An AI-Written WHS Record Is Not Audit Evidence Until You Prove the Work Happened.

AI can turn scattered notes into an immaculate WHS record. That record still needs a source, confirmation from an accountable person and an operational trace before you rely on it as proof that the claimed safety work occurred.

An AI-written minute, inspection summary or control-implementation note may be accurate. Its polish does not prove the meeting occurred, the branch was inspected or the control was put into operation.

Treat generated text as an unverified artefact until it passes a provenance triangle: source record, accountable human confirmation, and operational trace or observation. That triangle answers one narrow question, whether the claimed work happened. It does not decide whether the work was legally sufficient or whether the control was effective.

What does the provenance triangle prove?

The starting error is confusing a record with the activity it describes. Generative AI can create consistent dates, action tables and formal language from incomplete inputs. A credible format can conceal a missing event.

Comcare's current WHS management-system material makes the practical distinction clear. A system is more than safety forms, policies and documented procedures. It is about achieving what the safety documentation says, in an ongoing and managed way. Comcare lists proof that policies and procedures are documented, implemented and maintained among the evidence organisations may consider.

The current position for SRCC self-insured licensees changed on 1 July 2026. The SRCC's audit tools and templates page says AS/NZS ISO 45001:2018 replaced the National Audit Tool as the prevention-management-system standard from that date. Applicants must provide evidence of ISO45001 certification, or an audit report demonstrating alignment with ISO45001 that meets the Commission's requirements, while licensees must demonstrate annually that they maintain a certified or aligned system.

The SRCC's Licence Compliance and Performance Model, Version 14 dated June 2026 confirms the replacement. It says the transition began on 1 July 2026 and is expected to finish by 30 September 2028. Those are scheme-specific licence arrangements, not a universal statutory test.

The superseded National Self Insurer WHS Audit Tool user guide, Version 3 from September 2014, remains useful only as historical guidance for this article's evidence-sufficiency technique. It described objective evidence as potentially including documents, electronic information, documented records, visual observations and discussion with workers and others, and required the audit records to carry enough information for another auditor to identify, locate and independently verify that evidence. Do not use the old NAT as the current licence standard.

That does not mean an AI-written record can never be evidence. For material implementation claims, this article proposes three linked points:

1. Source record: a controlled, identifiable input created by or close to the activity. Examples include a system event, original attendance entry, approved change ticket, inspection image with controlled metadata, worker submission or contemporaneous note. Record the owner, date, version, location and limits. An AI summary is not its own source.
2. Accountable human confirmation: a named person with direct knowledge confirms what occurred, when, where, with whom and within what scope. Approval of elegant wording is not enough. The person confirms the underlying activity and identifies exceptions or uncertainty.
3. Operational trace or observation: a separate signal shows the activity entered the work system. Use a configuration history, completed task, access record, sampled worker discussion, direct observation or other trace appropriate to the claim. Do not manufacture a second document from the same prompt and call it corroboration.

Join all three with an activity claim ID so a reviewer can follow the chain. If one point is missing, label the claim UNVERIFIED_ACTIVITY rather than filling the gap with generated prose.

The sampling question sits alongside this one. Choosing which claims to test at all is a population and sample problem in its own right. This piece assumes the claim is already in scope and asks only whether the activity behind it can be shown to have occurred.

This is an occurrence gate, not an effectiveness verdict. Training may happen without building competence. A call-escalation screen may be live but poorly designed. A consultation meeting may occur without satisfying applicable requirements. Those are later questions with different evidence.

Under the current Work Health and Safety Act 2011, compilation dated 1 July 2024, section 19 places the primary duty on the PCBU, so far as is reasonably practicable. Section 27 requires officers to exercise due diligence to ensure the PCBU complies with its duties or obligations under the Act. An AI record does not hold either duty.

Where the claim concerns a control implemented under the Commonwealth Regulations, regulations 37 and 38 in the current compilation dated 25 March 2025 require it to be maintained so it remains effective, and reviewed and, as necessary, revised, including in specified circumstances. Proving implementation is only the first gate. Effectiveness review remains human work.

Victoria operates under its separate Occupational Health and Safety Act 2004, current version 045 effective 6 August 2025. Apply the governing jurisdiction's duties and audit criteria rather than treating the Commonwealth provisions or historic NAT as national law.

Use this prompt to build an occurrence-evidence index from approved records. A WHS practitioner must verify the source status, decide which human has direct knowledge and reject any proposed trace that merely repeats the same generated content.

Build an occurrence-evidence index for these claimed WHS activities.

Claims: [ACTIVITY_CLAIMS]
Approved source register: [SOURCE_REGISTER]
Available operational traces: [TRACE_REGISTER]
Jurisdiction and audit criterion: [CONTEXT]

For each claim, return: activity claim ID, exact claim, source record with owner,
date, version and location, accountable human confirmer, independent operational
trace or observation, scope limits, contradictions and evidence status. Use only
the supplied material. Mark a missing triangle point UNVERIFIED_ACTIVITY. Do not
decide legal compliance or control effectiveness.

How do you test whether the claimed work happened?

Start with the claim. "Branch aggression protocol implemented" is too broad. Break it into observable statements: the approved protocol was loaded; the nominated cohort received access; supervisors were briefed; and the escalation route was tested during the stated period.

Then test each statement against the triangle. The source record should support the same date, location, population and version as the human confirmation and trace. A mismatch is evidence, not an editing problem. Keep it visible.

Use this occurrence-evidence checklist:

• Is the precise activity, location, period, cohort and version stated?
• Can a reviewer locate the original source without relying on the AI output?
• Did the human confirmer have direct knowledge, and did they confirm the event rather than the prose?
• Is the operational trace independent enough to corroborate the claim?
• Are missing participants, failed steps, late actions and contradictory records retained?
• Can another reviewer reconstruct how the evidence status was assigned?
• Is control effectiveness reserved for a separate test?

The historical NAT illustrates this multi-source approach. Its guidance on the corresponding NAT workbook called for recording persons spoken with, documents and records seen, and observations and comments. It also contemplated interviews, worker input and confirmation through observation and discussion. These concepts inform the triangle but do not replace current ISO 45001 assurance requirements.

In banking, insurance and superannuation, a central log may say a customer-aggression protocol reached every contact-centre team. The system trace may show publication while sampled workers reveal the overnight team lacked access. Preserve both. The contradiction changes the claim's scope.

Fictional worked example: [BANK_NAME] asks AI to draft a record stating that the new post-incident manager guide was implemented across [BUSINESS_UNIT] on [IMPLEMENTATION_DATE]. The model uses a project plan, an email draft and a template action log. The output looks complete, but the project plan shows intention, not completion.

The WHS team assigns [ACTIVITY_ID]. The source record becomes the approved publication ticket showing the actual version and release time. [CONTROL_OWNER_ROLE], who directly managed release, confirms the cohort and discloses that two branches were excluded. Access logs and a sampled discussion with workers from the included cohort provide the operational trace. The evidence status is CORROBORATED_WITH_SCOPE_LIMIT, not "implemented nationally". Whether the guide actually supports workers after an incident is tested separately.

AI is useful after those boundaries are set. It can map claims to sources, identify missing fields, compare dates, expose inconsistent scope and prepare an exception queue. It must not invent missing attendance, turn an intended action into a completed one, infer a person's confirmation or declare conformance.

Safe Work Australia's current guidance on managing AI and digital-technology risks says risks from these technologies must be managed using the ordinary WHS risk-management process. It identifies human oversight and audits among possible controls and says PCBUs must maintain and review controls. Apply that discipline to the evidence workflow itself: approved tools, controlled inputs, visible AI assistance, human review, access rules and periodic sampling.

Use this prompt to challenge an evidence packet. A competent WHS auditor or practitioner must review every exception, speak with relevant people where needed and make the evidence judgement; the tool must not assign conformance.

Challenge this WHS occurrence-evidence packet: [PACKET].

For each activity claim, compare the source record, human confirmation and
operational trace. Identify mismatched dates, versions, locations, cohorts,
owners, scope, duplicate-source dependence, missing exceptions and claims that
describe intention rather than completion. Return questions for the human
reviewer and a source-linked exception table. Do not infer missing facts, rate
conformance, decide legal compliance or judge control effectiveness.

Do not flatten uncertainty during sign-off, least of all in the one-page packet a committee actually reads. Use evidence statuses such as CORROBORATED, CORROBORATED_WITH_SCOPE_LIMIT, CONTRADICTED and UNVERIFIED_ACTIVITY. Define them locally. They are workflow labels, not statutory ratings and not the NAT ratings.

The superseded NAT also warned that its examples were not the only or preferred ways to meet a criterion, and that conformance did not assure compliance with every statutory obligation. The triangle is a conservative TheAICommand sufficiency workflow for material implementation claims, not a demand for three artefacts against every criterion. It is not a NAT rating, ISO 45001 test, statutory rule or regulator's conclusion.

Do this Monday

1. Choose one implementation claim. Select a recent statement such as "all branch leaders were briefed" or "the escalation route was tested". Write the precise cohort, location, period and version claimed.
2. Assign an activity claim ID. Link the original source, a person with direct knowledge and one operational trace or observation. Do not commission new prose to replace a missing point.
3. Run the contradiction check. Compare dates, scope, exclusions and system states. Preserve disagreement and mark unsupported claims UNVERIFIED_ACTIVITY.
4. Separate the second gate. Record whether occurrence is corroborated, then create a different review question for compliance, suitability and control effectiveness.
5. Sample the workflow. Ask a competent human reviewer to reconstruct the evidence without the AI narrative. If the chain cannot be followed, repair the index before accepting the claim.

Bottom line

AI authorship does not automatically invalidate a WHS record, but fluent text cannot prove its own subject matter. Require a source record, accountable human confirmation and an operational trace or observation before accepting a claim that safety work occurred. Keep contradictions and scope limits visible. Then test legal sufficiency and control effectiveness separately, with people accountable for the judgement.

This article is general information and education only. It is not legal, compliance, financial or professional advice. Obligations vary by organisation and circumstance. Verify current requirements against the primary sources cited and seek advice specific to your situation.

References

1. Comcare, Workplace health and safety management system: https://www.comcare.gov.au/safe-healthy-work/healthy-workplace/whs-system
2. Safety, Rehabilitation and Compensation Commission, Audit tools and templates: https://www.srcc.gov.au/current-self-insurers/audit-tools-and-templates
3. Safety, Rehabilitation and Compensation Commission, Licence Compliance and Performance Model, Version 14, June 2026: https://www.srcc.gov.au/sites/default/files/docs/srcc-licence-compliance-performance-model.pdf
4. Comcare, National Self Insurer WHS Audit Tool (NAT Cth) user guide, Version 3, September 2014, superseded as the SRCC prevention-management-system standard from 1 July 2026: https://www.comcare.gov.au/sites/default/files/docs/whs-self-insurer-audit-tool-user-guide.pdf
5. Federal Register of Legislation, Work Health and Safety Act 2011, current text: https://www.legislation.gov.au/C2011A00137/latest/text
6. Federal Register of Legislation, Work Health and Safety Regulations 2011, current text: https://www.legislation.gov.au/F2011L02664/latest/text
7. Victorian legislation, Occupational Health and Safety Act 2004, current in-force version 045: https://www.legislation.vic.gov.au/in-force/acts/occupational-health-and-safety-act-2004/045
8. Safe Work Australia, Artificial intelligence (AI) and digital technologies - Managing risks: https://www.safeworkaustralia.gov.au/safety-topic/hazards/digital-technologies-ai/managing-risks