What to check before AI drafts a psychosocial risk assessment
The de-identification rule, the never-do list, the files to load and the three-stage prompt sequence for letting AI assist a psychosocial risk assessment without touching the risk ratings.
Psychosocial risk assessment AI pre-flight check · Free, no sign-up · Plain markdown
Psychosocial survey data is some of the most sensitive material an organisation holds. Free-text comments routinely name a manager, describe a specific incident, or disclose a worker's mental health. None of that should travel to a general consumer chatbot.
This is the setup discipline from the psychosocial risk assessment explainer, pulled out as a pre-flight check: the de-identification rule, the boundaries the assistant must never cross, the files to load, and the three prompts that cover the assist phases.
How to use it
Work down the check before any data reaches a model, then run the three prompts in sequence. Each prompt is scoped to one permitted task, and the third deliberately produces a draft with blank ratings.
The competent person keeps every judgement. The assistant never assigns a risk rating, never picks a single control as the answer, and never signs anything off.
The artefact
Section 1: de-identification, before anything reaches the model
Never paste real personal, claim, health, or incident data into a model that is not an approved enterprise instance.
Strip the data to placeholder tokens at the source:
Aggregate where you can, so the input is themes and counts rather than individual stories. De-identification is not a step the model does for you. It is a control you apply before the model sees anything.
Section 2: the boundaries the assistant never crosses
It never assigns, suggests, or pre-fills a risk rating, likelihood, or consequence score. Every rating field is left blank and marked [COMPETENT PERSON TO DETERMINE].
It never selects or recommends a single control as the answer. It may list candidate controls drawn from the Code for a human to choose from.
It never signs off, approves, or states that the assessment is complete.
Section 3: the project instructions
Create a project called "Psychosocial Risk Assistant" and paste this into the custom instructions or project description field.
Prompt
ROLE
You are a WHS drafting assistant for an Australian financial-services organisation.
You help a competent WHS person prepare a psychosocial risk assessment under the
Safe Work Australia Model Code of Practice: Managing psychosocial hazards at work
(July 2022) and the relevant adopting jurisdiction's WHS laws.
WHAT YOU DO
1. Identify candidate psychosocial hazards by reference to the uploaded model
Code of Practice hazard categories.
2. Synthesise de-identified survey and consultation data into themes.
3. Draft the written risk assessment with ALL risk-rating fields left BLANK.
WHAT YOU NEVER DO
- You NEVER assign, suggest, or pre-fill a risk rating, likelihood, or
consequence score. Leave every rating field blank and marked
"[COMPETENT PERSON TO DETERMINE]".
- You NEVER select or recommend a single control as "the answer". You may list
candidate controls drawn from the Code for a human to choose from.
- You NEVER sign off, approve, or state that the assessment is complete.
DATA RULES
- Treat all input as already de-identified. If you ever see what looks like a
real name, claim number, or incident ID, stop and warn the user.
- Use only the placeholder tokens [EMPLOYEE_NAME], [CLAIM_NUMBER],
[INCIDENT_ID], [TEAM], [ROLE], [SITE], [DATE].
STYLE
- Australian English. No em dashes. Clinical, evidence-first, no hype.
- When you map a theme to a hazard category, name the category exactly as it
appears in the uploaded Code.
- End substantive outputs with: "Human review required before use."
Section 4: the files to load
The Safe Work Australia model Code of Practice, or your jurisdiction's adopted version, as a PDF.
A de-identified export of your psychosocial survey, with all free-text scrubbed to placeholder tokens and all individual identifiers removed.
De-identified consultation notes from worker forums, health and safety representative meetings, or focus groups, again scrubbed to placeholders.
Optionally, your organisation's existing risk matrix template, with the rating cells left empty.
Section 5: the three prompts
Prompt 1: synthesise de-identified survey themes.
Prompt
Here is a de-identified export of free-text responses from our most recent
psychosocial survey for [TEAM] at [SITE]. All names, claim numbers, and
incident IDs have been replaced with placeholder tokens.
Cluster these responses into no more than 12 themes. For each theme give:
- a short theme label (5 words or fewer)
- an approximate count or proportion of responses that touch it
- 2 to 3 representative de-identified quotes
Do NOT assess severity or risk. Do NOT recommend controls yet. Just surface
the themes and how often they appear.
[PASTE DE-IDENTIFIED SURVEY EXPORT BELOW]
Prompt 2: map themes to the Code's hazard categories.
Prompt
Using the uploaded model Code of Practice, map each theme below to the
psychosocial hazard category or categories it relates to. Name each category
exactly as it appears in the Code (for example high job demands, low job
control, poor support, exposure to traumatic events, violence and aggression,
low role clarity, poor workplace relationships).
For each theme, give:
- the matching hazard category name(s) from the Code
- a one-line note on why the theme maps there
- a flag if a theme does not map cleanly to any Code category
Do NOT rate any hazard. Do NOT propose controls.
[PASTE THE THEMES FROM PROMPT 1 BELOW]
Prompt 3: draft the assessment with blank rating fields and candidate controls.
Prompt
Draft a written psychosocial risk assessment for [TEAM] at [SITE] using the
themes and hazard-category mappings below.
Structure each entry as a row with these columns:
- Hazard category (from the Code)
- Description of how it presents for this team (de-identified)
- Who is exposed
- Likelihood: leave as "[COMPETENT PERSON TO DETERMINE]"
- Consequence: leave as "[COMPETENT PERSON TO DETERMINE]"
- Risk rating: leave as "[COMPETENT PERSON TO DETERMINE]"
- Candidate controls: list 2 to 4 options drawn from the Code's control
guidance for a human to choose from, in order of the hierarchy of control
Do NOT fill in any likelihood, consequence, or risk rating. Do NOT pick a
single control as the recommendation. End with "Human review required
before use."
[PASTE THE MAPPED THEMES FROM PROMPT 2 BELOW]
General information and education only. Not legal, compliance, financial, or professional advice. This artefact is assembled from AI-assisted psychosocial risk assessment and adds nothing to it. Free to use and adapt internally, with attribution appreciated and no warranty. Check it against your own obligations and your organisation's policies before you rely on it.