Someone outside your business will ask how the system decides.
New South Wales passed the Work Health and Safety Amendment (Digital Work Systems) Act 2026 on 12 February 2026, and it received assent on 18 February 2026 as Act No 5 of 2026. Most of the commentary at the time focused on the new duty, and rightly, because it is the first Australian law to name algorithms and artificial intelligence directly in a work health and safety statute. We covered that duty when it passed, in the WHS obligation NSW teams already hold.
The provision HR teams should be reading now is a different one, and it has had almost no attention. Schedule 1[5] inserts section 118(1)(a1) into the Work Health and Safety Act 2011 (NSW). It gives a WHS entry permit holder the power to "require the relevant person conducting a business or undertaking to provide the WHS entry permit holder with reasonable assistance to access and inspect a digital work system relevant to the suspected contravention".
Read that slowly. A union official investigating a suspected contravention will be able to require your business to help them look inside the system that allocates work to your people.
What the Act actually covers
The definition is deliberately wide. Schedule 1[1] inserts into section 4 that a "digital work system means an algorithm, artificial intelligence, automation or online platform". There is no carve-out for systems bought off the shelf, no threshold for how much of the decision the system makes, and no requirement that anyone call it AI.
That definition then does work in two places.
Section 19(3)(c1), inserted by Schedule 1[2], extends the primary duty of care so that a business must ensure, so far as is reasonably practicable, that "the health and safety of workers is not put at risk from the use of digital work systems by the business or undertaking".
New section 21A goes further and is the provision most relevant to HR. Subsection (1) requires a business to ensure, so far as is reasonably practicable, that the health and safety of a worker is not put at risk from the allocation of work by a digital work system it uses. Subsection (2) then requires the business to consider whether the allocation of work by or using a digital work system creates or results in any of four risks:
- excessive or unreasonable workloads for workers
- the use of excessive or unreasonable metrics to assess and track the performance of workers
- excessive or unreasonable monitoring or surveillance of workers
- unlawful discriminatory practices or decision-making in the conduct of the business
Those four categories are a fair description of the arguments HR teams have been having internally about workforce technology for three years. They are now a statutory checklist, and the inspection power exists so that someone can test whether the business has actually run it.
Why has it not started, and how long do you have?
The Act is passed but the operative provisions are staged, and the staging is where the preparation window comes from.
Section 118(2A), inserted by Schedule 1[7], says the power may be exercised only if the permit holder has, during business hours, given notice of the proposed entry at least 48 hours and not more than 14 days before the entry, and that the power "is subject to guidelines made by the regulator under section 118A". A note added to section 117 restates the notice requirement.
Section 118A then requires the regulator to issue and publish guidelines about the power, and to conduct public consultation on them first. The transitional provision at Schedule 1[11] adds a phased application rule: a permit holder may exercise the power only if guidelines relevant to the exercise of the power have been published, with an example making clear that where no guidelines exist for a particular class of workplace, the power cannot be exercised for a business at a workplace in that class.
The commencement clause ties it together. Schedule 1[7], [9] and [11], the notice condition, the guidelines-making power and the transitional rule, commenced on assent on 18 February 2026, which is why SafeWork NSW can be consulting on guidelines now. Everything else commences on a day appointed by proclamation, and for every provision other than the definition, the section 19 amendment and section 21A, that day must not be earlier than one month after the first section 118A guidelines are published.
SafeWork NSW has published its consultation plan for the guidelines and describes a staged process: early targeted consultation with stakeholders, then further targeted consultation, then public consultation of four to six weeks on the NSW Have Your Say platform. SafeWork NSW states that the remaining provisions, including the entry permit holder power itself, will commence when the NSW Government announces a start date, and that this date must be at least one month after the guidelines are published.
Two things follow. First, nobody is inspecting anything until the guidelines are published and a start date is then proclaimed, and those two events must sit at least a month apart. Second, the definition, the section 19 amendment and the section 21A duty are not subject to the guidelines constraint, so those obligations can switch on before the inspection power does.
The practitioner play: build the system statement
The preparation is not a legal strategy. It is a document, one per digital work system, and it should be written now while nobody is asking for it.
- Inventory the systems that allocate, measure or monitor work. Start from the four risks in section 21A(2) rather than from the IT asset register, because the asset register is organised by vendor and the duty is organised by effect. Rostering and shift allocation, task and queue assignment, productivity and activity dashboards, quality scoring, and any AI assistant that distributes or prioritises work all belong on the list.
- For each one, write a plain description of what it does. In language a delegate could read: what inputs it takes, what it produces, whether it allocates or only recommends, and how often a human changes the output. If nobody in HR can write that paragraph without a vendor call, that is the finding.
- Record the measurement. What metrics does the system apply to a person, what thresholds trigger something, and what happens when a threshold is crossed. Section 21A(2)(b) speaks to excessive or unreasonable metrics, so a business that cannot state its metrics cannot argue about their reasonableness.
- Name the override. Who can change an allocation, on what grounds, how often it happens, and whether the override is recorded. This is the single most useful line in the document, because it is the difference between a system that allocates work and a system that suggests work.
- Attach the consultation record. Under the existing WHS duty to consult, and separately under the consultation clause an AI rollout already triggers, most of these systems should have generated a consultation record when they were introduced. Where one exists, file it with the statement. Where one does not, treat the gap as live work rather than a historical problem, along the lines set out in rolling out AI as a workplace change.
- Review it against the four risks and write down the conclusion. Not a rating. A sentence per risk saying what was considered and what was decided. Section 21A(2) requires the business to consider; a consideration nobody recorded is indistinguishable from one that never happened.
Worked example. [ORGANISATION] runs a scheduling platform that assigns service jobs to field staff. The system statement records that it allocates directly rather than recommending, that it scores completion time against a target derived from historical averages, that a supervisor can reallocate but that reallocations were not logged until March, and that the introduction was consulted through the health and safety committee with minutes attached. Against section 21A(2)(a) the business records that it reviewed allocation volumes for [TEAM] and adjusted the target after finding it was set from a period with different job mix. That paragraph, written calmly in advance, is a better answer to an inspection than any position a lawyer can take in 48 hours.
The governance line
Three boundaries are worth stating plainly.
The inspection power is tied to a suspected contravention, not to general curiosity, and it comes with a notice requirement and regulator guidelines. It is not an open door to source code, and the statute asks for reasonable assistance to access and inspect, which is a different thing again. A dispute about the exercise or purported exercise of a right of entry is dealt with under Part 7, Division 6, and the note to section 21A points to section 142, under which the Industrial Relations Commission may deal with the dispute in any manner it thinks fit.
Privacy still applies to whatever the system holds about individuals. Preparing for an inspection is not a reason to assemble a new dataset about named workers, and the material in a system statement should describe the system rather than profile the people it manages. The related question of what protection employee records actually attract is covered in your employee data is exempt, and that is not permission.
The human decision boundary does not move. A system may allocate, score or flag. A person still decides what to do about a pattern, and the accountability for that decision stays where it always was. That principle is the same one that governs AI-drafted performance documents, and it holds here for the same reason.
What never to automate in this preparation
Do not let a model write the system statement from the vendor's marketing material. The statement is an assertion by the business about what its own system does, and its value comes from someone in the business having verified it. AI is useful for turning a technical export into readable prose, for drafting the consultation summary from existing minutes, and for checking a draft against the four statutory risks. It is not useful for deciding whether a workload is excessive, whether a metric is reasonable, or whether a pattern of allocation is discriminatory. Those are judgements the business has to own, and they are exactly the judgements an entry permit holder will test.
Bottom line
New South Wales has created a statutory reader for systems most organisations have never documented. The power is not live and will not be for some months. The only version of this that goes badly is the one where the guidelines are published, a start date is proclaimed, and HR begins writing the first description of its rostering engine on day one of a two day notice period.
Do this Monday
- List every system that allocates, measures or monitors work, organised by what it does rather than who sold it
- Pick the three with the most workers exposed and draft a one page system statement for each
- Find and file the consultation record for each of those three, or note that none exists
- Record a sentence per risk against section 21A(2) for each system, including what was decided
- Put the SafeWork NSW guidelines consultation on your regulatory watch list with a named owner
TheAICommand. Intelligence, At Your Command.
