Your AI Dashboard Is Not Due Diligence: What Officers Need to Know, Ask and Record

A polished AI risk dashboard can support an officer's inquiry. It cannot perform that inquiry. Section 27 requires current knowledge, operational understanding, resourcing, responsive processes, compliance processes and active verification. The evidence file must show what the officer actually asked and did.*

An officer cannot discharge due diligence by receiving a quarterly dashboard and noting it. The dashboard may be useful evidence, but it is only one input. Comcare describes section 27 as a proactive officer duty that is separate from the organisation's own duties.

For AI work systems, that means understanding how the technology changes real work. Safe Work Australia's current risk guidance identifies issues including pace, cognitive demand, worker control, human oversight and system changes. You also need to know what management has done with that evidence.

The practical answer is a six-part officer evidence file. It should connect each statutory element to source records, questions, decisions and verification. It assists the officer. It does not certify compliance.

What does section 27 require when AI changes work?

In model-law jurisdictions, section 27 requires an officer of a person conducting a business or undertaking to exercise due diligence to ensure that the PCBU complies with its duties or obligations. The current Commonwealth WHS Act contains that duty. NSW has an enacted equivalent section 27, and the NSW picture is developing further with the incoming digital work systems duty.

The current model WHS Act is dated 5 December 2025, but model provisions and amendments do not operate in a jurisdiction merely because Safe Work Australia has published them. They must be implemented locally, and variations exist. Safe Work Australia confirms that all jurisdictions except Victoria have implemented model WHS laws, with some differences between them. Check the enacted law applying to the workplace, not just the model text.

Section 27 describes six areas in which an officer must take reasonable steps:

1. Acquire and maintain current WHS knowledge.
2. Understand the organisation's operations and generally the hazards and risks associated with them.
3. Ensure appropriate resources and processes to eliminate or minimise risks are available and used.
4. Ensure processes receive and consider information about incidents, hazards and risks, then respond in a timely way.
5. Ensure the organisation has and implements processes for complying with its WHS duties and obligations.
6. Verify that the resources and processes in steps three to five are provided and used.

That list is not a safe harbour. Comcare's current regulatory guide says the steps are required but non-exhaustive. What is reasonable depends on the circumstances. Safe Work Australia's officer-duty guideline says the officer must take an active and inquisitive role, and that reasonable steps depend on the person's role and influence.

Officer status also turns on the statutory definition and actual role. A senior title does not settle it. The model officer guidance includes directors and secretaries, as well as people who make or participate in decisions affecting the whole or a substantial part of the business, or who can significantly affect its financial standing. A WHS manager is not automatically an officer merely because that person advises on safety.

AI adds a specific operational question: what changed in the work? Safe Work Australia's July 2026 guidance says AI and digital technologies can introduce or contribute to physical and psychosocial hazards. Its risk examples include work intensification, more cognitively demanding residual tasks, computer-set pace, reduced control, poor support and role ambiguity. It also says pushed software updates can change WHS risks and that existing risk-management duties apply, which is why an AI rollout is a WHS change in its own right. There is no separate statutory AI shortcut. The organisation must manage the risks as it would other work risks, in consultation with workers and their representatives. See the current AI guidance and WHS duties page.

Victoria needs separate treatment. It does not use model section 27. Under section 144 of Victoria's current Occupational Health and Safety Act 2004, an officer may be liable where a body corporate contravenes the Act or regulations and that contravention is attributable to the officer's failure to take reasonable care. In determining guilt, regard must be had to matters including what the officer knew and the extent of the officer's ability to make, or participate in making, relevant decisions. The six-part file below may still be useful governance practice in Victoria, but it is not a Victorian statutory checklist.

What should an officer's AI evidence file contain?

Start with the six legal elements, then require a trace from assertion to action. A dashboard usually shows selected measures. A defensible file should also show what sits behind them, what is missing, what workers said, what changed and what the officer decided.

Use this checklist for each AI work system:

• Current knowledge: applicable jurisdiction, current legislation, approved codes, regulator guidance and the date each source was checked.
• Operational reality: tool, version, business task, affected worker groups, decision boundary, human review point, work pace, fallback and vendor-pushed changes.
• Hazard evidence: worker and HSR input, complaints, error patterns, workload observations, audit findings and unresolved uncertainty.
• Resources and controls: review time, staffing, training, technical and WHS capability, escalation paths, control owners and rejected resource requests with reasons.
• Compliance process: consultation, instruction, incident notification, HSR entitlements and notice-management processes relevant to the system.
• Verification: source records inspected, operational sample taken, people consulted, contradictions found, corrective action and recheck date.

The fresh technique is a two-hop verification rule. Every favourable dashboard claim must link first to its underlying record and then to an independent human or workplace check. If the dashboard says review quality is effective, inspect a risk-based sample of reviewed outputs, then ask affected workers whether the allocated review time and escalation route work in practice. The officer does not need to perform daily implementation, but the model officer guidance says the officer must take reasonable steps to verify that resources, processes and procedures are provided and used.

Use this prompt to expose evidence gaps in a de-identified officer pack. A WHS adviser must verify the legal mapping and source records, and the accountable officer must decide what inquiry or action follows.

Act as an evidence-gap analyst, not a legal decision-maker.

Jurisdiction: [JURISDICTION]
AI work system: [SYSTEM_AND_VERSION]
Affected work: [TASKS_AND_WORKER_GROUPS]
Officer pack: [PASTE_DE-IDENTIFIED_CONTENT]

Map the pack against the six section 27 due diligence elements. For each element, list:
1. management claim
2. cited source record and date
3. missing or stale evidence
4. contradictory information
5. question the officer should ask
6. decision or verification still required

Treat summaries, dashboards and AI-generated text as claims until linked to source evidence. Do not conclude that the officer or organisation is compliant. Flag any jurisdictional assumption for human legal review.

Fictional worked example: [BUSINESSUNIT] introduces [AITOOL] to summarise customer calls. The board pack reports faster completion, low error counts and completed training. The evidence file shows a different question set. Workers in [WORKERGROUP] now review more complex calls, vendor version [VERSION] changed last month, review time has not been measured, and the escalation log contains unresolved entries.

The officer's useful record is not “dashboard reviewed”. It records that [OFFICERROLE] asked for the version-change assessment, worker consultation results, a sample of escalated errors and evidence that staffing allowed meaningful review. It then records the resource decision, accountable owner and recheck date. The AI organised the material. People supplied evidence, tested the work and made the decision.

Use this prompt to design a verification sample. A competent WHS practitioner must approve the sample, people conducting the checks must validate findings, and the officer must interpret the result rather than accept the model's conclusion.

Create a risk-based verification plan for this de-identified AI control register:
[PASTE_REGISTER]

For each selected control, specify:
- why it is in the sample
- the original source record to inspect
- the operational observation or worker or HSR check
- the person competent to perform the check
- the contradiction or failure signal to look for
- the evidence needed before closure

Prioritise changed systems, high-consequence work, unresolved concerns, overdue actions and controls supported only by summaries. Do not decide that any control is effective or that due diligence has been satisfied.

SafeWork NSW's due diligence guidance identifies records such as training material, risk registers, staffing plans, minutes, consultation records, audit reports, corrective-action logs and decision-register entries. Those records help only when they reflect real activity. A generated procedure that nobody follows is evidence of document production, not evidence that the process operates.

Do this Monday

1. Confirm the jurisdiction and the officers in scope. Record why the Commonwealth, NSW or another enacted regime applies. Obtain legal advice where officer status or cross-jurisdiction coverage is uncertain. Do not copy section 27 language into a Victorian assessment.
2. Select one material AI work system. Choose a system affecting work pace, workload, customer interaction, safety information or human review. Record its current version, purpose, worker groups and the last material change.
3. Build the six-part file. Place one page against each statutory element. Link every statement to a source, owner and as-at date. Add an explicit field for unknown, contradictory or worker-disputed information.
4. Run the two-hop test. Trace one favourable assurance to the original record, then test it through an observation, worker or HSR discussion, or competent audit sample. Apply the organisation's approved data-handling controls before entering any material into an AI tool.
5. Record the officer response. Capture the question asked, evidence considered, uncertainty remaining, resource or control decision, owner and due date. Schedule re-verification when a vendor update, work change, incident, worker concern or failed control alters the risk picture.

The aim is not a larger board pack. It is a shorter line between what the officer is told, what actually happens in the work and what the officer does next.

Bottom line

A dashboard can direct attention, but it cannot exercise due diligence. Section 27 requires reasonable steps across six connected areas, and the list is not exhaustive. Build an evidence file that exposes sources, gaps, worker experience, decisions and verification rather than presenting a polished assurance score. Keep the legal framework jurisdiction-specific, especially in Victoria, and keep every judgement human.

This article is general information and education only. It is not legal, compliance, financial or professional advice. Obligations vary by organisation and circumstance. Verify current requirements against the primary sources cited and seek advice specific to your situation.

References

1. Federal Register of Legislation, Work Health and Safety Act 2011, current text: https://www.legislation.gov.au/C2011A00137/latest/text
2. Safe Work Australia, Model Work Health and Safety Act: https://www.safeworkaustralia.gov.au/doc/model-work-health-and-safety-act
3. Safe Work Australia, Model WHS laws: https://www.safeworkaustralia.gov.au/law-and-regulation/model-whs-laws
4. Safe Work Australia, The health and safety duty of an officer, interpretive guideline: https://www.safeworkaustralia.gov.au/system/files/documents/1812/officer-duty-interpretive-guide.pdf
5. Comcare, Regulatory guide: Duties of officers: https://www.comcare.gov.au/scheme-legislation/whs-act/regulatory-guides/duties-of-officers
6. NSW legislation, Work Health and Safety Act 2011 No 10, current text: https://legislation.nsw.gov.au/view/whole/html/inforce/current/act-2011-010
7. SafeWork NSW, Due diligence: https://www.safework.nsw.gov.au/legal-obligations/employer-business-obligations/due-diligence
8. Safe Work Australia, Artificial intelligence and digital technologies: https://www.safeworkaustralia.gov.au/safety-topic/hazards/digital-technologies-ai
9. Safe Work Australia, Artificial intelligence and digital technologies: WHS duties: https://www.safeworkaustralia.gov.au/safety-topic/hazards/digital-technologies-ai/whs-duties
10. Safe Work Australia, Artificial intelligence and digital technologies: Managing risks: https://www.safeworkaustralia.gov.au/safety-topic/hazards/digital-technologies-ai/managing-risks
11. Victoria legislation, Occupational Health and Safety Act 2004, authorised version 045: https://content.legislation.vic.gov.au/sites/default/files/2025-08/04-107aa045-authorised.PDF