An AI Safety Control Is Still Just a Control. The Duty to Verify It Stays With You.

A new kind of safety product is being sold into Australian workplaces. A camera on the warehouse wall that flags when someone steps into a forklift's path. A cab-facing camera that detects a microsleep and sounds an alarm. A wearable that reads posture, heat strain or proximity to plant. The pitch is simple. The technology watches the hazard so a supervisor does not have to, and it never blinks. For a safety lead stretched across too many sites, an always-on set of eyes is genuinely attractive, and some of these systems do useful work. The risk is quieter. It is the assumption that installing the system is the same thing as controlling the risk.

It is not. Under work health and safety law an AI safety system is a control measure, one option in the kit, and a control measure has to be chosen well, placed correctly, verified, maintained and reviewed like any other. The model framework is mirrored across the Commonwealth (Comcare) scheme, New South Wales, Queensland and most states and territories, with equivalent duties under Victoria's Occupational Health and Safety Act 2004. None of it lets you buy your way out of the duty. This piece sets out the duty an AI safety control touches, where it sits in the hierarchy of controls, how to deploy one without fooling yourself, and the line the law draws between what the model can do and what a person still has to own.

The duty an AI safety control touches

Start with who owes the duty. Under section 19(1) of the Work Health and Safety Act, a person conducting a business or undertaking must ensure, so far as is reasonably practicable, the health and safety of workers while they are at work (Comcare, Regulatory guide: Primary duty of care). Health is defined in the model Act as both physical and psychological health, and the duty covers both (Safe Work Australia, Duties of a PCBU). That primary duty is the thing an AI safety control is meant to help you discharge. It is also the thing the vendor cannot take off your hands.

This is not a drafting nicety. Safe Work Australia states the principle plainly. Each duty holder "retains responsibility and must discharge their duty to the extent to which the PCBU has the capacity to influence and control the matter. A PCBU cannot 'contract out' of their responsibility and a duty cannot be transferred to another person" (Safe Work Australia, Duties of a PCBU). The supplier of an AI safety system has its own upstream duty. A PCBU who designs, manufactures, imports or supplies plant must ensure, so far as is reasonably practicable, that the product is without risks to health and safety throughout its lifecycle (Safe Work Australia, Duties of a PCBU). But that duty sits alongside yours, it does not replace it. You can hold the vendor to account and still be the one who answers for the worker on the floor.

Concurrent duties are the norm with these systems, not the exception. When a contractor installs the cameras, or the vendor runs the monitoring as a managed service, more than one business can owe a duty in relation to the same risk, and each must discharge it to the extent of its own capacity to influence and control the matter, then consult, co-operate and co-ordinate with the others (Safe Work Australia, Duties of a PCBU). What decides this is the contract and the operating model, not the sales conversation, so map who is responsible for the camera's placement, its accuracy in your conditions, the alerts it raises and the response to them before go-live.

So the vendor's data sheet is the start of your assessment, not the end of it. A model that detects a person in an exclusion zone with high accuracy in the vendor's test footage tells you very little for certain about your loading dock at dusk, in rain, with a high-visibility vest the model was not trained on, around a forklift mast that occludes the lens. The accuracy claim is the vendor discharging the vendor's duty. Verifying that the control actually works in your conditions is you discharging yours.

Where the AI control sits in the hierarchy

The WHS Regulations make working through the hierarchy of control measures mandatory where a risk cannot be eliminated, and the hierarchy is ranked from the highest level of protection and reliability to the lowest (Comcare, Regulatory guide: Managing psychosocial hazards, referring to the hierarchy in Regulation 36; Safe Work Australia, Managing risks). Elimination sits at the top, then substitution, isolation and engineering controls, then administrative controls, and last personal protective equipment. Safe Work Australia is blunt about the bottom of the list. "Administrative controls and personal protective equipment (PPE) are the least effective. They do not control the hazard at the source and rely on human behaviour and supervision" (Safe Work Australia, Managing risks).

Almost every AI safety product is, in control terms, an administrative control, the kind that Safe Work Australia ranks among the least effective. A system that detects and alerts does not remove the hazard, isolate the worker from it or engineer it out. It watches, and then it relies on a human noticing the alert and acting in time. That places it near the bottom of the hierarchy, exactly where the law says reliability is lowest. The danger is not that the tool is useless, it is that a slick, always-on system feels like a high-order control and quietly displaces the real ones. A vision system watching a forklift route is not a substitute for separating people and plant with a physical barrier or a one-way traffic plan. If the camera becomes the reason the barrier is never built, safety has gone backwards while the dashboard looks greener.

There is a human-factors trap inside this. Because the control relies on human behaviour and supervision, the more reliable the system looks, the more tempting it becomes to stop watching. A control that quietly trains people to pay less attention is degrading the work, not improving it.

Heavy vehicle fatigue shows the disciplined version. The National Heavy Vehicle Regulator, addressing fatigue and distraction detection technologies, notes they "are shown to play a positive role in reducing driver fatigue and distraction events", but frames its material as "a starting point on the good practice options" rather than a prescriptive fix, and stresses the procedures and processes to reasonably respond to alerts and the importance of the company response (National Heavy Vehicle Regulator, Fatigue and Distraction Detection Technologies). The technology is one layer on top of a fatigue management system of scheduling, rosters, rest and culture, not a replacement for it. An alert that no one is required to act on is not a control. It is a recording of the incident you did not prevent.

Deploying an AI safety control without fooling yourself

A practitioner-grade rollout runs in a fixed order. AI can sit inside several of these steps. It cannot own any of them.

First, name the hazard and lock the higher-order controls before you buy the camera. Decide what elimination, isolation or engineering control you can reasonably apply, and apply it. The AI control is a supplement to those, never a reason to skip them.

Second, specify what the control must detect and the conditions it must work in. Write down the unsafe situation in plain terms, who in the path of what, and the real-world variables, light, dust, weather, camera angles, occlusion and the gear your workers actually wear. A control with no defined success and failure cannot be verified, and a control that cannot be verified cannot be relied on.

Third, verify it before you rely on it. Test against your conditions and probe the two failures that matter, in opposite directions. The false negative is the dangerous miss, the worker in the zone the system did not flag. The false positive is the nuisance alert that trains everyone to ignore it, the fastest way to turn a safety control into wallpaper. Vendor accuracy figures do not close this out. Your own test on your own site does.

Fourth, wire the alert into a response that a person is required to make. Define who receives the alert, what they must do, and how fast. Without a defined and resourced response, you have surveillance, not a control.

Fifth, set the triggers that force a review, then review it. SafeWork NSW says a PCBU "must routinely review the control measures they have put in place to ensure they are effective", in consultation with workers and health and safety representatives, and must revise them when they are not working (SafeWork NSW, Maintaining and reviewing control measures). Review when the system misses, when the workplace layout or practices change, when new equipment is introduced, or when a new problem is found (SafeWork NSW, Managing risk in the workplace). An AI model can also drift as conditions shift, so scheduled re-verification is part of the maintenance, not an optional extra.

Sixth, resource the people, and keep the records. The people who receive and act on alerts need the information, training, instruction and supervision the regulations expect, which Comcare lists among the relevant matters in Regulation 55D (Comcare, Regulatory guide: Managing psychosocial hazards). Keep your verification results, your review dates and your consultation notes, so the control can be shown to be effective rather than merely installed.

A de-identified example. Say [TEAM] runs a busy warehouse aisle where pedestrians and forklifts cross, and a vendor offers a vision system that alarms when a person enters a marked zone. The compliant path is to first reduce the crossing with a one-way layout and a physical barrier where practicable, then trial the camera against the real lighting and traffic at [SITE], deliberately walk the zone in different vests and conditions to find the misses, set a rule that a flashing alert stops the forklift and is logged, consult the crew who work the aisle, and put a named person's signature against the decision to rely on it. The AI flags. The barrier, the rule, the consultation and the sign-off are human.

The control that watches workers is itself a hazard

There is a second risk most AI safety pitches skip. A camera trained on a person, a cab-facing fatigue camera, a wearable that tracks a body, is a form of monitoring, and Comcare lists intrusive surveillance among the common psychosocial hazards a PCBU must manage (Comcare, Regulatory guide: Managing psychosocial hazards). Because health in the WHS Act means physical and psychological health, the same primary duty covers it. Regulations 55A to 55D of the WHS Regulations require a PCBU to manage psychosocial risks, and Comcare is explicit that the four-step risk management process "must be supported by consultation" (Comcare, Regulatory guide: Managing psychosocial hazards).

So a control you install to manage a physical hazard can create a psychosocial one, and the same business owns both. The discipline is proportionality and purpose. Scope the system to the safety problem you named, not to productivity or behaviour generally. Keep the footage to the safety purpose and only as long as that purpose needs. Tell workers what is watched, why, and what it is not used for. Function creep, a camera bought to stop a crush injury that drifts into tracking break times, is exactly the slide regulators are now naming, with New South Wales having legislated in 2026 against excessive or unreasonable monitoring and surveillance by digital work systems. The consultation, supported by the approved Codes of Practice including the model Managing Psychosocial Hazards at Work Code of Practice, is not a courtesy. It is the step that tells you whether your safety control has become a surveillance hazard, and it is required either way.

What stays human

The pattern across all of it is steady. The model can watch, detect and flag, faster and more tirelessly than a person. It cannot decide what to control, choose where the control sits in the hierarchy, verify that it works in your conditions, weigh the surveillance it creates against the harm it prevents, respond to what it flags, or carry the duty when it misses. Those are judgements, and the law puts them on a person and an organisation, not on a sensor. The vendor's claim is evidence you weigh, not a verification you can borrow, and the duty cannot be transferred to another person (Safe Work Australia, Duties of a PCBU). Buy the camera if it earns its place in the hierarchy. Then do the work that makes it a control rather than a comfort.

Turn a proposed control into a verification plan

Use this prompt to turn a proposed AI safety control into a WHS deployment and verification plan, including where it sits in the hierarchy, a false-negative and false-positive test plan, the alert response, the review triggers, and the surveillance and consultation check. It plans the work. It does not sign anything off.

You are a work health and safety adviser working under the Australian model WHS framework (the model WHS Act, the WHS Regulations and the approved Codes of Practice). I am assessing an AI or sensor-based safety control before we rely on it. Help me plan the deployment and verification. Do not make a determination, give legal advice, or sign anything off; a competent person and the accountable PCBU make those decisions.

CONTEXT I WILL PASTE:
- The hazard and the work: [describe the unsafe situation, the task, the workers and the plant involved]
- The proposed control: [what the AI / sensor system detects and does, eg vision exclusion-zone alarm, cab fatigue camera, proximity wearable]
- The site conditions: [lighting, weather, dust, layout, shift pattern, PPE worn, anything that could affect detection]
- Higher-order controls already in place or possible: [elimination, substitution, isolation, engineering controls]
- Vendor claims: [paste accuracy or performance claims verbatim, marked as claims, not evidence]

PRODUCE, under clear headings:
1. Hierarchy placement: classify the proposed control on the hierarchy of controls and state plainly that it is most likely an administrative control that relies on human behaviour.
2. Higher controls first: list the elimination, isolation or engineering controls that must be in place or seriously considered before relying on the AI control, and flag anything the AI control might be wrongly displacing.
3. Verification test plan: design a test on our own site that probes false negatives (dangerous misses) and false positives (alert fatigue) across the stated conditions, with pass and fail criteria. Treat vendor accuracy claims as unverified until our test confirms them.
4. Alert response: specify who receives each alert, the required action, and the time to act, so the alert is a control and not just a recording.
5. Review triggers: list the events that must trigger a review of the control (a miss, a change in layout or plant, new equipment, a new problem, or worker feedback) and a re-verification schedule.
6. Surveillance and psychosocial check: identify whether the control monitors workers, whether that is proportionate to the safety purpose, what data is kept and for how long, and the specific consultation needed with affected workers and HSRs.
7. What must stay human: list the decisions a person and the PCBU must own (the decision to rely on the control, the response to alerts, the accountable sign-off).

RULES: Australian English. No em dashes. Cite the relevant duty in plain terms (primary duty of care, the hierarchy of controls, the duty to review control measures, intrusive surveillance as a psychosocial hazard) without inventing clause numbers. Flag every point where I must consult a competent person, the workers, or the regulator. End with the 5 highest-priority questions I should answer before go-live.

How to run it. Put the prompt into a ChatGPT or Claude project called "AI safety control review" with three standing rules so you do not re-type them: Australian English and no em dashes, never make a determination or give legal advice, and always treat vendor accuracy claims as unverified until your own on-site test confirms them. Run one control at a time, then add a second turn that asks the model to act as a sceptical safety auditor and find the three most likely ways the control fails in the real world that the verification test would miss, adding a specific test step or review trigger for each. A third turn can rewrite the alert response so a named role, not "the supervisor", owns each alert with a maximum time to act. The model sharpens the plan. A competent person reviews it, and the PCBU signs it off.

References

1. Safe Work Australia, Duties of a person conducting a business or undertaking (PCBU), accessed 27 June 2026. https://www.safeworkaustralia.gov.au/law-and-regulation/duties-under-whs-laws/duties-pcbu
2. Safe Work Australia, Managing risks (Identify, assess and control hazards), accessed 27 June 2026. https://www.safeworkaustralia.gov.au/safety-topic/managing-health-and-safety/identify-assess-and-control-hazards/managing-risks
3. Comcare, Regulatory guide: Primary duty of care (sections 17, 18 and 19, WHS Act 2011), accessed 27 June 2026. https://www.comcare.gov.au/scheme-legislation/whs-act/regulatory-guides/primary-duty-of-care
4. Comcare, Regulatory guide: Managing psychosocial hazards (Regulations 55A to 55D and Regulation 36, WHS Regulations 2011), accessed 27 June 2026. https://www.comcare.gov.au/scheme-legislation/whs-act/regulatory-guides/managing-psychosocial-hazards
5. SafeWork NSW, Managing risk in the workplace (hierarchy of controls and review triggers), accessed 27 June 2026. https://www.safework.nsw.gov.au/safety-starts-here/safety-support/managing-risk-in-the-workplace
6. SafeWork NSW, Maintaining and reviewing control measures, accessed 27 June 2026. https://www.safework.nsw.gov.au/resource-library/list-of-all-codes-of-practice/codes-of-practice/engineered-stone-code-of-practice/maintaining-and-reviewing-control-measures
7. National Heavy Vehicle Regulator, Fatigue and Distraction Detection Technologies, accessed 27 June 2026. https://www.nhvr.gov.au/safety-accreditation-compliance/fatigue-management/fatigue-distraction-detection-technologies
8. SafeWork NSW / Centre for Work Health and Safety, AI WHS Scorecard (Ethical Use of Artificial Intelligence in the Workplace), accessed 27 June 2026. https://www.safework.nsw.gov.au/resource-library/whs-research/AI-WHS-scorecard.pdf

---

This article is general information for work health and safety practitioners and people with safety duties. It is not legal advice and not a substitute for the model WHS Act, the WHS Regulations, the approved Codes of Practice, or advice from your regulator (Comcare, Safe Work Australia, or your state or territory WHS regulator) on your own circumstances.*