AI at Work Is Now a WHS Duty, Not Just Governance

Most organisations have filed artificial intelligence under governance. It sits with the privacy review, the procurement checklist and a policy about acceptable use. It is a technology decision with a compliance wrapper.

Safe Work Australia has just made that filing incomplete. Its new guidance on AI and digital technologies treats these systems as something a work health and safety duty holder has to manage: a source of physical and psychological hazards, subject to the ordinary risk management process, and requiring consultation with the workers affected.

That is a different conversation, with different people in the room.

What the guidance says

The guidance sets out the opportunities and the risks, and explains how duty holders can apply the standard WHS risk management process so these technologies are introduced and used safely. Two things in that sentence do the work.

“The standard WHS risk management process.” No new framework. The same identify, assess, control, review cycle already applied to plant, chemicals and manual handling. If you have a functioning WHS system, AI goes through it. If AI has instead gone through a governance committee that has never done a risk assessment, it has not been through the process at all.

“In consultation with workers and their representatives.” Consultation is a duty under the WHS Act, not a courtesy. It is also the step most AI rollouts skip entirely, because they are run as IT projects with a change-management communications plan attached. Telling people about a system is not consulting them on it.

The scope is broader than chatbots. It covers algorithmic management, workplace monitoring, automation and robotics. If software is allocating work, setting pace, scoring performance or watching people, it is in scope.

The hazards are not hypothetical

Physical risks are the easy ones to see. Automation and robotics introduce plant hazards, and those are well understood.

The psychological ones are where most organisations have no controls at all, and they are the ones the guidance draws out:

Work pace and intensity set by an algorithm that does not know a worker is unwell, new, or covering for someone.
Monitoring and surveillance, and the effect of being measured continuously.
Loss of autonomy and control, which is one of the best-evidenced psychosocial hazards there is.
Job insecurity during a rollout that nobody has explained properly.
Unclear accountability when a system makes a call and no human can say why.

Those map directly onto psychosocial hazards that are already regulated across Australian jurisdictions. Which means for many organisations this is not a new duty. It is an existing duty arriving through a door nobody was watching.

NSW has already legislated

Guidance is guidance. But the direction of travel is no longer speculative.

The Work Health and Safety Amendment (Digital Work Systems) Act 2026 received assent in New South Wales on 18 February 2026. It inserts a new section 21A into the NSW WHS Act requiring a PCBU to ensure, so far as is reasonably practicable, that a worker’s health and safety is not put at risk by the allocation of work by a digital work system, which the Act defines as an algorithm, artificial intelligence, automation or online platform. It also requires PCBUs to consider excessive or unreasonable workloads, excessive or unreasonable performance metrics, excessive or unreasonable monitoring and surveillance, and discriminatory decision-making.

The duty is not yet in force. What commenced on assent were the provisions requiring SafeWork NSW to consult on and publish guidelines. Section 21A itself, and the new power for a WHS entry permit holder to require assistance to access and inspect a digital work system, commence on a day to be appointed by proclamation, and no date has been announced. For the entry and inspection provisions the Act sets a floor: they cannot start earlier than one month after those first guidelines are published. The duty is not bound by that floor, so it could be proclaimed sooner.

If you operate in NSW, or you have workers there, the question is no longer whether AI sits inside your WHS obligations. It is whether you can demonstrate you have treated it that way.

Where ISO 42001 and ISO 45001 meet

This is the practical problem, and it is an organisational one before it is a technical one.

ISO 42001, the AI management system standard, handles the governance side properly: what AI you have, what it is for, who owns it, how risk is assessed, what happens when it behaves unexpectedly. Its Annex A controls cover impact assessment, data governance and human oversight.

ISO 45001 handles the safety side: hazard identification, consultation, the hierarchy of controls, incident reporting.

In most organisations those two live in different buildings. The AI register sits with IT or legal. The risk register sits with the safety team. The AI system that sets work pace appears in the first one as a productivity tool and does not appear in the second one at all.

Tilt-shift view of an office desk running an analytics dashboard and a warehouse bench with a hi-vis vest and hard hat, separated by a partition, with a single lit line running across the divide — The AI register on one side of the partition, the risk register on the other. The line across the middle is the part most organisations have not built yet.

That is the gap the guidance closes, and closing it is not complicated:

One register, or two registers that talk. Every AI or algorithmic system that touches how work is allocated, paced, monitored or assessed should appear in your WHS hazard identification, not only in your AI inventory.

Consultation that satisfies the WHS Act. Health and safety representatives involved before deployment, not briefed after it. Records kept, because consultation you cannot evidence did not happen as far as a regulator is concerned.

Psychosocial risk assessment as standard. Treat an algorithmic management tool the way you would treat a change to rosters or workload, because functionally that is what it is.

Human oversight that is real. ISO 42001 asks for it. Make sure the person nominated can actually intervene, and has the authority and the time to do so.

A route for reporting. Workers need somewhere to raise that a system is producing unsafe pressure, and it needs to reach the safety function rather than a product backlog.

None of that requires new machinery if you already run a management system. It requires the two systems you have to stop ignoring each other.

Update, 4 September 2026. WorkSafe Victoria has charged the operator of a Ravenhall distribution centre and its warehouse robotics supplier following the death of a 27 year old worker in September 2024, after he came into contact with an energised and operating automated robot. The charges are allegations, nothing is proven, and the matters are listed for a filing hearing in the Melbourne Magistrates’ Court on 28 September 2026.

The shape of the charges is the part worth reading. Both companies are charged under section 21 of the Victorian OHS Act, the employer’s duty to its own employees. WorkSafe alleges the operator failed to guard the access points to the robot grid with an interlocked physical barrier, and failed to ensure access happened only after the grid was de-energised and locked out. It alleges the robotics supplier failed to provide a safe system of work for access to an energised grid, and failed to provide the supervision needed to keep its own employees off it. The operator faces two further charges under section 23, which covers people who are not its employees.

So this is not a case about upstream design or supply duties. It is two employers whose people worked on the same automated system, each answering for its own workers. If your automation vendor has technicians on your site, you are both employers in the same space, and the questions are ordinary ones: who de-energises, who verifies it, who supervises, and which of you carries it when the answer is not written down anywhere. Under ISO 45001 that is clause 8.1.4, contractors and procurement. Under ISO 42001 it is third party management with documented instructions and oversight. Most contracts for automated plant address neither, and that is worth settling before an incident rather than after one.

The straightforward question

If a regulator asked tomorrow how you had assessed the health and safety risks of the AI you have deployed, and how you had consulted workers about it, could you answer with documents?

For most organisations the honest answer today is that the AI decision is well documented and the safety assessment does not exist, because nobody thought it was that kind of decision.

It is now.

We work with organisations on ISO 42001 AI management systems and on ISO 45001, and increasingly on the join between them, which is where this particular duty actually gets discharged.

Sources

General guidance only. This article is general information, not legal, financial, safety or compliance advice, and it does not take account of your specific circumstances. Streamline ISO Consultants are ISO management-system consultants, not lawyers or licensed advisers. Standards, laws and regulator guidance change, and details were correct only at the time of writing. Always seek professional advice before acting. See our full Disclaimer.