It is Tuesday, 8:03 am. Your front desk walks in with coffee and finds the schedule already sorted. A cancellation came in overnight. The waitlist patient was contacted, confirmed, and briefed on what to bring. Two overdue forms were chased and filed. Nobody on your team touched any of it.
Stop for a moment, because three decisions were made overnight while your practice was asleep. Who gets the slot? What the message says. When it is sent, each used to be somebody’s call and was shaped by things never written down. Mrs Nguyen cannot do mornings. That patient never answers texts. A good receptionist carries dozens of small facts like these, and none live in the practice management system.
By most measures, it is a good morning. The book is full, the patient is happy, and your team has time to greet people properly. That is the risk. A good morning is easy to get used to, and the more comfortable we become with mornings that go well, the less we ask who actually decided what.
The AI in that story did not just complete a task. It decided the task needed doing. Nobody was consulted or approved it. The question is no longer whether AI will act on its own because it already does. The question is how much you trust it when it does, and this article is about answering that one decision at a time.
From Tool to Teammate
For the last few years, AI in most practices has meant something you ask. You type a question, you get an answer, and then it stops. It is a very clever calculator, and you remain in charge of every step.
Agentic AI changes that arrangement in three ways. It can act inside your systems, not just talk about them. It carries on across many steps without waiting to be told. Moreover, it decides what to do next. Ask the older kind for a list of overdue recalls, and it gives you the list. Ask the newer kind, and it finds the patients, drafts personalised messages, sends them, reads replies, books appointments, and updates the record. You asked for a list. You got a campaign.
This is where the word teammate starts to strain. An agent acts like a member of your team, but you cannot hold it responsible like one. The accountability lands somewhere else, and usually it lands on you.
What this Looks Like in your Practice
None of this is far off. Scheduling tools already predict cancellations and fill the gaps without being asked. Recall tools find overdue patients and draft messages that read as personal. Follow-up tools send check-ins and review requests on their own. Each used to depend on a person remembering to do it, which is why they are so appealing to automate.
There is a hidden cost that is easy to miss. The person who sent the recall also knew the patient. They knew about the unwell partner and what was said at the last visit. Take that person out of the loop, and you remove a checkpoint never written down anywhere.
Consider a post-extraction check-in sent automatically at 9 pm. At 10 pm, the patient replies that the bleeding has not stopped. Who reads that message? The task was automated. The responsibility was not. That is where the conversation stops being about whether the technology can do something and starts being about which decisions you are willing to hand over and which you want a person watching. It is a trust question, not a technology question.
What this Looks Like in your Practice
Not every decision deserves the same level of oversight. A reminder SMS and a treatment plan message are different, and treating them the same means you either wrap simple ones in so much checking that the technology is pointless or let serious ones run with none. I sort decisions into four tiers, from fully autonomous to hands-off, with one thread running through all: human judgement always wins.
Three questions help place any decision on the spectrum: What happens if it is wrong? Can it be undone? Would we notice? Keep these in mind as we go through the tiers.
Tier 1: Full Auto
At the first tier, the agent acts, and nobody reviews. Typical examples include appointment reminders, recall messages, and waitlist notifications. The test is simple. Imagine it ran a hundred times while you were away. Would you be comfortable never seeing any of them? If the stakes are low, a mistake is easy to undo, and an error would be obvious, the answer is probably yes.
One caution applies here. No review does not mean no record. Autonomy without a record is hope, not trust.
Tier 2: On the Loop
At the second tier, the agent acts and a person monitors, ready to step in. Schedule optimisation, waitlist prioritisation, and follow-up sequences sit here. The test has two parts, both matter: Can you see what it did, and can you stop or undo it quickly?
This tier fails predictably when nobody opens the dashboard. Then you have Tier 1 with extra steps and a false sense of comfort. The fix is a named owner, not a committee, and a clear definition of what unusual looks like, such as the same patient being contacted three times in a week, with an alert when it happens.
Tier 3: In the Loop
At the third tier, the agent prepares, and a person approves before anything happens. Treatment plan messages, financial arrangements, and complaint replies belong here, along with anything where a small mistake costs a patient relationship, not just a rebooking. The test is whether you would put your own name to it. If a human clicks approve, the human owns the outcome.
The trap is approval fatigue. Someone approving eighty drafts before lunch is not reviewing; they are clicking, creating Tier 1 with a false sense of security. Design approval so a person can genuinely check it. Show what the agent changed, what it was unsure about, and what it based the draft on. If the volume is too high to review properly, narrow what the agent handles.
Tier 4: Hands Off
The fourth tier is the line in the sand. AI supports, and the human decides. Diagnosis, treatment decisions and patient consent are never delegated, and that is not only my view. Ahpra and the National Boards have been clear that practitioners remain accountable when they use AI (Ahpra, 2024). You are expected to apply your own professional judgement to what it produces, and to be open with patients about when AI is part of their care, including seeking their consent where appropriate.
Hands Off does not mean the AI is absent. A tool can highlight a finding on a radiograph, draft the consent form and pull together a patient’s history. What it cannot do is hold the consent conversation, and it cannot be the name on the decision. The decision is yours, and your record should show that.
The last point about the spectrum is one people often miss. The tiers are not permanent. A decision can start at Tier 3 and move to Tier 2 as you build evidence, which is healthy. The dangerous move is drift. A setting changes in an update, a vendor adds a feature, someone switches on auto-approve to clear a backlog, and a Tier 3 decision quietly becomes Tier 1. Nobody decided that. It just happened. Moving up the spectrum should always be a decision with a name next to it.
Try it on Five Decisions
Before you read my answers, place each of these on the spectrum using the three questions.
- Sending a reminder the day before an appointment.
- Offering a cancelled slot to the waitlist.
- Replying to a patient complaint.
- Sending a treatment cost estimate.
- Deciding what a radiograph shows.
The reminder is Tier 1. The stakes are low; it is easy to undo, and a mistake is obvious.
The cancelled slot is where some will disagree. You may say Tier 1. I say Tier 2 because the agent chooses between patients, and someone should see whose turn it was and why.
The complaint reply is at least Tier 3. The agent can draft it, but a person approves it because the cost of getting the tone wrong is high and an email cannot be unsent. The cost estimate is also Tier 3. It costs money, is a commitment, and needs someone willing to stand behind the number.
The radiograph is Tier 4 for the decision itself. The AI can flag. The clinician decides.
Suppose your answers differ from mine; good. That is exactly the conversation to have with your team, and there is rarely one right answer. There is a wrong process, though, and it is never having the conversation at all.
What Goes Wrong
Trust gets abused, and in healthcare it already has. Five failures show up again and again, and they are easier to spot once they have names.
- Injection. Someone slips instructions into content the AI reads, such as an email, a referral letter or a form a patient fills in. The AI cannot always tell the difference between information and an order.
- Agent sprawl. You start with one agent and a year later you have five, from different vendors, each with its own access to patient data, and nobody holds a list.
- No clear owner. When something fails, the practice manager, the software vendor and the AI vendor each assume it is someone else’s problem.
- Shadow AI. Tools your team adopted on their own, with good intentions, that you have never heard of.
- Governance gaps. No policy, no log and no review. The thing works, so nobody asks how.
You can see how these stack up. A receptionist connects a free tool to the shared inbox to save time. It becomes one of five agents the practice has, nobody owns it, and it reads every email that arrives. That is shadow AI, sprawl, no owner, and a governance gap in a single afternoon, and everyone involved was trying to help. This is why a ban rarely works. People will find a way to be helpful, so give them an approved route.
The numbers suggest most organisations are moving faster than their oversight. In a May 2025 survey of 353 respondents, SailPoint found that 80% of companies said their AI agents took unintended actions, such as accessing systems they shouldn’t or sharing sensitive data (SailPoint, 2025). Deloitte’s 2026 survey of 3,235 business and IT leaders found only 21% of companies planning to deploy agentic AI had a mature model for agent governance (Deloitte, 2026). That gap is where things go wrong.
Injection is not just a theory either. In March 2026, security firm Mindgard reported on its tests of Doctronic, the AI health tool behind a Utah pilot that lets AI renew prescriptions. The researchers invented a regulatory authority and a fake official bulletin, presented it to the chatbot, and got it to treat a dose of OxyContin roughly triple the normal baseline as standard guidance (Mindgard, 2026).
To be precise, this was a security test, not a patient, and it ran on the company’s public chatbot, not the live system Utah operates in its regulatory sandbox (Sabin, 2026). However, look at the attack. Nobody wrote malicious code. They wrote a convincing paragraph, and the AI believed it. If an agent in your practice reads incoming emails, referral letters, or patient forms, each is a place someone could insert an instruction. Most of the time it will be harmless. You only need it to be wrong once.
Who is Responsible?
So let us bring this back to a Tuesday morning in your practice, and away from the headlines. The wrong patient booked into a complex procedure slot by mistake. A recall message sent to a patient who has passed away. A Medicare or DVA record mishandled by an automated process. Each is a small failure on its own, and each becomes a conversation with a distressed patient or their family.
When something like that happens, who is responsible? The agent, the vendor, or you? The agent has no legal standing. It cannot be sued, disciplined, or hold a registration. The vendor is responsible for whatever its contract says, usually less than people expect. In practice, accountability comes back to the practice and, for anything clinical, to the registered practitioner. Read your contracts with that in mind. What does the vendor actually accept, and what do they say is yours?
I am not a lawyer, and this is general information, not legal advice, so seek advice on your own situation. However, four things are worth every practice knowing.
- The Privacy Act 1988 and the Australian Privacy Principles apply to AI use that involves personal information. A dental practice is a health service provider, so the Act applies regardless of how small you are. There is no carve-out for using AI.
- Since 10 June 2025, a statutory tort for serious invasions of privacy has allowed individuals to sue directly. Courts can award damages, grant an injunction or order an apology (OAIC 2025). Separately, penalties for serious or repeated interference with privacy can reach $50 million or more.
- From 10 December 2026, privacy policies must describe the kinds of decisions made, or substantially assisted, by automated programs where those decisions could significantly affect a person, and the kinds of personal information those programs use (OAIC 2026).
- Ahpra’s guidance is that you remain accountable, apply your own judgement and are open with patients about AI.
The third point has a date, only two months away. If an agent decides who is offered a cancelled slot, who is recalled first, or who is chased for a payment, ask your adviser whether that needs disclosing. A good place to start this week is with three questions. Does any agent in our practice make or substantially assist decisions that could significantly affect a patient? What personal information does it use? Moreover, is that described in our privacy policy?
Your First 90 days
None of this means you should not do it. It means doing it deliberately, and it does not need a transformation program. It needs one task watched carefully. Here is the shape of the first three months.
Month one, look. Buy nothing. Make a list of the tasks in your practice that someone has to remember to do, and place each one on the spectrum using the three questions.
Month two, shadow. Choose one Tier 1 task and run it in shadow mode. The agent proposes, a person acts, and you compare the results.
Month three, switch on. Turn it on, check the audit trail every week and hold your first review.
Two habits make the plan work. Pick a night last week. If you cannot find out within two minutes what the agent did and why, it is not ready. Write down what the agent may touch, the same way you would for a new staff member’s login. It can read the appointment book. It cannot edit clinical notes or change payment details. The narrower the access, the smaller the worst day.
Then put a review in the diary every 90 days. Look at what the agent has been doing, which tier each decision now sits in, and whether anything has drifted after an update. Trust is not something you grant once. You keep earning it, from both sides.
Back to Tuesday
Go back to that 8:03 am morning. The practice did not get there by accident, and it didn’t get there by handing everything over and hoping for the best. Somebody decided, on purpose, that this particular decision belonged at Tier 1. The cost of being wrong was low. They could see what the agent had done. Someone owned it, and someone was watching.
Moreover, remember the patient who replied at 10 pm about the bleeding? That practice made a decision too. It decided where those replies go, who sees them and how fast. No sales demonstration will ever show you that part of an agent, and it matters most.
So which of your decisions have you already handed over, and did anyone choose to? Ask what it would cost if it were wrong, whether you could undo it and whether you would notice. Ask it of every task you hand to an AI, and start on Monday.
Autonomy is not the goal. Deliberate trust is.
References
- Australian Health Practitioner Regulation Agency (Ahpra) and National Boards (2024) Meeting your professional obligations when using Artificial Intelligence in healthcare, Ahpra, page reviewed 22 August 2024, accessed 18 October 2026, https://www.ahpra.gov.au/Resources/Artificial-Intelligence-in-healthcare.aspx
- Deloitte (2026) From ambition to activation: organizations stand at the untapped edge of AI’s potential, reveals Deloitte survey, media release, 21 January 2026, accessed 18 October 2026, https://www.deloitte.com/us/en/about/press-room/state-of-ai-report-2026.html
- Mindgard (Nightingale J) (2026) Doctronic is now accepting new patients (and unsafe instructions), Mindgard blog, 3 March 2026, accessed 18 October 2026, https://mindgard.ai/blog/doctronic-is-now-accepting-new-patients-and-unsafe-instructions
- Office of the Australian Information Commissioner (OAIC) (2025) Statutory tort for serious invasions of privacy, OAIC, last updated 4 July 2025, accessed 18 October 2026, https://www.oaic.gov.au/privacy/your-privacy-rights/more-privacy-rights/statutory-tort-for-serious-invasions-of-privacy
- Office of the Australian Information Commissioner (OAIC) (2026) Chapter 1: APP 1 Open and transparent management of personal information, Australian Privacy Principles guidelines, last updated 30 September 2026, accessed 18 October 2026, https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-1-app-1-open-and-transparent-management-of-personal-information
- Sabin S (2026) ‘Exclusive: Researchers trick a bot that prescribes meds’, Axios, March 2026, accessed 18 October 2026, https://www.axios.com/2026/03/04/doctronic-utah-prescriptions-ai-jailbreak
- SailPoint (2025) SailPoint research highlights rapid AI agent adoption, driving urgent need for evolved security, media release, 28 May 2025, accessed 18 October 2026, https://www.sailpoint.com/press-releases/sailpoint-ai-agent-adoption-report
About the Author
Sean Perera
Chief Technology Officer
