Closing the App Loophole: Australia's TGA Rethinks Digital Mental Health Regulation

Sam: Imagine finding out that the mental health chatbot recommending your therapy steps has bypassed all independent safety checks just by pasting a link to some clinical guidelines. That is exactly the loophole the Australian government is looking at closing right now.

Maya: It is a massive shift for anyone building or buying these tools. Today we are unpacking a document called Consultation: Reviewing the exclusion for certain digital mental health tools. It was published by the Therapeutic Goods Administration, or TGA, in October 2026.

Sam: Before we dive in, a quick reminder that our voices are AI-generated, and this is a summary of a public document. But Maya, you have been tracking software as a medical device for a long time. Tell me why this document exists.

Maya: It exists because the technology has completely outpaced the rules. Back in 2021, the TGA decided to exclude a specific subset of digital mental health tools from active regulation. They did this to avoid duplicating requirements that were expected to come out in the new National Safety and Quality Digital Mental Health Standards.

Sam: And at the time, these tools were not as common, right? The document notes they were considered very low risk back then.

Maya: Exactly. But here is the catch. Those National Digital Mental Health Standards, published by the Australian Commission on Safety and Quality in Health Care, only apply to service providers through voluntary accreditation. They do not cover product-specific requirements for individual tools or apps.

Sam: So if a developer makes an app and sells it directly to a consumer, those provider standards do not necessarily cover the safety of the software itself.

Maya: Right. Which leads us to the 2024 review. The TGA looked at the regulation of medical software and artificial intelligence and realised this exclusion might no longer be appropriate. The tools are getting too complex.

Sam: So they spent 2025 and 2026 doing a deep dive. The document mentions they surveyed digital mental health tool users, software developers, and providers. They did market research on consumer-facing health software.

Maya: They also held workshops with a digital mental health tool expert group comprising more than 20 experts from the mental health sector, academia, and government. And they met with the Technical Reference Group on Software as a Medical Device and AI.

Sam: Let us step back and define what a digital mental health tool actually is according to the TGA. The document defines them as software products, like apps and websites, that offer assessment, therapy, or self-management strategies to support mental health care.

Maya: They can be used for a really wide range of conditions. The document specifically lists depression, anxiety, eating disorders, addiction, post-traumatic stress disorder, and sleep-related conditions. These tools can be recommended by health professionals or accessed directly by consumers without any oversight.

Sam: They give some real-world examples too. Things like apps providing cognitive behavioural therapy to help manage anxiety symptoms, online platforms using questionnaires to screen for depression and recommend next steps based on the result, or chatbots providing personalised interventions to people experiencing challenges.

Maya: Here is the critical part for clinicians and builders. A digital mental health tool is legally a medical device if the developer intends for it to screen for, diagnose, prevent, monitor, predict, treat, or support the management of a mental health condition. That is under the Therapeutic Goods Act 1989.

Sam: So by definition, almost all of these things are medical devices. But then we have this carve-out from 2021. How exactly does a company get out of being regulated under the current rules?

Maya: The exclusion relies on 3 criteria. First, the tool must be based on established clinical practice guidelines. Second, those guidelines must be referenced and displayed in the software. And third, it has to be done in a manner that is reviewable by the user.

Sam: Wait, really? So if I build a complex AI chatbot for people experiencing acute anxiety, I just need to base it on clinical guidelines, link to those guidelines in the app, and let the user click the link? And then the TGA does not regulate it?

Maya: That is exactly the problem the TGA is calling out. The document gives an example of how it is supposed to work, like a website offering self-guided behavioural therapy for anxiety that follows guidelines published by the Royal Australian and New Zealand College of Psychiatrists.

Sam: Which sounds reasonable for a static website. But the TGA admits these criteria completely ignore the intended purpose of the product, the user groups, the types of outputs, the clinical claims being made, and the consequences if the tool fails to work properly.

Maya: And that failure can cause real harm. The document warns that these tools might give a person the wrong assessment, provide unsuitable advice, miss signs that urgent help is needed, or delay someone from getting proper care or treatment they need. Under the exclusion, none of these products are subject to TGA minimum requirements for safety and performance.

Sam: The other massive issue mentioned is that established clinical guidelines are written for health professionals, not everyday consumers. A user might click the link, see a massive medical document, and just assume the app is safe, effective, and completely up to date.

Maya: The TGA explicitly notes that consumers generally expect that products have been independently checked to ensure they are safe and effective. But excluded products are not subject to the TGA oversight, so this expectation is simply not being met for everyday users.

Sam: Furthermore, companies supplying excluded products do not have to collect and evaluate complaints. They are not required to investigate safety concerns or report adverse events, which are side effects, to the TGA.

Maya: There is a complete blind spot when it comes to detecting real-world risks as they emerge. If a chatbot starts giving harmful advice to vulnerable users, the developer does not have a legal obligation under the therapeutic goods framework to report those side effects to the regulator.

Sam: That is a glaring gap, especially now that these tools are incorporating artificial intelligence and personalised recommendations. Overall, the TGA says the exclusion may no longer be proportionate to the range and risk profile of tools available now and in the future.

Maya: Because of all this, the consultation paper puts forward 3 options for regulatory change. Let us walk through them. Option 1 is no change to the digital mental health tool exclusion. It maintains the status quo.

Sam: The main benefit there is that sponsors and manufacturers of tools that meet the exclusion criteria will have no new regulatory obligations. Access to these tools is unlikely to be impacted, which is great for current users.

Maya: But the document points out that this option fails to address the reported safety issues. Products with potentially higher risk profiles would continue to fall outside regulatory oversight. Some stakeholders have raised concerns that continuing to exclude certain tools may not protect users enough from harm.

Sam: And Australia's regulatory approach would remain out of step with overseas approaches. For Option 1, the TGA is asking stakeholders if they support retaining the current exclusion without change, whether the current exclusion appropriately determines which tools do not require oversight, and what unintended consequences they foresee.

Maya: Then we have Option 2, which is removing the exclusion entirely. If they do this, products that currently meet the criteria would generally become regulated medical devices when they meet that definition.

Sam: So sponsors and manufacturers would need to meet regulatory requirements, such as Australian Register of Therapeutic Goods inclusion, known as ARTG, and collecting and reporting adverse events, to keep supplying these products in the Australian market.

Maya: The potential benefits here are significant. Greater safety oversight, risk-based regulation where higher-risk products are subject to greater oversight, greater transparency with information publicly available in the ARTG, and meeting consumer expectations.

Sam: It would also lead to a better understanding of emerging risks through the collection of complaints, greater alignment with overseas regulators, and simpler software regulation overall. It removes a lot of the ambiguity.

Maya: However, this option imposes administrative and cost burden. The TGA acknowledges sponsors might experience design and development difficulties with ensuring their product meets the rules. This could lead to some tools being removed from supply entirely by their sponsors.

Sam: Which might negatively impact users already relying on these tools. Not having this exclusion available could also risk some sponsors choosing not to bring a product to market due to the cost and potential difficulties associated with regulatory compliance.

Maya: For Option 2, the consultation questions ask about the expected regulatory burden or cost impact, and specifically asks sponsors of tools meeting the current exclusion criteria if they would expect to stop supplying their product if this option were implemented.

Sam: This leads us to Option 3, which is modifying the exclusion criteria. The objective here would be to keep an exclusion for very low-risk tools, while bringing higher-risk products within regulatory oversight.

Maya: The established clinical practice guidelines criteria could be replaced by other factors, like focusing on intended purpose or functionality. This could better clarify which tools should not be regulated, leaving the truly simple stuff out of the framework.

Sam: The document looks at how other countries do this, which is fascinating for anyone building for a global market. The UK Medicines and Healthcare products Regulatory Agency, or MHRA, does not regulate low-functionality tools.

Maya: And the TGA notes that low functionality means very simple computational tasks, like storing or communicating data with no change or prioritisation, basically replacing pen and paper. An example is a digital diary that records depression symptoms and displays them graphically without interpretation.

Sam: Quick note before we carry on. This spot is open for a sponsor. If your company builds or sells AI for healthcare and wants to reach the clinicians, health-system leaders and industry teams who listen to this show, the link to our sponsorship page is in the show notes.

Maya: And now, back to the document.

Sam: But if an app uses complex algorithms or AI to summarise patient information and report probabilities of mental health conditions, the UK regulates it as a medical device with a medical purpose and high functionality.

Maya: The United States Food and Drug Administration takes a slightly different angle. The FDA focuses on carving out general wellness products. The TGA gives the example of software providing daily motivational tips to reduce stress and promote a positive mental outlook.

Sam: The potential benefits of Option 3 are similar to Option 2, centred on risk-based regulation and greater safety. Depending on the specific approach taken, it might align regulation more closely with overseas jurisdictions, which brings regulatory simplicity and efficiency.

Maya: The main challenge, as the document points out, is developing criteria that are risk-based and sufficiently clear to distinguish low-risk products from those needing regulation. If the criteria are open to different interpretations, it could create ongoing uncertainty for sponsors.

Sam: And any new criteria would need to be adaptable enough for future changes in technology. For Option 3, the TGA asks what characteristics should be considered when determining if a tool is low-risk enough to remain excluded from regulation.

Maya: They list examples like intended purpose, functionality, target user group, clinical claims, and the use of AI or personalised recommendations. They also want to know how likely the tool is to be used by people for whom it isn't intended.

Sam: They also ask about deterioration identification and escalation to appropriate care. That escalation piece is crucial in mental health. If someone using an anxiety management app suddenly displays signs of a crisis, how does the software handle it? Under the current exclusion, there is no mandate to test that.

Maya: To manage the impact of either Option 2 or Option 3, the TGA is proposing transition arrangements. If adopted, a 2-year transition period could be offered to sponsors of tools that meet the current exclusion criteria.

Sam: During this 2-year period, sponsors would need to take steps to comply with the new requirements, understand the rules, update processes, obtain certification if needed, and integrate regulatory obligations into their workflows and apply for ARTG inclusion.

Maya: But they cannot just stay quiet during that time. The proposal requires sponsors to notify the TGA of their intention to transition a tool that is already in supply. This notification would provide visibility to the TGA, supporting improved stakeholder communication, implementation planning, and compliance.

Sam: Once the transition period is over, any tool subject to the new rules that has not complied would no longer be allowed to be supplied in Australia. It is a hard deadline. They are asking stakeholders if a 2-year transition period is appropriate, and if the notification requirement is supported.

Maya: It is also worth noting that the digital mental health tool exclusion is not the only one that exists. Appendix A outlines other software exclusions that might apply, which really helps illustrate how the TGA thinks about risk and how developers can navigate the landscape.

Sam: Yes, for instance, there is an exclusion for behavioural change and coaching. This applies to software intended by the manufacturer to be used by a consumer to improve general health or wellness by coaching or encouraging behavioural change regarding personal or environmental factors.

Maya: Things like weight, exercise, sun exposure, or dietary intake. But crucially, to get this exclusion, it cannot be intended to be used in clinical practice, or to provide information requiring a health professional's interpretation, or for diagnosis, prognosis, or making treatment decisions.

Sam: The example they give is an app for learning mindfulness meditation that includes daily reminders to complete an exercise to improve general wellness. That is excluded because it does not cross the line into clinical treatment.

Maya: Then there is the patient surveys exclusion. This is for software intended to be used as a patient reported outcome measures questionnaire or patient survey. Again, it cannot be intended to diagnose, screen for, monitor, predict, alleviate, or treat a condition.

Sam: So a webpage that digitises a survey used to assess the severity of depression and emails the results to a health professional without interpretation or making recommendations is excluded. It is just acting as a digital courier.

Maya: There are also exclusions for general health and wellness tools that measure physical parameters through non-invasive means, like sleep or heart rate, and health self-management tools for existing diseases that are not serious.

Sam: The dividing line always comes back to clinical claims and the seriousness of the condition. An app helping a user self-manage mild stress through breathing exercises, mindfulness activities and wellbeing tracking, without providing diagnosis or treatment recommendations, is excluded. But an app making recommendations for treating clinical depression is not.

Maya: If a digital mental health tool does become regulated, the level of oversight is scaled according to the device classification. Appendix C breaks this down into 4 classes: Class I, Class IIa, Class IIb, and Class III.

Sam: Device classification is based on different factors that help determine the level of risk posed by the tool. For example, intended purpose, the seriousness of the conditions the software is intended for, risk to public health, and user type, meaning whether it is for a consumer or a health professional.

Maya: A Class I device is the lowest risk. The TGA gives the example of a webpage offering self-guided cognitive behavioural therapy to help manage mild symptoms of depression.

Sam: Then you step up to Class IIa. The examples provided are an app that provides cognitive behavioural therapy for bipolar disorder, and an online platform that uses questionnaires to screen for depression and recommends next steps based on the result.

Maya: Next is Class IIb. The example here is a generative AI chatbot providing personalised intervention to people experiencing mental health challenges.

Sam: And at the top end, you have Class III. The example here is an app that screens for acute psychosis and provides a diagnosis directly to the user. That is considered the highest risk.

Maya: The regulatory obligations scale with these classes. For regulated tools, the ARTG inclusion pathway generally involves 4 stages. Stage 1 is meeting safety, performance, and design requirements. This means meeting standards to ensure the software is safe and performs as intended, known as the Essential Principles.

Sam: It also involves establishing a post-market surveillance system, maintaining appropriate records and controls, and for Class IIa and above, implementing a formal quality management system.

Maya: Stage 2 is obtaining certification, which is required for Class IIa and above. Class III devices also require design certification. Stage 3 is applying for ARTG inclusion, which means submitting the application, paying the fees, and then supplying the software once the application is approved.

Sam: Finally, Stage 4 covers ongoing obligations after supply. This involves keeping records, monitoring software performance, reporting adverse events, complying with advertising rules, and meeting other post-market obligations such as market and recall action.

Maya: For a lot of software companies that have been flying under the radar using this clinical guideline loophole, implementing a formal quality management system and dealing with ARTG inclusion fees and audits is going to be a massive operational shift.

Sam: Appendix B looks at other regulators. The European Union Medical Device Regulation regulates software meeting the definition of a medical device, but excludes general wellbeing apps lacking a medical purpose or used for simple storage.

Maya: Health Canada regulates them as medical devices but excludes general wellness apps and electronic health record systems. Interestingly, mental health apps can be assessed by the Mental Health Commission of Canada to receive a badge if they meet standards.

Sam: Japan regulates them but excludes software with limited potential to impact patient health, like patient education tools. Singapore regulates those meeting the medical device definition without listing specific exclusions here. And Korea regulates them under their Digital Medical Products Act, which might actually capture general wellness products rather than excluding them.

Maya: This entire consultation is a loud signal that the global regulatory grace period for digital mental health tools is ending. The TGA is asking stakeholders to provide feedback at their consultation webpage by 23:59pm AEDT on 7 Dec 2026.

Sam: Following internal review of the feedback received, the consultation outcomes will be published on the TGA website. This is expected to occur in early 2027. So the window to shape these rules is open right now.

Maya: Whether you are building these tools, prescribing them, or buying them for a hospital network, you need to pay close attention. If a health service is procuring a digital mental health tool, they need to ask the vendor about their regulatory strategy. Will this product still be legal to supply in Australia after the 2-year transition period?

Sam: You cannot just assume an app is safe because it is available to download. And developers can no longer assume that pasting a link to clinical guidelines will keep the regulator away.

Maya: To recap, the TGA is looking to close a 2021 loophole that allowed certain digital mental health tools to avoid regulation. With tools becoming more complex and AI-driven, Australia is proposing to either scrap the exclusion entirely or modify it to only cover truly low-risk software.

Sam: Developers will likely face strict medical device oversight and a 2-year transition period to comply. As always, you can find a link to the source document in the show notes.

Maya: And a quick reminder, we are just discussing a regulatory document here to unpack the findings, so please remember this is not medical advice.