Your First Safe AI Project: the 30-Day, Read-Only Roadmap

Most practices meet AI through a vendor pitch for the most dangerous starting point there is: an AI receptionist that talks to patients and collects health details after hours. It might belong in your practice eventually — as the last project, once everything underneath it is proven. The right first project is the opposite: an AI that can only read, never act. This guide is the 30-day sequence.

The one principle behind the whole roadmap

An AI that can't act, can't act wrongly. A read-only AI can't message a patient, can't change an appointment, can't publish a word. The worst it can do is be wrong in a report a human reads — and a wrong sentence in a report is a Tuesday, not an incident. Every step below exists to keep that property true for 30 days while you learn what AI is actually worth to your practice.

Days 1–5: put the boundaries in writing first

Before any tool is switched on:

• Adopt a staff AI policy — one page, signed, so "what's allowed" isn't a guess. (A ready-to-adopt starter is in our free library.)
• Start the AI tool register — list what's already touching the practice, including AI features inside software you didn't choose. (Fill-in template.)
• Name one accountable person. Every question, incident or vendor pitch routes to them.

Nothing here costs money, and all of it survives whichever vendor you eventually pick.

Days 6–10: choose the narrowest useful data

The pilot reads the minimum data that answers an owner's questions — typically appointment, recall and treatment-plan summaries. Three rules:

• Read-only access, granted formally, revocable in one step.
• No patient-facing systems in scope. No inbox. No website chat.
• Know where the data is processed (Australia or overseas) before it flows — that's an APP 8 question worth asking out loud.

If a vendor can't grant read-only access, that is the answer to whether they're the right first vendor.

Days 11–28: the nightly report earns its keep

Now the AI does one job: a short owner report each morning. Lapsed recalls. Accepted treatment never booked. Tomorrow's gaps. The questions an owner would ask a sharp practice manager — answered from data the practice already has, checked against reality by someone who knows the practice. You're testing two things at once: whether the numbers are right, and whether they change what you do on a Monday morning.

Days 29–30: decide with evidence, not a demo

At the end of the month you'll know what a month of AI attention found, what it got wrong, and what acting on it would be worth. Then — and only then — decide what earns write access, what stays read-only, and what (like the receptionist) still waits. That's the decision a demo can never give you, made with your own numbers.

What this roadmap deliberately leaves out

No patient-facing AI. No clinical AI (X-ray reading and triage tools carry their own regulatory weight — see the TGA guide). No whole-inbox AI. Not because those are forbidden forever — because they should be earned by the boring, safe month that proves the foundations.

---

General practice-workflow education, not legal, clinical or compliance advice. The roadmap describes a risk-ordered sequence, not a guarantee of outcomes — adapt it to your practice.