these systems. This article sets out where the regulatory lines sit as at October 2026 and what they mean for hospital engineers, engineering services managers, maintenance managers and the consultants and contractors who work with them.

Most facilities AI sits outside the TGA

Line drawing of hospital rooftop plant with one chiller highlighted in green as flagged by analytics

The Therapeutic Goods Administration (TGA) regulates software as a medical device when its intended purpose meets the definition in section 41BD of the Therapeutic Goods Act 1989. The test looks at purposes such as diagnosis, monitoring, prediction, prognosis or treatment of a disease, injury or disability. The framework is technology agnostic. Whether the software uses AI does not matter. What it is for decides the question.

Software that predicts a chiller bearing failure has no therapeutic purpose. Neither does software that optimises supply air temperature or schedules preventive maintenance on a steriliser fleet. These tools sit outside the TGA framework.

The Therapeutic Goods (Excluded Goods) Determination 2018 goes further. Exclusion 14G removes software intended for "the administration or management of health processes or facilities". The Determination names operating theatre management, hospital bed management, schedules, business analytics, admissions, inventory and workflow. The exclusion holds only while the software is not intended for diagnosis, screening, monitoring, prediction, treatment or a decision about the treatment of a condition.

That condition is where facilities projects can cross the line.

Where the boundary sits

The table shows how the rules typically apply to tools facilities teams encounter. Status always turns on the intended purpose and the claims the supplier makes, so treat it as a starting point.

Facilities use case Typical regulatory status
Predictive maintenance on chillers, boilers, AHUs, lifts and generators Outside TGA scope
Fault detection and BMS optimisation, including theatre and isolation room pressure regimes Outside TGA scope; the Australasian Health Facility Guidelines, state engineering guidelines and infection prevention requirements govern it
Predictive maintenance on the medical equipment fleet using service history Outside TGA scope while it informs maintenance and does not change how the device treats or monitors a patient
Asset tracking for equipment, inventory and stores Excluded as facility administration
Bed management, patient flow and cleaning or porter dispatch Excluded as facility administration while it makes no clinical claim
Generative AI drafting work orders, safe work method statements or compliance reports Outside TGA scope; WHS, records and certification obligations still apply
Water system and cooling tower risk analytics Outside TGA scope; state public health legislation governs it
Bed exit, falls or wandering detection using sensors or cameras Likely a medical device because it monitors a patient; check for an ARTG entry
Nurse call that simply routes calls Likely excluded as communications or alerts
Nurse call or alarm software that prioritises or triages patients Moves towards regulation; the TGA lists prioritising, triaging and monitoring patients as medical device functions

The bottom rows deserve attention. Smart ward and smart building projects are often run by facilities or capital works teams. A sensor network installed for occupancy and energy can be extended to falls detection with a firmware update. Once the system monitors patients, it is a candidate medical device. A medical device must be included in the Australian Register of Therapeutic Goods (ARTG) before supply unless an exclusion or exemption applies.

Line drawing of a ward ceiling sensor whose green sensing cone crosses a boundary line to the patient bed below

Scope creep in building platforms

The TGA uses the term scope creep for software that gains a therapeutic function through an update. When that happens, the manufacturer must either withhold the update or take the product through pre market assessment. When a manufacturer learns its product is being used for a clinical purpose it was not designed for, the TGA calls that off label use and expects the manufacturer to prevent it or seek approval.

For facilities teams, scope creep is a configuration management problem. The system you commissioned is defined by its version, its enabled features and its stated purpose. A cloud platform can change all three without a site visit or a work order.

Two situations put the hospital itself in the frame. The first is an engineering or digital team that repurposes building data for a patient purpose, such as using occupancy sensors to flag patients at risk. The second is a hospital team that builds its own model for that purpose. In both cases the hospital may be acting as a manufacturer. Manufacturers carry obligations for quality management, software lifecycle control, risk management and clinical evidence. The TGA takes enquiries at digital.devices@tga.gov.au and offers pre submission meetings.

The infrastructure under clinical AI

Clinical AI is spreading through Australian hospitals. The TGA's own examples include radiology image analysis and cloud analytics that predict patient deterioration. The TGA publishes a list of AI enabled medical devices included in the ARTG.

Every one of these tools depends on facilities infrastructure. Communications rooms need power, cooling and fire protection. Networks and WAN links carry data to cloud services. Emergency power and UPS systems keep the servers running through an outage. A deterioration model is only as available as the comms room it runs from.

IEC 80001 addresses this directly. It sets out risk management for IT networks that incorporate medical devices, and it places that responsibility on the organisation operating the network, which is the hospital. The TGA lists the IEC 80001 series among the standards it regards as the state of the art for software based medical devices.

The practical consequence is a criticality question. Infrastructure that supports clinical AI belongs in the criticality assessment alongside medical gases, patient area electrical systems and theatre ventilation. Its maintenance regime and redundancy should reflect that.

Rules that do apply to facilities AI

Staying outside the TGA does not mean staying outside regulation. Several frameworks apply to facilities AI directly.

National policy. The Australian Government released its National AI Plan on 02/12/2025. It did not adopt the mandatory guardrails for high risk AI proposed in 2024. The Government chose to rely on existing law and sector regulators, supported by a new AI Safety Institute. The National AI Centre published its Guidance for AI Adoption on 21/10/2025. It replaced the Voluntary AI Safety Standard and condenses the earlier guardrails into six practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. The guidance is voluntary. It is a sound frame for any facilities AI project.

Critical infrastructure. Under the Security of Critical Infrastructure Act 2018, critical hospitals must provide information to the register of critical infrastructure assets and report cyber incidents. Incidents with a significant impact on availability must be reported within 12 hours, and other relevant incidents within 72 hours. Designated hospitals must also run a critical infrastructure risk management programme. Building management systems and other operational technology are part of the attack surface. AI platforms that connect site OT to vendor clouds widen it. IEC 62443 is the usual reference for securing industrial control systems.

Privacy. Cameras, asset tags worn by staff, occupancy sensors and access control systems all collect personal information. Patient data is health information, which is sensitive information under the Privacy Act 1988. From 10/12/2026, new Australian Privacy Principle 1.7 requires organisations to disclose in their privacy policy where a computer program makes, or substantially assists, decisions that could significantly affect individuals. It applies even with a human in the loop. Systems that assess contractor or staff performance, or control access, are worth checking against it.

Surveillance. State surveillance devices legislation and workplace surveillance laws, such as the Workplace Surveillance Act 2005 in New South Wales, apply to camera analytics and tracking of staff and contractors.

Work health and safety. AI that allocates work, sets workloads or monitors workers creates WHS risks. New South Wales passed the Work Health and Safety Amendment (Digital Work Systems) Act 2026, which received assent on 18/02/2026. It adds a duty concerning digital work systems and commences on a date to be proclaimed. Contractors working across jurisdictions should watch for similar moves elsewhere.

Compliance records. Generative AI can draft maintenance records, essential safety measure reports and inspection summaries. It cannot hold the competency the record certifies. Records under AS 1851 and state building regulations must still be completed and signed by the competent person who did or verified the work.

Where the TGA is heading

The TGA completed its review of software and AI regulation in 2025 after engaging more than 600 stakeholders. It concluded the framework is broadly fit for purpose. Software as a medical device is one of 12 priority areas in the TGA's compliance and enforcement plan for 2026 and 2027. The TGA reviewed 12 digital scribe suppliers in 2026 and found 8 had functions likely to meet the medical device definition. It is also consulting on AI disclosure requirements and on showing ARTG numbers in software advertising.

For facilities teams, the signal is that suppliers will face harder questions about intended purpose and feature creep. Procurement and contract terms should anticipate that.

Six practices for facilities and engineering teams

1. Inventory the AI you already run. List the AI features in your CMMS, BMS, FDD platform, security system, asset tracking and smart building software. Record the supplier's stated purpose for each and flag anything that touches patient data or patient monitoring.

2. Make intended purpose a procurement gate. Ask suppliers in writing what the software is for. Where a feature monitors, predicts or prioritises patients, ask for the ARTG entry or the exclusion relied on. Check that clinical users plan to use it the way the supplier describes.

3. Control change. Contracts should require advance notice of updates that add features or change purpose. Treat a significant update as a recommissioning event. Decide who in engineering signs it off before it goes live.

4. Keep a competent person in the loop. AI can draft work orders, root cause summaries and compliance reports. A qualified person must review and sign anything that certifies safety, compliance or completion of work.

5. Rate the infrastructure under clinical AI. Include comms rooms, network paths, cooling and emergency power supporting clinical AI in your criticality assessment. Apply IEC 80001 risk management where building and clinical networks meet. Segment OT networks and control vendor remote access.

6. Take a seat on AI governance. Many hospitals now run AI governance committees led by clinical and digital health teams. Facilities engineering brings lifecycle discipline and knowledge of the systems those tools depend on. Ask to be a member.

Questions to ask before switching on an AI feature

  • What is the supplier's stated purpose for this feature, and is it written down?
  • Does any part of it monitor, predict, prioritise or make recommendations about patients?
  • If so, is it on the ARTG, or which exclusion applies?
  • What personal information does it collect about patients, staff or contractors, and does our privacy policy cover the decisions it supports?
  • Does it connect our operational technology to a vendor cloud, and how is that link secured?
  • Who signs off on outputs that become compliance records?
  • What happens to clinical services if the infrastructure it runs on fails?

Talk to us

SAS-AM works with hospital engineering and facilities teams on asset management, criticality and AI governance. If you are working out where AI sits in your engineering systems, get in touch.

Sources

Health
Article
Line drawing cutaway of a hospital with one green line running from the comms room up the riser to a ward bed

AI Rules for Healthcare Facilities Engineering

Most AI arriving in the plant room, CMMS and BMS sits outside the TGA. Here is where the regulatory lines sit for hospital engineers and facilities managers in 2026.
Health
Article

Unlocking Healthcare Asset Management: The Power of AI and ML

Discover how AI and machine learning revolutionise healthcare asset management, transforming unstructured data into actionable insights for improved patient care.