Rolling Out AI Is a Workplace Change: Consult and Risk-Assess First

A productivity assistant gets switched on across a team. An automated triage tool starts routing the work. A scheduling engine begins assigning shifts. In most organisations the decision to roll out a tool like this is made by someone in operations, technology or procurement, on a business case about speed and cost. The work health and safety function often hears about it after go-live, if at all.

Under Australian work health and safety law, that sequence is the wrong way around. Introducing a system that changes how work is allocated, paced, measured, monitored or decided is a change to the work itself. The duty to manage the health and safety risk of that change, including consulting the workers it affects, already sits with the person conducting the business or undertaking, the PCBU. It is not a new duty invented for AI. It is the duty you already have, applied to a new kind of system. New South Wales has now written it into statute. The rest of the country sits under duties that already reach it.

This piece is for safety leads, WHS practitioners and managers with safety duties. It sets out the duty an AI rollout touches, a practical workflow to discharge it before go-live, the psychosocial and WHS-law line that does most of the work here, and what has to stay with a person.

The safety duty AI touches

Start with the duty that has applied since 2011. Under the model Work Health and Safety Act, a PCBU must ensure, so far as is reasonably practicable, the health and safety of workers. Comcare, the Commonwealth WHS regulator, is explicit that here "health" means "physical and psychological health" (Comcare, Regulatory guide: Managing psychosocial hazards). Introducing AI does not change that duty. It changes the hazard profile the duty has to cover.

The second duty is consultation. Safe Work Australia states it plainly: a PCBU "must consult with workers and other duty holders in managing work health and safety risks", and one of the times consultation is required is when "proposing changes that might affect workers' health and safety" (Safe Work Australia, Consultation). Rolling out a tool that reshapes how people are allocated work, measured or monitored is exactly that kind of change. The consultation is not a launch email. It is a genuine opportunity for affected workers, and their health and safety representatives, to influence the decision before it is made. The model framework sets this out in its consultation provisions (sections 47 to 49) and in the Model Code of Practice: Work Health and Safety Consultation, Cooperation and Coordination.

NSW has now made the AI case express. On 18 February 2026 the Work Health and Safety Amendment (Digital Work Systems) Act 2026 (Act No 5 of 2026) received assent, after passing both Houses earlier that month (Parliament of New South Wales). It defines a "digital work system" as "an algorithm, artificial intelligence, automation or online platform", extends the primary duty of care so that a PCBU must ensure "the health and safety of workers is not put at risk from the use of digital work systems" (new section 19(3)(c1)), and adds a new section 21A (NSW legislation register). Section 21A requires a PCBU to ensure, so far as is reasonably practicable, that worker health and safety "is not put at risk from the allocation of work by a digital work system", and to consider whether that allocation creates four specific risks: "excessive or unreasonable workloads", "the use of excessive or unreasonable metrics to assess and track the performance of workers", "excessive or unreasonable monitoring or surveillance of workers", and "unlawful discriminatory practices or decision-making".

Two points matter for timing. First, the substantive duties commence by proclamation and are not tied to SafeWork NSW publishing its guidelines, so the smart move is to prepare now rather than wait for the guidance. Second, the Act builds in a review once Safe Work Australia's model laws "deal with substantially the same subject matter", which signals where this is heading nationally. Even outside NSW, the duty already reaches AI rollouts: the model WHS jurisdictions, the Commonwealth and Comcare scheme, NSW, Queensland and most states and territories, carry both the primary duty and the consultation duty today, and Victoria's Occupational Health and Safety Act 2004 imposes equivalent duties. The legal ground is the same. NSW has just made the AI part unmissable.

The practical workflow before go-live

Comcare sets out a four-step risk management process for psychosocial risk, and is clear that "all these steps must be supported by consultation" (Comcare). Applied to an AI rollout, before go-live, it looks like this.

• Treat the rollout as a change, and bring safety in early. The trigger is the decision to introduce the tool, not the first complaint after it lands. Put the rollout through the same change process you would use for a new piece of plant. Inventory exactly where the system touches the work: does it allocate or schedule work, set or track performance metrics, monitor or score workers, or make or shape decisions about people?
• Consult the affected workers and their health and safety representatives, for real. Comcare requires consultation when identifying and assessing hazards, and the consultation has to give workers "a reasonable opportunity to raise" issues and "contribute to decision-making". This is the step most rollouts skip. The people who do the work see the failure modes a vendor demo never will: where the tool will create pressure, strip control, or feel like surveillance.
• Identify the hazards, weighted to psychosocial. Most of the risk from an AI rollout is psychosocial. Map the system against the recognised hazards in Comcare's list: high job demands and work intensification, low job control where the tool dictates the pace or the order of work, job insecurity where people fear the tool replaces them, poor organisational change management where the rollout itself is handled badly, and intrusive surveillance from monitoring and scoring. SafeWork NSW's AI WHS Scorecard, a tool built with the Centre for Work Health and Safety, gives you a structured way to run this assessment and maps AI risks to WHS hazard categories.
• Assess and control, by design. Eliminate the risk where you can; where you cannot, minimise it so far as is reasonably practicable using the hierarchy of controls. The most effective controls for AI are designed into how the tool is configured and used, not bolted on afterwards: a workload ceiling the algorithm cannot breach, a human override on automated allocation, a way for a worker to question a decision, transparency about what is measured, and no covert monitoring. The governing principle SafeWork NSW draws out is that the risk usually "does not come from the technology itself, but from how you design and use it".
• Document, then review. Keep the consultation records and the written risk assessment. Review after go-live, and again whenever the tool or how you use it changes, because AI models are updated quietly and a tool that was safe in March can behave differently in June.

A de-identified worked example. A national insurer plans to switch on an AI work-allocation and triage tool in its [TEAM] claims contact centre. Run through the steps and the four NSW risk categories surface immediately. Excessive workload: the tool can route more claims per hour than a person can handle without rushing, so a cap and a realistic load model go in. Unreasonable metrics: a claims-closed-per-hour score would push staff to close fast rather than well, so the metric is removed and replaced with quality measures consulted on with the team. Surveillance: an idle-time monitor reads as constant watching, so it is switched off. Discrimination: the routing logic is checked so it does not quietly funnel the hardest, lowest-status work to the same people. None of these controls come from the model. They come from consulting [EMPLOYEENAME] and the team and deciding, as people, what is reasonably practicable.

The psychosocial and WHS-law line

The reason this sits squarely in WHS, and not only in privacy or HR, is that the harms from a badly introduced AI system are mostly psychological, and psychological health is inside the duty. Comcare grounds this in regulations 55A to 55D of the WHS Regulations and the definition of "health" as physical and psychological. The four risks NSW names in section 21A map almost one-to-one onto recognised psychosocial hazards: workload onto job demands, metrics onto job control and organisational justice, surveillance onto intrusive surveillance, and discriminatory decisions onto organisational justice.

Two of those hazards are worth drawing out. The first is "poor organisational change management", which is itself on Comcare's list. The way you introduce the tool is part of the hazard, not separate from it. A rollout sprung on a team with no consultation, no explanation of what is measured, and no answer to the question "does this replace me" creates psychosocial risk before the tool does anything at all. The second is surveillance. Monitoring and scoring features can create psychosocial risk even when they are introduced with good intent, because what the organisation calls insight the worker experiences as being watched. Productivity scoring, screen or keystroke capture, and sentiment analysis are each a surveillance hazard to assess, and often to dial down or remove.

The records are the evidence. If a regulator, a health and safety representative or an injured worker later asks what you did, the answer is the consultation you ran and the risk assessment you wrote before go-live. "We rolled it out and would have fixed problems as they came up" is not the standard. The duty is to manage reasonably foreseeable risk in advance.

What stays human

The duty is non-delegable. A PCBU cannot contract it out to the vendor, and "the supplier said it was compliant" is not a defence. Officers carry a parallel due diligence duty to make sure the organisation has, and uses, processes to manage WHS risk, and that reaches the decision to switch on an AI system.

AI can help with the paperwork around this duty. It can draft the consultation plan, structure the risk assessment, and turn workshop notes into a tidy first draft. What it cannot do is the duty itself. It cannot consult, because consultation is a two-way exchange with the people who do the work. It cannot set the risk rating or decide which controls are reasonably practicable, because that is a judgement a competent person makes in context. It cannot sign off, and it cannot carry the accountability if the rollout harms someone. The decision to switch a tool on, restrict it, or pull it stays with the people who answer for it.

Workers' lived experience of the work is the data the law actually wants. A model trained on the internet does not know how your [TEAM] feels at 4pm on a high-volume day. The people in the room do. The whole point of the consultation duty is to get that knowledge into the decision before the system is live, not to reconstruct it from incident reports afterwards.

The pre-rollout prompt

You can use AI to draft the paperwork around this duty, provided the consultation, the risk rating and the sign-off stay with a competent person. Paste the prompt below into a model to produce a pre-rollout WHS change pack.

You are a work health and safety adviser helping an Australian organisation introduce a new AI or digital work system safely and lawfully. You apply the model WHS framework: the primary duty of care (where health includes psychological health), the duty to consult workers when proposing changes that affect their health and safety, and the four-step risk management process (identify, assess, control, review), with psychosocial hazards weighted heavily.

TASK: From the details I paste below, produce a pre-rollout WHS change pack with five parts.
1) A plain-English description of where this system touches the work (allocation, pace, metrics, monitoring, decisions).
2) A consultation plan: who to consult (affected workers and health and safety representatives), the questions to ask them, and how they can influence the decision before go-live.
3) A psychosocial hazard identification list, mapping the system against recognised hazards (job demands, low job control, job insecurity, poor change management, intrusive surveillance, organisational justice), with a short note on how each could show up here. Leave the risk rating blank for a competent person to complete.
4) A controls shortlist, designed into how the tool is configured and used (for example workload caps, human override, transparency, no covert monitoring), ordered by the hierarchy of controls (eliminate first).
5) A review-trigger list (after go-live, and on any change to the tool or its use).

INPUTS TO PASTE
- Tool and what it does:
- Team or role affected:
- What it allocates, measures or monitors:
- Vendor claims about safety or compliance:
- Jurisdiction (for example Comcare scheme, NSW, Vic):

OUTPUT FORMAT: Markdown, with the five parts as headed sections; the hazard list with columns Hazard, How it could show up here, and Risk rating (leave blank); controls as a numbered list.

HUMAN-REVIEW BOUNDARY: You draft only. A competent person sets every risk rating, decides which controls are reasonably practicable, runs the actual consultation with workers, and signs off. Do not invent figures, do not assert legal conclusions, and flag anything that needs the workers' input or a regulator's guidance. Use no real personal data; use placeholders such as [EMPLOYEE_NAME] and [TEAM].

How to run it. Paste the prompt into a new project, then add your standing rules to the project instructions: Australian English, no real personal data, draft only with a competent person rating and signing off, and your jurisdiction. Run it across your AI inventory one tool at a time so each output becomes that tool's draft pack, then add a self-refine turn that asks the model to critique its own draft as a sceptical health and safety representative would before you take the improved version to the team meeting.

References

1. Parliament of New South Wales. Work Health and Safety Amendment (Digital Work Systems) Bill 2025 (bill page; Act No 5 of 2026; assented 18 February 2026). https://www.parliament.nsw.gov.au/bills/Pages/bill-details.aspx?pk=18847
2. NSW legislation register. Work Health and Safety Amendment (Digital Work Systems) Act 2026 No 5 (Schedule 1: section 4 definition, section 19(3)(c1), section 21A). 18 February 2026. https://legislation.nsw.gov.au/view/html/inforce/current/act-2026-005
3. Safe Work Australia. Consultation (managing health and safety), and Model Code of Practice: Work Health and Safety Consultation, Cooperation and Coordination. https://www.safeworkaustralia.gov.au/safety-topic/managing-health-and-safety/consultation
4. Comcare. Regulatory guide: Managing psychosocial hazards (Work Health and Safety Act 2011 (Cth); WHS Regulations 55A to 55D). https://www.comcare.gov.au/scheme-legislation/whs-act/regulatory-guides/managing-psychosocial-hazards
5. SafeWork NSW and the Centre for Work Health and Safety. AI WHS Scorecard (research project: Ethical Use of Artificial Intelligence in the Workplace, 2020-2021). https://www.safework.nsw.gov.au/resource-library/whs-research/AI-WHS-scorecard.pdf

---

This article is general information for Australian workplaces, not legal or work health and safety advice. Confirm your duties against the WHS or OHS law and codes of practice that apply in your jurisdiction, and seek advice on your specific circumstances. Never paste real personal, claim, health, or incident data into a model that is not an approved enterprise instance.*