Australian Immunisation Register Rules 2026

The instrument rests on a small set of definitional and operational concepts that determine who may access or act for the AI register and what reporting obligations attach to vaccination events.

Prescribed body, for the purposes of the Act’s definition (s 6-9). The Rules specify four routes by which a person or entity becomes a prescribed body for the Act’s definition:

• entities operating Primary Health Networks under a Commonwealth funding agreement for the Primary Health Network Grant Program (s 6);
• named research and statistics bodies and a named hospital network (the Australian Institute of Health and Welfare, the ABS to the extent it acts through that agency, the Australian Institute of Family Studies to the extent it acts through that agency, and The Sydney Children’s Hospitals Network) (s 7);
• state and territory governments to the extent they act through their respective health departments or directorate (s 8); and
• officers, employees or contractors of another prescribed body where they perform work relating to the purposes of the AI register and perform that work because they are an officer or employee of, or engaged by, a prescribed body designated under another section of Part 2 (s 9).

Relevant vaccination and the reporting hook (s 10). The Act contains a reporting mechanism triggered by subsection 10A(1). For the purposes of that subsection this instrument prescribes which vaccinations and circumstances fall within the reporting obligation, the time within which reports must be made, the manner of reporting and the precise data fields. The concept of a “relevant vaccination” is therefore operationalised to include COVID‑19 vaccinations, influenza vaccinations, vaccinations with a “specified national immunisation program vaccine” (a subset of national immunisation program vaccines excluding influenza and Q fever) and Japanese encephalitis vaccinations (s 10(a); s 5 definition).

Timing and practicability (s 10(c), 10(d)). The Rules adopt a two‑tier timing and manner regime that conditions tighter deadlines and the required electronic form on what is “reasonably practicable”. The prescribed period for reporting is 24 hours after administration if it is reasonably practicable otherwise 10 business days (s 10(c)). The prescribed manner is an electronic form if reasonably practicable otherwise a written form (s 10(d)). The instrument does not define “reasonably practicable” but makes it a material qualifier for both timing and format.

Prescribed data fields (s 10(e)). The instrument enumerates particular data elements that must be supplied when reporting these vaccinations. Mandatory items include patient demographics, Medicare number if the person has one, healthcare identifier if known, provider identification information for the recognised vaccination provider, date of vaccination, brand/dose number/batch number, route of administration for specified NIP vaccines, vaccine type information and pregnancy status via an antenatal field (s 10(e)(i)-(ix)). Some elements are conditional (for example Medicare number only if the individual has one).

Interaction with existing definitions (s 5 note). The Rules rely on the Act for several expressions. The instrument supplements that by defining national immunisation program vaccine as a vaccine provided under s 9B of the National Health Act 1953, and further creating the carve‑out “specified national immunisation program vaccine” which excludes influenza and Q fever (s 5).

Repeal of the 2015 Rules (Schedule 1). The instrument expressly repeals the Australian Immunisation Register Rule 2015 in full (Schedule 1). The 2015 Rules are removed from the regulatory landscape as of this instrument’s commencement.

Authority and scope. The instrument is made under the authority of the Australian Immunisation Register Act 2015 (s 3). It therefore operates to the extent permitted by that Act; it does not itself create criminal penalties or broader powers beyond what the Act authorises. Where the Rules refer to sections of other statutes (for example the National Health Act 1953 and the Healthcare Identifiers Act 2010), they do so to import established statutory definitions or administrative frameworks (s 5 and s 10(e)(iii)).

In sum, the main concepts are: who counts as a prescribed body; which vaccinations must be reported; the time and form in which reports must be lodged; the specific data elements required; the conditional qualifiers of “if reasonably practicable”; and the repeal of the 2015 instrument.

The Rules create legal effects for several discrete groups. The instrument itself does not purport to create novel obligations beyond those identified in the Act but it operationally defines who is a prescribed body and what vaccination events must be reported for purposes of the Act.

Recognised vaccination providers and persons who administer vaccines. The reporting prescription in Part 3 (s 10) applies to “relevant vaccinations administered in Australia” from 1 April 2026. The Act (as referenced in the instrument) places reporting obligations on persons who administer relevant vaccinations. The Rules specify the vaccinations and the data content that must be reported to satisfy the Act’s subsection 10A(1). Therefore, recognised vaccination providers, and any person acting as the administering provider, will be directly affected by the reporting timelines, manner and data field requirements set out in s 10.

Primary Health Networks. Entities that have agreed to operate a primary health network under a Commonwealth funding agreement made under the Primary Health Network Grant Program are designated “prescribed bodies” for the purposes of the Act (s 6). That designation is likely to affect PHNs’ eligibility to receive or supply AI register data and to perform functions or have access rights that the Act attaches to prescribed bodies.

Named research and statistical bodies, and hospital network. The Australian Institute of Health and Welfare, the Australian Bureau of Statistics to the extent it acts through that agency, the Australian Institute of Family Studies to the extent it acts through that agency, and The Sydney Children’s Hospitals Network (Randwick and Westmead) are prescribed bodies for the Act’s purposes (s 7). Those entities will be able to act under the Act’s framework in the manner the Act allows for prescribed bodies. The Rules state the designation without setting out the rights and limits that the Act attaches to that designation.

State and territory health departments. Each state and territory is designated to the extent it acts through its health department or equivalent directorate (s 8(a)-(i)). That includes New South Wales, Victoria, Queensland, Western Australia, South Australia, Tasmania, the Australian Capital Territory and the Northern Territory through the listed agencies. The designation is limited by the phrase “to the extent that it acts through” the named agency, which ties the prescription to official departmental action.

Officers, employees and contractors of prescribed bodies. A person who performs work relating to the purposes of the AI register and who performs that work because they are an officer or employee of, or are engaged by, another person who is a prescribed body under another section of Part 2, is themselves a prescribed body for the purposes of the Act’s definition (s 9). In practice this means individual staff and contracted personnel working on AI register purposes for a prescribed body fall within that defined category. The wording extends coverage beyond corporate entities to individuals performing relevant duties.

Persons receiving vaccinations. While not the addressees of compliance duties, individuals who are administered the enumerated vaccinations are affected as data subjects. The Rules specify demographic and identifier fields to be collected and reported (name, contact, date of birth, gender, Medicare number if any, healthcare identifier if known) and pregnancy status via an antenatal field (s 10(e)(i)-(iii), (ix)). Those fields relate to privacy and data management for the persons vaccinated.

Administrative actors and IT vendors. The reporting manner is prescribed as electronic where reasonably practicable (s 10(d)). Software suppliers, IT operations and health record vendors who support recognised vaccination providers will be affected by the need to transmit the enumerated fields in the prescribed manner and timeframe. Where electronic reporting is not reasonably practicable, written form is permitted; that creates procedural differences for smaller providers or transient clinics.

Who does not appear. The Rules do not designate private sector research entities generally, professional bodies, insurers, or other non‑listed organisations as prescribed bodies. They do not on their face create direct duties on employers, insurers or third parties beyond those recognised vaccination providers and the persons and bodies listed.

In summary, the instrument affects recognised vaccination providers (reporting duties and data requirements), PHNs and the named public research/health agencies and state/territory health departments (as prescribed bodies), officers and contractors working for those bodies (by extension), data management and IT suppliers, and individuals receiving the specified vaccinations as data subjects.

The Rules primarily set out a reporting duty and clarify who is a “prescribed body” under the Act’s definition. The relevant duties and the associated rights or entitlements derive from how the Act uses these defined categories and the reporting mechanics prescribed.

Reporting duty: scope and triggers (s 10). For the purposes of subsection 10A(1) of the Act, the Rules prescribe:

• the kinds of relevant vaccinations that must be reported: COVID‑19, influenza, specified national immunisation program vaccines (that is NIP vaccines excluding influenza and Q fever) and Japanese encephalitis (s 10(a));
• the circumstance that triggers reporting: vaccination administration on or after 1 April 2026 (s 10(b));
• the reporting period: within 24 hours if reasonably practicable otherwise within 10 business days (s 10(c));
• the manner: electronic form if reasonably practicable otherwise written form (s 10(d)); and
• the information to be provided in each report (s 10(e)(i)-(ix)). The instrument explicitly prescribes the exact data fields required.

Actions required of recognised vaccination providers. The Rules require a recognised vaccination provider who administers a listed vaccination on or after 1 April 2026 to ensure that the specified information is recorded and reported within the prescribed period and manner. The provider must therefore capture the enumerated fields at the point of care or otherwise obtain them, and transmit them in electronic form unless doing so is not reasonably practicable (s 10(c)-(e)).

Conditional and conditional‑conditional items. Some data elements are conditional by their wording. The Medicare number is only to be reported if the individual has one (s 10(e)(ii)). The healthcare identifier is to be reported “if known” (s 10(e)(iii)). For “specified national immunisation program vaccine” the Rules add a specific requirement to report information about the route of administration (s 10(e)(vii)). Pregnancy status must be reported via the antenatal field (s 10(e)(ix)).

Prescribed bodies: status and implied rights (ss 6-9). The Rules designate certain persons as prescribed bodies for the purposes of section 4 of the Act. The Rules themselves do not elaborate the rights and duties that flow from that definition; however the practical effect is that the named entities and persons will be treated as prescribed bodies under the Act. Any rights, access to data, obligations or powers that the Act assigns to a “prescribed body” will therefore apply to the entities and persons listed in ss 6-9, to the extent those Act provisions operate. The Rules thus determine the universe of entities that are eligible to be a prescribed body for the Act’s purposes (s 6-9).

Operational discretion: “reasonably practicable” qualifier (s 10(c)-(d)). The Rules embed operational discretion in the concept of what is “reasonably practicable” for reporting within 24 hours and reporting in electronic form. The qualifier affects the duty’s timing and format. The Rules do not define reasonably practicable, so the immediate duty requires an operational assessment by the reporting entity of practicability, and consequences for later reporting are governed by the Act.

Data granularity: provider and product identifiers (s 10(e)(iv)-(vi)). The duty requires provider identification information for the recognised vaccination provider and detailed vaccine product identifiers including brand, dose number and batch number (s 10(e)(iv)-(vi)). This requires accurate product recording at administration and linkage to recognised provider identifiers when reporting.

No new penalties specified in the Rules. The Rules are made under the Act (s 3) and set out the reporting content and the persons who count as prescribed bodies. They do not create or amend penalties themselves. Any sanction, enforcement mechanism or administrative regime tied to non‑compliance with the reporting obligation is therefore located in the Act rather than in these Rules. The instrument references subsection 10A(1) of the Act as the statutory hook for the reporting requirement (s 10 preamble).

Repeal and transitional silence (Schedule 1). By repealing the 2015 Rules in full, the instrument removes the prior regulatory text that previously governed prescribed bodies and reporting. The instrument does not include express transitional provisions or savings clauses in respect of the prior Rules; therefore any transitional arrangements, if relevant, would need to be found in the Act or other instruments.

Summary. Practically, the key duties are: capture and report the enumerated vaccination events and prescribed data fields within the specified timeframe and in the prescribed form, with practicability as the operational qualifier. The key rights are those that flow from being designated a “prescribed body” under the Act; the Rules determine which entities and persons are so designated.

The instrument does not itself create or specify penalties, fines or criminal offences. It is made under the Australian Immunisation Register Act 2015 (s 3), and it prescribes reporting mechanics and the identities of prescribed bodies for the purposes of the Act. Enforcement, sanctions and any administrative remedies therefore fall back on the Act’s provisions and any other statutory instruments or administrative rules made under that Act. The Rules reference subsection 10A(1) of the Act as the statutory authority for the reporting requirement (s 10), but do not recite or alter the Act’s enforcement framework.

What the Rules do state that is relevant to enforcement:

• They set the temporal and format expectations for reporting, including the 24‑hour target when “reasonably practicable” and the fallback 10 business day deadline (s 10(c)). These deadlines will be the operational benchmarks against which compliance is measured, and any enforcement will likely refer to them.

• They set discrete data fields that are prescribed for reporting (s 10(e)). Failure to include those fields when reporting will be an operational compliance lapse; whether it constitutes a breach subject to penal sanction depends on the Act’s wording and any delegated enforcement rules.

• The Rules designate a set of entities as prescribed bodies (ss 6-9). Designation can carry entitlements and obligations under the Act, which might include lawful access to AI register data, obligations to maintain data security, or other duties the Act prescribes for prescribed bodies. The Rules do not itself articulate enforcement mechanisms for breaches by prescribed bodies.

Because the Rules are silent on penalty amounts, pecuniary fines or criminal offences, any practical compliance risk that includes legal sanctions will depend on the Act. Practitioners should therefore consult the Act’s enforcement provisions, regulatory guidance issued by the AI register administrator, and any administrative instruments or directions made under the Act to determine the concrete penalty and enforcement environment.

Administrative enforcement and audit risk. While the Rules do not specify enforcement mechanisms, their precise data‑field prescriptions and timings create a clear basis for administrative review and audit. An administering agency or compliance unit can compare reported data timestamps, completeness of required fields and reporting format (electronic vs written) against the Rules. The “reasonably practicable” test will be a fact‑based assessment in compliance reviews.

Information governance and privacy enforcement. The Rules require specific personal identifiers and sensitive data elements (for example, pregnancy status via the antenatal field) (s 10(e)(i), (ix)). Compliance therefore implicates privacy frameworks and data security standards. Enforcement action for mishandling or unlawful disclosure of AI register data will follow from privacy law and any Act‑based data protection or handling rules rather than from the Rules themselves. The Repeal of the 2015 Rules and the lack of transitional provisions places an onus on administrators to ensure that privacy and retention practices align with the new Rules and with the Act.

In short, the instrument prescribes duties but not sanctions. Enforcement and penalties must be sought in the Act and associated administrative instruments; the Rules provide the measurable operational benchmarks that enforcement will rely upon.

The Rules operate by reference to the Australian Immunisation Register Act 2015 and interact with other statutory regimes through incorporated definitions and cross‑references. The instrument does not itself overhaul other statutes but creates operational linkages to them.

Primary statutory anchor: the Australian Immunisation Register Act 2015 (s 3). The Rules are made under this Act and expressly tie the designation of “prescribed body” and the reporting prescription to provisions of that Act (for example, the definition in section 4 and subsection 10A(1)) (ss 6-10). Therefore the scope, effect and limits of the Rules must be read in conjunction with the Act. Any rights, obligations and enforcement frameworks that the Act creates for “prescribed bodies” or for reportable vaccinations apply to the entities and events the Rules describe.

National Health Act 1953 (s 5). The Rules define “national immunisation program vaccine” by reference to section 9B of the National Health Act 1953 (s 5). The instrument further constructs “specified national immunisation program vaccine” as a national immunisation program vaccine other than influenza or Q fever (s 5). Those cross‑references import the statutory classification and the list of vaccines authorised under the National Health Act into the reporting prescription. Practically, shifts in which vaccines are designated under section 9B will change the universe of “specified national immunisation program vaccines” for reporting purposes.

Healthcare Identifiers Act 2010 (s 10(e)(iii)). The Rules require reporting of a healthcare identifier "if known" and expressly reference the definition in the Healthcare Identifiers Act 2010 (s 10(e)(iii)). That cross‑reference ties the reporting obligation to a recognised national identifier framework and brings any obligations related to handling healthcare identifiers under that Act into the operational compliance mix.

Administrative funding instruments and program rules (s 6). The Primary Health Network Grant Program funding agreements determine who is a PHN operator; the Rules make those PHN operators prescribed bodies if they have entered an applicable funding agreement with the Commonwealth (s 6). This links program funding and grant administration to the AI register’s statutory framework.

Privacy and data‑protection laws. The Rules mandate collection and reporting of personal and health information including demographics, Medicare numbers, healthcare identifiers and pregnancy status (s 10(e)). Data handling will intersect with the Privacy Act 1988 and any state or territory privacy regimes applicable to the prescribed bodies (not detailed in the Rules). The instrument does not attempt to displace privacy responsibilities; it prescribes reporting requirements within the existing statutory environment.

State and territory administrative law. The Rules designate state and territory governments acting through their respective health departments as prescribed bodies (s 8). This designation interacts with state statutory frameworks under which those health departments operate, and with state recordkeeping, health regulation and privacy laws. The phrase “to the extent that it acts through” the named agency creates a bridge only when the state/territory acts by those agencies, which could be relevant where governments use other agencies or contractors.

Repeal of prior delegated instrument (Schedule 1). The instrument repeals the Australian Immunisation Register Rule 2015 in full (Schedule 1). The repeal interaction with other laws is administrative: the instrument replaces the prior delegated instrument and leaves the Act as the continuing legal basis for the AI register. Any transitional arrangements previously set out in the repealed instrument, if relevant, are not carried forward by this instrument.

Absence of express modifications to offences or powers. The Rules do not purport to modify offences, powers of search or inspection, or other coercive powers in other Acts. Therefore any interaction with law enforcement powers, surveillance statutes, or similar regimes will be governed by those statutes and the Act rather than by the Rules themselves.

In summary, the Rules are a statutory instrument that sits inside a network of health, identifier and privacy legislation. They import vaccine classifications from the National Health Act, healthcare identifier concepts from the Healthcare Identifiers Act, designate certain public health bodies for the Act’s purposes, and leave enforcement and privacy obligations to the parent Act and existing privacy laws.

This instrument is a new instrument made on 12 March 2026 by the Minister for Health and Ageing and is titled the Australian Immunisation Register Rules 2026. The instrument’s commencement provision states the whole instrument commences on 1 April 2026 (s 2). The instrument does not include staged commencement dates for individual provisions; the commencement table records only that the whole instrument commences 1 April 2026 (s 2(1)) and warns that column 3 information is not part of the instrument (s 2(2)).

The instrument expressly repeals the Australian Immunisation Register Rule 2015 in its entirety (Schedule 1). Schedule 1 contains a single item: “The whole of the instrument , Repeal the instrument.” The Rules therefore remove the prior delegated instrument that governed these matters. The instrument does not include express transitional or saving clauses preserving rights, duties or data collected under the 2015 Rules; the absence of transitional provisions in this instrument means any transitional arrangements must be located in the Act or in separate instruments.

No other amendments are recorded in the instrument. The document does not record prior amendments to itself, as it is presented as originally made. The instrument contains a note indicating that the commencement table relates only to the provisions as originally made and will not be updated for later amendments (s 2 note). That indicates the instrument’s internal metadata may be updated in published versions but such metadata updates do not form part of the instrument.

The instrument also contains internal definitional changes relative to the prior instrument by way of new or clarified definitions. Notably, it defines “specified national immunisation program vaccine” as a national immunisation program vaccine other than influenza or Q fever (s 5). The instrument adds specific prescribed vaccinations in s 10(a) for reporting purposes, including COVID‑19, influenza, specified national immunisation program vaccines and Japanese encephalitis. Whether these are substantively different from the 2015 Rules is not addressed in the instrument; the only formal step recorded here is total repeal of the 2015 instrument and replacement by this 2026 instrument.

Administrative metadata. The instrument contains a formal heading with the Minister’s signature and date (12 March 2026). It includes a contents list and the Schedule indicating the repeal. It also contains a note that several expressions are defined in the Act, and clarifies which statutory instruments specify which vaccines under the National Health Act (s 5 note). The instrument does not record any prior consultation, explanatory memorandum or legislative history within the text itself.

In short, the amendment history recorded in this instrument is simple: it is a new, standalone instrument replacing the 2015 Rules in full and commencing on 1 April 2026. No interim amendments, transitional savings, or staged commencements are included in the instrument text.

The Rules contain no reference to litigation, court proceedings, tribunal determinations or legal disputes. They do not cite any judicial or administrative decisions, nor do they record any contested matters or appeals in relation to their content. The instrument is a delegated legislative instrument that prescribes procedural and definitional matters for the Australian Immunisation Register Act 2015 and therefore, as presented, contains no litigation history.

Implications of absent litigation record. Because the instrument itself does not discuss litigation, practitioners should not infer precedent from this text alone. Any litigation that concerns the scope, interpretation or enforcement of the reporting obligations, the meaning of “reasonably practicable”, the Act’s use of “prescribed body”, or the compatibility of reporting with privacy law would be litigated under the Act and related statutes. The instrument’s silence means:

• There are no recorded judicial interpretations of the instrument’s specific terms within the text.
• Questions such as the scope of “reasonably practicable” for the 24‑hour timing or electronic reporting, the sufficiency of the specified data fields, or disputes over access to AI register data by prescribed bodies are open to legal challenge and will be ultimately determined by the Act and applicable judicial principles if contested.

Potential litigation touchpoints. Although the Rules do not record litigation, the text frames several areas where litigation could arise:

• Interpretation of “reasonably practicable” for both timing and format (s 10(c)-(d)). Courts or tribunals may be asked to determine what constitutes reasonable practicability in given operational contexts.
• Coverage and limits of “prescribed body” status (ss 6-9). Disputes could arise over whether particular persons or contractors fall within s 9, or over the meaning of “to the extent that it acts through” for state and territory designations in s 8.
• Data handling and privacy compliance. Litigation under privacy statutes or administrative law could test whether the collection, reporting and subsequent use of the antenatal field and other identifiers complies with privacy obligations.
• Compliance with the reporting period and data completeness. Administrative enforcement actions or judicial review could arise if agencies attempt to apply penalties or sanctions for non‑compliance with reporting obligations set out in s 10.

Absence of recorded judicial decisions does not preclude future litigation. Practitioners should therefore monitor the Act, subsequent administrative instruments, guidance from the AI register administrator, and any judicial or tribunal decisions interpreting these Rules or the Act.

The Rules contain several provisions and drafting choices that create practical risks or uncertainties for implementers and legal advisers. These are specific, text‑based observations rather than value judgements.

1. “Reasonably practicable” qualifier. The instrument uses “reasonably practicable” twice to qualify the 24‑hour reporting target and the electronic‑form mandate (s 10(c)-(d)). The Rules do not define this term. This creates an evidentiary and interpretive burden on reporting entities to establish why they could not comply with the 24‑hour target or with electronic reporting. Practically, providers and their IT vendors should plan for the 24‑hour goal and electronic transmission as the default, and document exceptions when they rely on the 10 business day fallback or written form.

2. 24 hours versus 10 business days. The two‑tier timing regime requires a judgment call and recordkeeping. A provider reporting in 4 business days will not be automatically compliant unless it can show 24 hours was not reasonably practicable. The instrument does not state what constitutes evidence of impracticability or the test administrator for that assessment.

3. “Prescribed manner” ambiguity. Electronic reporting is required if reasonably practicable, otherwise written form is allowed (s 10(d)). The Rules do not define required electronic standards, secure transmission protocols, acceptable file formats, or whether manual batch uploads are permissible. Absent supplementary administrative guidance, vendors and providers will need to seek clarification from the AI register operator.

4. Data field granularity and conditional items. The Rules require brand, dose number and batch number (s 10(e)(vi)). Capturing batch numbers in some settings (mass vaccination clinics, pop‑up sites) may be operationally difficult. The Medicare number is required only if the individual has one (s 10(e)(ii)), and the healthcare identifier only "if known" (s 10(e)(iii)), which creates conditional data completeness expectations. The antenatal field requirement for pregnancy status (s 10(e)(ix)) raises sensitive data handling issues.

5. “Vaccine type information” undefined. The Rules require “vaccine type information” (s 10(e)(viii)) without defining the term within the instrument. Implementers will need to determine whether this means vaccine platform (mRNA, vector), antigenic composition, or another classification. That interpretive uncertainty carries a compliance risk.

6. Route of administration limited to specified NIP vaccines. For “vaccines prescribed under subparagraph 10(a)(iv)” (that is, specified national immunisation program vaccines) the Rules require route‑of‑administration information (s 10(e)(vii)). That requirement is not extended explicitly to other vaccines such as COVID‑19 or influenza, which may create inconsistent recording practices for similar vaccinations across settings.

7. Who is a “prescribed body” depends on the Act’s use of that defined term. The Rules repeatedly state that persons are prescribed bodies "for the purposes of the definition of that expression in section 4 of the Act" (ss 6-9). The practical legal consequences of being a prescribed body depend on the Act’s provisions. The Rules do not elaborate what those consequences are. Practitioners must map the Act’s provisions onto these designations to determine rights to access AI register data, permitted uses, confidentiality obligations and related duties.

8. Officers, employees and contractors may be designated individually. Section 9 extends prescribed body status to individuals who perform work relating to the purposes of the AI register because they are employed by or engaged by prescribed bodies (s 9). This phrasing potentially broadens access, delegation and liability exposure to individual staff and contractors. Organisations should review engagement contracts and confidentiality agreements to align with that status.

9. Repeal of the 2015 Rules with no transitional text. Schedule 1 repeals the 2015 Rules in full. The 2026 Rules contain no transitional provisions. If the 2015 Rules contained different reporting timeframes or fields, the instrument does not set out how data collected under the previous instrument or ongoing reporting commitments are to be handled during the changeover.

10. Column 3 caveat. The commencement table contains a column 3 with notes; section 2(2) states information in column 3 is not part of the instrument. Users who rely on published copies with editorial notes should take care to distinguish between text that forms part of the legal instrument and ancillary explanatory or metadata content.

11. Limited list of prescribed bodies. The Rules include named agencies and PHNs under funding agreements, but do not list other research entities, private health organisations or insurers. Organisations outside the designated list should not assume they are prescribed bodies without checking the Act and any other instrument.

12. Privacy and data sensitivity. The required antenatal field and the collection of Medicare and healthcare identifiers introduce privacy and security obligations. The Rules do not set data retention, use or sharing limits; those matters are left to the Act and privacy regimes. Practitioners should align reporting practices with privacy legislation and with any AI register administrative guidance.

Each of these points arises directly from the instrument’s text. They represent operational friction points that reporting entities, IT vendors, health departments and legal advisers will need to address to implement the Rules with regulatory certainty.

Compliance requires implementing processes, recordkeeping and technical capabilities that align with the instrument’s prescriptions. The following stepwise actions are grounded in the instrument’s text and address who pays, who decides and what behaviour must change.

1. Establish legal basis and mapping. Confirm that your entity is a recognised vaccination provider under the Act and identify whether you are a prescribed body under ss 6-9. If you operate a Primary Health Network under a Commonwealth funding agreement under the Primary Health Network Grant Program, you are a prescribed body (s 6). If you are one of the named agencies in s 7 or a state health department acting through the named agency in s 8, you are a prescribed body. If you employ or engage persons to perform work relating to AI register purposes, s 9 may apply to those personnel.

2. Update intake and clinical forms to capture required data fields. The Rules prescribe specific fields to be reported for each relevant vaccination (s 10(e)(i)-(ix)). Ensure your point‑of‑care documentation collects:

   • full name, contact details, date of birth and gender (s 10(e)(i));
   • Medicare number if the individual has one (s 10(e)(ii));
   • healthcare identifier if known (s 10(e)(iii));
   • provider identification information for the administering recognised vaccination provider (s 10(e)(iv));
   • day of vaccination (s 10(e)(v));
   • brand, dose number and batch number (s 10(e)(vi));
   • route of administration for specified national immunisation program vaccines (s 10(e)(vii));
   • vaccine type information (s 10(e)(viii)); and
   • pregnancy status via the antenatal field (s 10(e)(ix)).

3. Implement electronic reporting capability as the default. The Rules require electronic reporting where reasonably practicable (s 10(d)). Design IT systems and workflows to transmit the prescribed fields electronically to the AI register in near real time where feasible. Plan for secure transmission protocols, mapping between local codes and the AI register's fields, and error handling.

4. Develop a fallback written‑form process and compliance justification. Because the Rules permit written reporting only where electronic reporting is not reasonably practicable (s 10(d)), document the criteria and decision‑making process that will be used to justify reliance on written reports. Keep contemporaneous records demonstrating why electronic submission was not reasonably practicable in each instance.

5. Meet timing obligations and document impracticability. The Rules set a 24‑hour target if reasonably practicable and otherwise a 10 business day deadline (s 10(c)). Configure workflows to aim for 24‑hour reporting for each vaccine administration. Where you cannot meet 24 hours, document the reasons why it was not reasonably practicable and ensure the report is lodged no later than 10 business days. Maintain an auditable timeline for reporting events.

6. Ensure batch and product recording at point of care. The requirement for brand, dose number and batch number (s 10(e)(vi)) demands processes that capture product identifiers before or at administration. Train clinical staff and configure stock management systems so batch numbers are recorded and linked to individual vaccine entries.

7. Train staff and contractors on data sensitivity and the antenatal field. The antenatal pregnancy field is explicit (s 10(e)(ix)). Provide staff training on how to collect this sensitive data, privacy obligations, consent considerations and appropriate documentation. For contractors and employees covered by s 9, ensure confidentiality and data handling clauses in contracts reflect prescribed body status.

8. Review identity‑matching protocols. The Rules require Medicare numbers if the individual has one and healthcare identifiers if known (s 10(e)(ii)-(iii)). Implement identity matching protocols that correctly record these identifiers when available and ensure verifiable capture of patient identity to reduce downstream reconciliation issues.

9. Update vendor contracts and system interfaces. If you use third‑party clinical software, confirm your vendor can support the electronic feed of the required fields and the 24‑hour reporting objective. Ensure vendor SLAs address uptime and data transmission responsibilities, and align contractual confidentiality and security obligations with the Act and privacy laws.

10. Undertake data governance and privacy compliance checks. The Rules do not set privacy safeguards. Conduct privacy impact assessments for the collection and transmission of identifying and antenatal data. Align retention, access controls and breach notification procedures with the Privacy Act and any state privacy laws that apply to prescribed bodies (ss 10(e)(i), (ix)).

11. Coordinate with PHNs and state health departments. If you are a PHN, state health department or otherwise designated as a prescribed body, determine internal roles for accessing AI register data and for managing contractors who may be treated as prescribed bodies under s 9. Ensure delegation and data sharing arrangements are documented consistent with the Act.

12. Monitor for administrative guidance. The Rules leave operational details such as electronic formats and what constitutes “reasonably practicable” to administration. Monitor communications from the AI register administrator and the Department of Health for technical specifications, reporting endpoints, schemas, and guidance that will operationalise the Rules.

13. Document decision logic and compliance evidence. Given the interpretive qualifiers in the Rules, retain contemporaneous documentation for each reporting decision that departs from the 24‑hour electronic default. This will be the primary defence in any administrative compliance review.

14. Address transitional and legacy data. Because the 2015 Rules are repealed (Schedule 1) and no transitional provisions are included, evaluate whether prior data collection processes require migration, reconcile historical records with the new data fields, and ensure reporting systems handle historic events as required by the Act.

15. Legal and policy check. Finally, align your compliance programme with the Australian Immunisation Register Act 2015 for enforcement, data access and permitted uses. The Rules do not themselves establish penalties or data‑use constraints; those provisions remain with the Act and with any relevant privacy law.

Who pays and who decides. The duties fall on the person who administers the relevant vaccination, i.e. the recognised vaccination provider as per the Act (s 10 referencing subsection 10A(1) of the Act). The decision about whether electronic reporting or 24‑hour reporting is “reasonably practicable” rests with the reporting entity in the first instance, but may be assessed by the AI register administrator or an enforcement body under the Act in later review. Entities should document and retain evidence supporting their operational decisions.

Practical prioritisation. Prioritise building electronic reporting pipelines to meet the 24‑hour objective, ensure accurate capture of product identifiers at the point of care, and institute robust privacy controls. Where immediate electronic reporting is infeasible, use the documented fallback and meet the 10 business day deadline.

Implementation checkpoints. Key milestones for compliance readiness should include: mapping data fields to clinical forms and IT systems; vendor readiness testing for electronic feeds; staff training on antenatal and identifier collection; and establishing audit logs documenting reporting timelines and decisions on practicability.

Align these steps to the instrument’s text: the reporting fields and timing are prescribed in s 10; the list of prescribed bodies is in ss 6-9; the definitions are in s 5; and the instrument commences 1 April 2026 (s 2).