Use AI for the mechanical parts of a psychosocial risk assessment, clustering de-identified survey free-text into themes and drafting the written assessment, while a nominated competent person, after consulting workers, sets the risk rating, chooses the controls, and signs off. A psychosocial risk assessment is one of those documents that takes a week of careful work and reads like it took an afternoon. You consult workers, you read free-text survey responses, you sort the noise into themes, you map those themes to recognised hazard categories, and only then do you sit down to write the assessment, rate each risk, and decide what controls are reasonably practicable. The reading and the drafting are slow. The judgement is the part that actually matters.
This is exactly the shape of work where a large language model earns its place, and exactly the shape where it must be fenced off from the decision. AI can cluster hundreds of de-identified survey comments into themes in seconds. It can suggest which hazards in your jurisdiction's approved code of practice those themes relate to. It can produce a clean first draft of the written assessment. What it must never do is assign a risk rating or sign the document. Under Australian work health and safety law, the duty to manage psychosocial risk sits with the person conducting a business or undertaking (PCBU), and section 14 of the WHS Act is blunt: "A duty cannot be transferred to another person." A tidy table produced by a model changes nothing about who answers for the assessment.
This guide sets out a defensible workflow for an Australian financial-services WHS function. It is built around a worked example most readers will recognise: managing psychosocial hazards in a national insurer's claims contact centre. The same pattern applies to a bank's collections team, a super fund's member-services line, or any regulated environment where people absorb pressure on behalf of the organisation.
Which Australian laws govern psychosocial risk assessment?
Australian WHS law is built on a set of model laws developed by Safe Work Australia and then adopted, with variations, by each jurisdiction. This matters before you automate anything, because the exact obligation you are meeting depends on where your workers sit.
The Safe Work Australia Model Code of Practice: Managing psychosocial hazards at work, dated July 2022, explains how to identify psychosocial hazards, assess and control the risks, review the controls, and record the process. It is a template, not law. Safe Work Australia states: "To have legal effect, a model Code of Practice must be approved as a code of practice in a jurisdiction." The code to anchor any AI workflow to is therefore the approved code for the jurisdiction where your workers sit, not the model. Sitting above the codes, the model WHS Regulations introduced specific psychosocial provisions, regulations 55A to 55D: they define a psychosocial hazard and psychosocial risk, require a PCBU to manage psychosocial risks in accordance with Part 3.1 of the Regulations, and list the matters a PCBU must have regard to when deciding control measures, starting with "the duration, frequency and severity of the exposure of workers and other persons to the psychosocial hazards" and "how the psychosocial hazards may interact or combine". Safe Work Australia's own announcement of the new regulations and Code stresses that they "do not automatically apply in a jurisdiction". The primary duty of care already lived in section 19 of the model WHS Act, and the Act defines health as "physical and psychological health".
The model laws are adopted differently across the country, and the position has moved since this guide was first published. As at 10 October 2026:
- Commonwealth (Comcare scheme). The Work Health and Safety Act 2011 (Cth), regulated by Comcare, covers Commonwealth and other Comcare-scheme employers. The psychosocial amendments to the Commonwealth WHS Regulations commenced on 1 April 2023. The operative code is the Work Health and Safety (Managing Psychosocial Hazards at Work) Code of Practice 2024 (F2024L01380), registered on 1 November 2024, which lists 17 common hazards: the model Code's 14 plus Fatigue, Job insecurity and Intrusive surveillance. Comcare's regulatory guide on managing psychosocial hazards sits alongside it.
- New South Wales. The NSW Code of Practice: Managing psychosocial hazards at work was issued in May 2021, ahead of the national model. Since 1 July 2026, section 26A of the NSW WHS Act requires PCBUs to comply with approved codes of practice or to manage hazards and risks in a way that is equivalent or higher. SafeWork NSW says codes now "become the minimum performance standards that a PCBU is expected to comply with".
- Victoria. Victoria has not adopted the model laws. The Occupational Health and Safety (Psychological Health) Regulations 2025 and WorkSafe Victoria's Compliance code: Psychological health "are in effect from 1 December 2025". The compliance code names its hazards differently, for example "High job demands" and "Exposure to traumatic events or content".
- Western Australia. WA is a model-law jurisdiction. Its psychosocial hazards code of practice "is issued by the Work Health and Safety Commission (the Commission), under provisions of the Work Health and Safety Act 2020", and it points to separate codes for bullying, harassment, discrimination and misconduct, and for violence and aggression from customers and clients.
- South Australia. SafeWork SA states that its psychosocial code of practice "commenced in South Australia on 19 February 2026".
- Elsewhere. Check your regulator's site for the approved code in force where your workers sit.
Internationally, ISO 45003:2021 gives guidance on managing psychosocial risk inside an ISO 45001 management system, and is worth a read as a structuring reference, though it is a voluntary standard rather than Australian law.
The practical takeaway: confirm which jurisdiction governs your workers, load that jurisdiction's approved code into the workflow rather than the model Code, and verify the specific provision against the adopting jurisdiction before you cite a number in a document that may be read in evidence. An employer with workers in several jurisdictions may need more than one code.
What can AI do, and what must a competent person keep?
Set this boundary in writing before anyone opens a chat window. It is the single most important governance control in the whole workflow.
AI may assist with three things, and only three:
- Suggesting candidate psychosocial hazards by reading your jurisdiction's approved code and proposing which of its listed hazards may be present. A person checks every suggestion: identifying hazards is the duty holder's job, and the code itself warns that "The list and the examples in the descriptions are not exhaustive".
- Synthesising de-identified survey and consultation data into themes, so a human is reading twelve clusters instead of three hundred raw comments.
- Drafting the written risk assessment, with the rating fields deliberately left blank.
A competent person always does the rest, after consulting workers: assessing the risks, selecting the controls and testing whether they are reasonably practicable, and signing off. The model never assigns a risk rating, and the model never signs. If your drafting tool ever returns a populated risk-level column, you treat that as a defect in the prompt, delete it, and put the rating back in human hands.
Be precise about what that human gate is. It is a governance control the organisation sets, not a requirement of WHS law. Regulation 5 of the WHS Regulations defines "competent person" for listed technical tasks, such as electrical work and asbestos clearance inspections, and for any other case as "a person who has acquired through training, qualification or experience the knowledge and skills to carry out the task". Regulations 55A to 55D impose no competent-person, written-record or sign-off requirement. Contrast confined spaces, where regulation 66 expressly requires "that a risk assessment is conducted by a competent person". The psychosocial duty sits with the PCBU under section 19 and regulation 55C, it cannot be transferred (section 14), and officers must exercise due diligence to ensure the PCBU complies (section 27). The Commonwealth Code treats a written record as good practice rather than a mandate: "If you do not have a written record, you will need to demonstrate by other means how you have met your duties." A named, competent sign-off is how you show that the duty holder's judgement, not a model's, decided the outcome.
Does the psychosocial survey count as consultation?
Not on its own. Consultation is a legal duty with defined content, and it runs through the whole assessment, not just the data-gathering step. Under section 47 of the WHS Act, the PCBU must, so far as is reasonably practicable, consult workers who are, or are likely to be, directly affected. Section 48 sets out what consultation requires: "that relevant information about the matter is shared with workers", a reasonable opportunity "to contribute to the decision-making process relating to the matter", "that the views of workers are taken into account", and "that the workers consulted are advised of the outcome of the consultation in a timely manner". If workers are represented by a health and safety representative, the consultation must involve that representative. Section 49 says when consultation is required, including "when identifying hazards and assessing risks" and "when making decisions about ways to eliminate or minimise those risks".
A survey can carry part of that load, but not all of it. The Commonwealth Code of Practice 2024 says: "Surveys must not replace agreed consultation procedures unless agreed with your workers, however they can be used as an additional tool for consultation." In this workflow, the survey export and the model's themes are inputs to consultation, not the consultation itself. Share the draft hazards and candidate controls with workers and their HSRs before the ratings and control choices are settled, take their views into account, and tell them what was decided. Read the de-identified comments yourself as well as the clusters, because a theme count can bury a single serious disclosure.
There is a second, non-negotiable rule that sits alongside the boundary, and it deserves its own heading.
A standing note on de-identification
Never paste real personal, claim, health, or incident data into a model that is not an approved enterprise instance. Psychosocial survey data is some of the most sensitive material an organisation holds. Free-text comments routinely name a manager, describe a specific incident, or disclose a worker's mental health. None of that should travel to a general consumer chatbot.
Before any data reaches the model, strip it to placeholder tokens: [EMPLOYEE_NAME], [CLAIM_NUMBER], [INCIDENT_ID], [TEAM], [ROLE], [SITE], [DATE]. Aggregate where you can, so the input is themes and counts rather than individual stories. Every prompt in this article assumes the data has already been de-identified at the source. The de-identification is not a step the model does for you. It is a control you apply before the model sees anything.
Setting up the Psychosocial Risk Assistant project
Both ChatGPT Projects and Claude Projects let you create a persistent workspace with its own custom instructions and uploaded reference files. That is the right container for this work, because it keeps the model anchored to your jurisdiction's approved code and the de-identification rule on every turn, rather than relying on you to restate them.
Create a project called "Psychosocial Risk Assistant" and paste the following block into the project's custom instructions or project description field.
Then upload the files-to-upload checklist below into the project so the model has them on hand:
- The approved psychosocial code for the jurisdiction where your workers sit, as a PDF: for Comcare-scheme employers, the Commonwealth Code of Practice 2024 (F2024L01380); in Victoria, the Compliance code: Psychological health. Not the Safe Work Australia model Code, which is a template. Add any companion codes your regulator points to, such as Western Australia's separate codes on workplace behaviour and on violence and aggression at work.
- A de-identified export of your psychosocial survey, with all free-text scrubbed to placeholder tokens and all individual identifiers removed.
- De-identified consultation notes from worker forums, health and safety representative meetings, or focus groups, again scrubbed to placeholders.
- Optionally, your organisation's existing risk matrix template, with the rating cells left empty.
The prompt library
Three prompts cover the assist phases. Each is scoped to one of the three permitted tasks, and the third deliberately produces a draft with blank ratings.
The standing reminder applies to every prompt: never paste real personal, claim, health, or incident data into a model that is not an approved enterprise instance. The prompts below assume your input is already de-identified.
Prompt 1: synthesise de-identified survey themes.
Prompt 2: suggest hazard matches from the code, for a person to check.
Prompt 3: draft the assessment with blank assessment fields and candidate controls.
Why duration, frequency and severity columns? Because that is how the Commonwealth Code tells you to assess psychosocial risk: "To assess the risk of harm, you need to identify the workers affected and consider the duration, frequency and severity of their exposure." It also says: "Consider psychosocial hazards collectively rather than in isolation." If your organisation's risk matrix expresses the result as likelihood and consequence, apply it to those inputs, not in place of them.
A worked example, end to end
Take a national general insurer running a claims contact centre. For this example the insurer is a Comcare-scheme employer, so the Commonwealth Code of Practice 2024 applies. The WHS lead, whom the insurer has nominated as the competent person for this assessment, is preparing the annual psychosocial risk assessment for the team. The contact centre handles distressed customers making claims after fires, floods, and motor accidents. The known pressures are obvious to anyone who has worked the phones: high job demands, low control over call flow, and repeated exposure to other people's worst days.
Setup. The WHS lead creates the Psychosocial Risk Assistant project, pastes in the custom instructions above, and uploads the Commonwealth Code of Practice 2024, a de-identified survey export, and consultation notes from two worker forums and the team's HSR meeting. Before uploading, the survey export is scrubbed at source, so a comment that once named a team leader and a fatality claim now reads "my team leader [EMPLOYEE_NAME] told me to take the next call straight after a fatality claim, claim [CLAIM_NUMBER]", with the real name and number already removed.
Synthesise. The lead runs Prompt 1. The model returns themes such as "back-to-back distressing calls", "no recovery time between calls", "unclear escalation path", "low say over rosters", and "manager support varies by shift", each with an approximate count and a few de-identified quotes.
Map and check. The lead runs Prompt 2. The model suggests matches against the Code's hazards: back-to-back distressing calls relates to Traumatic events or material; no recovery time and tight call targets relate to Job demands; low say over rosters relates to Low job control; variable manager support relates to Poor support. It notes that the distressing-call and workload themes combine for the same consultants. It flags one theme, "the new claims system keeps crashing", as not matching a listed hazard. The lead's check overturns that flag: the Code's Poor support examples include "lack of functional or adequate IT systems", so the theme stays in the assessment under Poor support. That is exactly why a person checks every suggestion.
Draft. The lead runs Prompt 3. The model produces a clean assessment table. Every duration, frequency, severity, and risk-rating cell reads [COMPETENT PERSON TO DETERMINE]. The candidate-controls column offers options drawn from the Code, ordered by the hierarchy of control: redesigning call routing to build in recovery time, capping consecutive high-distress calls, clarifying the escalation path, and offering trauma-informed support. An illustrative fragment of that draft:
The human decision gate. This is where people take over, and it is explicit. The WHS lead reads the draft against the consultation record and the de-identified comments, then takes the draft hazards and candidate controls back to the consultants and their HSR before anything is settled. With their views on the record, the lead assesses the duration, frequency and severity of exposure, considers the traumatic-call, workload and system-outage hazards together, applies the organisation's risk matrix, and determines that the combination is, on the evidence, a high risk requiring immediate attention. The model did not reach that conclusion. The lead did, after consulting the people exposed. From the candidate controls, the lead selects two to implement now, recovery time in the call-routing logic and a cap on consecutive high-distress calls, raises the claims-system outages with the system owner as a Poor support control action, and schedules the escalation-path work for the next quarter, recording why the other options were deferred. The lead tells the team what was decided and why. The lead then signs the assessment as the nominated competent person, dates it, and logs the de-identified source data, the consultation record and the model's drafts as the working trail. The signature is human. The rating is human. The control selection is human. The duty itself stays with the insurer as PCBU, and its officers must exercise due diligence, which includes reasonable steps to ensure the insurer has and uses appropriate resources and processes for exactly this kind of work. The model produced a faster draft and nothing more.
What does this AI workflow actually buy a WHS function?
What it buys you is time and consistency on the mechanical work. Synthesising free-text, mapping to categories, and producing a structured first draft are tasks where a model is genuinely faster and more even-handed than a tired person at the end of a survey cycle. The auditable trail, from de-identified data through to a drafted assessment with blank ratings, is itself a governance asset: it shows a regulator that the method followed the Code, that workers were consulted, and that the judgement stayed with people rather than a model.
What it does not buy you is a shortcut around the duty. The duty to manage psychosocial risks so far as is reasonably practicable, expressed through the regulations and the primary duty in the WHS Act, rests on the PCBU. It cannot be transferred, and officers must exercise due diligence to ensure the PCBU complies. A model that drafts well can make that work more thorough. It cannot make it someone else's responsibility.
If you take one thing from this piece, take the boundary. AI synthesises and drafts. People consult, then a competent person rates, selects controls, and signs. Build that into your project instructions, your prompts, and your sign-off process, and the tool stays a drafting aid rather than a liability.
Bottom line
AI earns its place on the slow, mechanical parts of a psychosocial risk assessment: clustering de-identified survey free-text into themes, suggesting matches to the hazards in your jurisdiction's approved code for a person to check, and producing a structured first draft. It never rates a risk and never signs. Consultation runs through the risk assessment and the control decisions, and the duty stays with the PCBU. The auditable trail from de-identified data to a drafted assessment with blank ratings is a governance asset, but it does not shortcut that duty.
Do this Monday:
- Write the boundary into your project instructions: AI suggests hazards, synthesises, and drafts only.
- Load the approved psychosocial code for the jurisdiction where your workers sit, not the Safe Work Australia model Code.
- De-identify all survey and consultation data to placeholder tokens at source before anything reaches the model.
- Use an approved enterprise instance, never a general consumer chatbot.
- Leave every duration, frequency, severity, and risk-rating field marked "[COMPETENT PERSON TO DETERMINE]" and treat any populated rating as a prompt defect.
- Take the draft hazards and candidate controls to workers and HSRs before the ratings and controls are settled, and tell them the outcome.
- Keep the de-identified source data, the consultation record and the model's drafts as the working trail for the competent person's sign-off.
---
General information and education only. Not legal, compliance, or professional WHS advice. WHS laws are model laws adopted differently across Australian jurisdictions, including the Commonwealth Comcare scheme; Victoria has not adopted them and regulates psychological health under its OHS laws. Verify the specific provisions that apply to your workers, and have a competent person determine all risk ratings and controls after consulting workers. Never paste real personal, claim, health, or incident data into a model that is not an approved enterprise instance.
TheAICommand. Intelligence, At Your Command.
