NSW Category 1 and Category 2 Cosmetic Rules: What Your Records Must Show

Key takeaways

NSW’s Medicines, Poisons and Therapeutic Goods Regulation 2026 splits cosmetic injectable rules under Part 9 into Category 1 and Category 2 requirements
The Regulation commences 5 November 2026; it was made and published 3 July 2026 as statutory rule 2026-330
Category 1 covers who can administer, prescriber checks and responsible-provider risk management; Category 2 covers the written direction, records and storage, the tier a booking and patient record system actually produces
The Regulation’s penalties range from 20 to 400 penalty units for an individual and 100 to 2,000 for a corporation, worth $2,200 to $44,000 and $11,000 to $220,000 at $110 per unit; exactly where Category 1 and Category 2 sit within that range was not independently confirmable
The framework governs nurse-administered injectables under a prescriber’s direction, not doctors administering personally
A written direction must record patient, prescriber, responsible-provider and per-substance data; a specific “13 data points under a named section” figure could not be confirmed and is not used in this article

As at 18 September 2026, NSW’s Medicines, Poisons and Therapeutic Goods Regulation 2026 has been made but has not commenced. From 5 November 2026, its Part 9 splits cosmetic use substance rules for nurse-administered injectables into Category 1 requirements (who can administer, the checks a prescriber must make, the responsible provider’s risk management duties, the higher-penalty tier) and Category 2 requirements (the written direction, its required data fields, records and storage, the tier your booking and patient record system actually produces). Get the split wrong and you audit the wrong half of your practice.

What the Regulation Actually Says

Part 9 of the Medicines, Poisons and Therapeutic Goods Regulation 2026 (NSW), made under the Medicines, Poisons and Therapeutic Goods Act 2022 and published 3 July 2026 as statutory rule 2026-330, deals with what NSW Health’s own guidance calls “cosmetic use substances”: eight Schedule 4 medicines, listed as botulinum toxins, calcium hydroxylapatite, collagen, deoxycholic acid, hyaluronic acid and its polymers, polyacrylamide, polycaprolactone and polylactic acid. In plain terms: anti-wrinkle injections, most dermal fillers and fat-dissolving injectables. legislation.nsw.gov.au blocks automated access to the Regulation’s full text, so this article does not cite the specific section number that defines the list; the substance list itself is confirmed against NSW Health’s own published cosmetic-use guidance.

NSW Health’s guidance sets the part’s scope: administration is restricted to medical and nurse practitioners acting in the lawful practice of their profession, nurses acting under a practitioner’s direction, hospital personnel under a practitioner’s direction, and veterinary practitioners for animals. No other person may administer a cosmetic use substance. Read together, Part 9 governs the nurse-injector model: a nurse administering treatment under a prescriber’s direction, how most NSW cosmetic injectable clinics already operate.

Part 9 splits its duties into two tiers. Category 1 requirements cover who can administer, the checks a prescriber must make before issuing a direction, and the responsible provider’s risk management and emergency-equipment duties, the clinical and staffing side of the framework. Category 2 requirements cover the written direction itself, its required content, how directions and administration records are kept, and how the substances are stored, the recordkeeping side. That split is corroborated by NSW Health’s own guidance and by independent industry reporting on the Regulation. What is not independently confirmed is the pinpoint section numbering behind the split, or an exact penalty figure for each category specifically. NSW Health’s guidance describes a tiered penalty structure across the whole Regulation, from 20 to 400 penalty units for an individual and 100 to 2,000 for a corporation, which at the current NSW penalty unit value of $110, set under the Crimes (Sentencing Procedure) Act 1999, works out to $2,200 to $44,000 for an individual and $11,000 to $220,000 for a corporation. Category 1 breaches, being clinical and safety failures, would reasonably sit toward the higher end of that range and Category 2 recordkeeping failures toward the lower end, but which named tier attaches to which named provision is a question for the primary register, not this article.

Penalty Range Across the Regulation's Tiers (AUD)

The gap matters for prioritisation. Category 1 is a clinical and staffing question your practice already manages. Category 2 is a data question, and it is the one your website, booking flow and patient record system actually answer.

What That Means for the Build

Most of the Category 2 requirements do not describe software. They describe a record that has to exist, be complete and reach the right people.

Duty	Category	What your systems must capture or do
Who can administer, product checks	1	Confirm the injector is a nurse acting under a direction, or a practitioner supplying under their own prescription; confirm the product is on the Australian Register of Therapeutic Goods before it is logged as administered
Personal review before a direction	1	A direction can only follow a review in person or by audiovisual link. Store a review timestamp against the direction, not just a signature
Written record of administration	2	Every administration needs a written record (nurse’s name, date, batch number, plus the direction’s data fields) copied to the prescriber and the responsible provider
Direction in writing and signed	2	A written direction needs a real signature, or a signed record of an oral direction made at the time. A typed name in a form field is not the same thing
Content of the direction	2	Patient’s name and address, prescriber’s name and contact details, treatment premises address, responsible provider’s name, review date, validity period (capped at 6 months), number and interval of administrations, and per administration: substance, form, treatment site, route and quantity
Records of directions	2	The prescriber keeps a copy of every direction; the responsible provider gets a copy too. One record, not two versions that can drift apart
Storage	2	Storage that is not publicly accessible, separate from food, matching the label’s storage conditions. A premises record, not a booking-system field, but one the responsible provider is accountable for
Responsible provider duties	1 and 2	Risk management policies, emergency equipment and nurse training sit under Category 1; keeping copies of every direction and every record sits under Category 2

Build Duties by Category (This Article's Table)

Of the eight build-relevant duties in the table above, five sit purely in Category 2, two sit purely in Category 1, and one, the responsible provider’s duties, spans both. That is the recordkeeping tier, and it is the one a booking widget, CRM or practice management system can either satisfy automatically or quietly fail every single time.

A Worked Example

Cosmetic injectables clinic, single site, one prescribing nurse practitioner, two treating registered nurses. Bookings run through a scheduling widget that captures name, phone, email and treatment type. Clinical notes sit in a separate practice management system the nurses use in person.

Under Category 2, each treatment needs a written direction that records the patient’s name and street address, the prescriber’s and responsible provider’s details, the direction’s validity window (capped at six months) and, for each planned administration, the substance, its form, the treatment site, the route and the quantity. None of that exists in the booking widget today, and only part of it exists in the clinical notes.

The practical fix is not a new system. It is a direction record type inside the practice management software the nurses already use, populated from the review that already happens before treatment, with a validity field the system checks on its own rather than a receptionist tracking a six-month cutoff on a spreadsheet. The responsible provider then needs a copy of every direction and every nurse’s administration record, a matter of the software syncing a copy on save, not a manual step for someone to forget.

What to Check on Your Own Site

Find where your patient record stores a prescriber’s written direction, if it stores one at all.
Check whether that record captures the full set of required fields: patient name and street address, prescriber and responsible provider details, the treatment premises address, review date, validity period and, per administration, substance, form, treatment site, route and quantity. The patient’s street address and the treatment premises address are both easy to miss.
Check whether a direction has a validity date your system enforces, or whether staff track the six-month limit manually.
Confirm your responsible provider (the business, not an individual employee) receives a copy of every direction and every nurse’s administration record.
Check your storage arrangements for the physical product: a space that is not publicly accessible, separate from food, matching the label.
Ask your practice management or booking vendor directly whether they have built anything for the 5 November 2026 commencement, or whether the gap is yours to close.

NSW Health’s public guidance is clear that both Category 1 and Category 2 breaches carry real, enforceable penalties, not just a warning letter. It does not, in the material available outside the primary register, name a specific schedule of on-the-spot penalty notices tied to individual provisions. Treat any breach as enforceable, and treat a claimed on-the-spot fine amount for a specific provision as something to confirm with your compliance adviser against the current, in-force text, not something this article can responsibly state as settled.

The Enforcement Anchor

No infringement notice, determination or complaint outcome exists under the Medicines, Poisons and Therapeutic Goods Regulation 2026 itself. It cannot, because the Regulation has not commenced.

What does exist is a recent NSW Health Care Complaints Commission decision showing the same regulator acting on the same underlying failure under current law. An unregistered practitioner, Huirong Zhou, operating Rui Mei Beauty Salon in Burwood, administered botulinum toxin, a Schedule 4 medicine, to a 62-year-old patient in October 2025. The patient developed botulism and spent five days in intensive care with lasting difficulty swallowing and speaking. According to reporting on the decision, the inspection found “appropriate records were not kept, and those which were found were mostly in Mandarin”. A five-year prohibition from providing any health services took effect on 19 May 2026.

That case predates the new Regulation and involves an unregistered operator, not a registered clinic. It shows the regulator already prosecuting the exact failure Category 2’s recordkeeping duties are built to prevent: an undocumented Schedule 4 administration with no usable record afterward. Once Part 9 commences, that same kind of failure falls squarely within the Category 2 recordkeeping duties this article describes, with a case for the regulator to act on the paper trail rather than its absence.

Where This Gets Hard

The honest limit here is sourcing. legislation.nsw.gov.au blocks automated access to the Regulation’s full text, so the pinpoint section-by-section, subsection-by-subsection detail an earlier draft of this article asserted (specific citations like “section 90” or “section 94(2)”) could not be independently verified and has been generalised or removed. What is confirmed, directly from NSW Health’s own published guidance pages rather than the primary register, is the Regulation’s existence, its made date of 3 July 2026, its commencement date of 5 November 2026, the correct citation (statutory rule 2026-330), the substances Part 9 covers, the administration model, the broad content a written direction must contain, and the existence of a Category 1/Category 2 split with real penalties attached. Treat the category-level description in this article as a reasonable build brief and treat any pinpoint section citation as something your compliance adviser should confirm by opening sl-2026-330 on the official register before you rely on it for a specific legal position, particularly if any amendment lands before commencement.

NSW Health’s guidance says a written direction must record the number of times and intervals at which a substance may be administered and stays valid for at most six months from the prescriber’s personal review; the build consequence is a direction record with a hard expiry your booking and patient record system enforces on its own, not a paper form filed and forgotten. Whether your particular direction workflow satisfies the Regulation in full is a question for your medical defence organisation or your lawyer.

Status

Passed but not yet commenced, as at 18 September 2026. The Medicines, Poisons and Therapeutic Goods Regulation 2026 (NSW) was made and published on 3 July 2026 as statutory rule 2026-330, and commences on 5 November 2026. Nothing in Part 9, including the Category 1 and Category 2 requirements described above, applies before then. Until commencement, cosmetic use substance administration in NSW remains governed by the Poisons and Therapeutic Goods Act 1966 and the Poisons and Therapeutic Goods Regulation 2008.

Frequently Asked Questions

What is the difference between Category 1 and Category 2 under NSW’s cosmetic use substance rules?

Category 1 requirements cover who can administer a cosmetic use substance, the checks a prescriber must make before giving a direction, and the responsible provider’s risk management duties. Category 2 requirements cover the recordkeeping around that administration, the written direction itself, what it must contain, how it is stored, and who keeps copies. Category 1 breaches sit toward the higher end of the Regulation’s penalty scale and Category 2 breaches toward the lower end, but the pinpoint section numbers behind this split could not be independently confirmed, since legislation.nsw.gov.au blocks automated access, and are not asserted here as settled citations.

When do the Category 1 and Category 2 cosmetic requirements commence in NSW?

The Medicines, Poisons and Therapeutic Goods Regulation 2026 (NSW) commences on 5 November 2026. It was made and published on 3 July 2026 as statutory rule 2026-330, so as at the publish date of this article it exists as law but is not yet in force.

Does the Category 1 and Category 2 framework apply to a doctor who injects a patient personally?

No. Administration is restricted to medical and nurse practitioners acting in the lawful practice of their profession, nurses acting under a practitioner’s direction, hospital personnel under a practitioner’s direction, and veterinary practitioners for animals. It is aimed at nurse-administered treatment under a medical practitioner’s or nurse practitioner’s direction, the model most NSW cosmetic injectable clinics already run on.

What happens if a clinic breaches a Category 2 recordkeeping requirement?

NSW Health’s published guidance describes a tiered penalty structure across the whole Regulation, from 20 to 400 penalty units for an individual and 100 to 2,000 for a corporation, worth $2,200 to $44,000 and $11,000 to $220,000 at the current $110 penalty unit value. Which specific tier attaches to a specific Category 2 provision, and whether NSW Health can issue an on-the-spot penalty notice for it, could not be confirmed against the primary register and is not stated here as settled fact.

Get Your Direction and Booking Path Reviewed

RockingWeb can check how your booking flow, intake and patient record system connect, alongside where a Category 2 direction record would need to live before 5 November 2026. For a scoped fix or a discovery call, talk to us about your clinic’s build. For the wider booking-system integration angle, see the systems your site must now talk to.

Sources

NSW Legislation - Medicines, Poisons and Therapeutic Goods Regulation 2026, sl-2026-330, Part 9. The official register blocks automated access, so this article does not cite section-by-section, subsection-by-subsection numbers as pinpoint references; a reader relying on a specific clause should open this page directly and confirm the current, in-force text. Checked 18 September 2026.
NSW Health - Medicines, Poisons and Therapeutic Goods Legislation overview, confirming the Regulation’s citation (sl-2026-330) and its 5 November 2026 commencement. Checked 18 September 2026.
NSW Health - Medicines, Poisons and Therapeutic Goods Legislation Update, confirming the Regulation was made and published on 3 July 2026 and commences 5 November 2026. Checked 18 September 2026.
NSW Health - Cosmetic use medicines guidance, confirming the substances covered, who may administer them, the broad content a written direction must contain, records and storage duties, and the Regulation’s general penalty-unit tiers. Checked 18 September 2026.
NSW Judicial Commission - Sentencing Bench Book, penalty unit value of $110 under the Crimes (Sentencing Procedure) Act 1999, section 17. Checked 18 September 2026.
Mondaq - reporting on the NSW Health Care Complaints Commission prohibition order against Huirong Zhou, Rui Mei Beauty Salon, Burwood. Checked 18 September 2026.
AHPRA - Guidelines for registered health practitioners who perform non-surgical cosmetic procedures, 2 September 2025, for context on which practitioners the national advertising and performance guidelines cover alongside this state-level Regulation. Checked 18 September 2026.
Juvae - industry commentary (6 July 2026) independently corroborating that Part 9 introduces a Category 1 and Category 2 framework for cosmetic medicine with enforceable penalties. Checked 18 September 2026.

Last reviewed: 18 September 2026.