Your Prompt History Is a Document. A Regulator Can Require It.

The notice does not ask for your prompt history. It asks for documents.

That is the problem. In the Commonwealth work health and safety jurisdiction, document is defined to include a record, and a prompt, an output and an agent's action log are each records of information.

So the power is settled. Whether the material still exists when the notice arrives is not. Retention is a vendor default, set by someone not thinking about safety.

The power was written in 2011 and it already says documents

Section 155 of the Work Health and Safety Act 2011 (Cth) gives the regulator a standalone information-gathering power. It does not require entering a workplace.

Section 155(1) sets the gate. It applies where the regulator has reasonable grounds to believe a person can give information, produce documents or give evidence about a possible contravention, or that will assist the regulator to monitor or enforce compliance with this Act. Read that second limb again. Monitoring compliance is enough, and no suspected breach is required.

Section 155(2) then lets the regulator require, by written notice, information in writing, production of documents, or attendance to give evidence, the last only as a fallback under section 155(4). Section 155(5) makes refusal or failure to comply without reasonable excuse an offence at the tier D monetary penalty: $17,000 for an individual and $83,000 for a body corporate for the year commencing 1 July 2026, under instrument F2026N00550 (as at 21 September 2026). Section 155(6) puts the evidential burden of the excuse on the accused.

Inspectors hold a parallel power. Section 171(1) lets an inspector at a workplace ask who has custody of or access to a document and require production. Section 171(2A) reaches past the visit: within 30 days after entering, an inspector may give written notice requiring production, confined by section 171(2D) to the purpose of the entry.

Three details matter. A section 155 notice runs to a person, not only the person conducting the business or undertaking, so a vendor or labour hire provider can receive one. NSW section 155A reaches persons and matters outside the State. And the section 171 test is custody or access: if an administrator can pull the log from a vendor console, you have access.

Is a prompt history a document?

Yes, on two definitions that already exist.

Section 4 of the Commonwealth Act defines document to include record. That is inclusive, extending the general meaning rather than replacing it, and section 2B of the Acts Interpretation Act 1901 (Cth) supplies the rest: document means any record of information, and includes ... anything from which sounds, images or writings can be reproduced with or without the aid of anything else. NSW section 4 carries the same inclusion.

Format is not a defence. A conversation held only as rows in a vendor database is something from which writings can be reproduced. So is a tool-call log, a stored system prompt, and the configuration that set an agent's permissions.

The target is narrower than that sounds. Section 155(1) requires reasonable grounds, and section 171(2D) ties an inspector's notice to the purpose of the entry. What an investigator wants is one decision, on one shift. Your logs record the tokens and usually not the decision, so dumping six months of chat history is over-collection and under-evidence at once.

One boundary. Whether a produced record is genuine and traceable to work that happened is handled in the provenance triangle.

What happens to privilege when the notice lands?

Less than most people expect, and the jurisdictions do not agree.

Section 172(1) abrogates the privilege against self-incrimination. Nobody is excused from answering, or from producing a document, on the ground that it may incriminate them or expose them to a penalty, and section 155(7) applies that to a section 155 notice.

What survives is a use immunity, narrower than the abrogation. Section 172(2) operates only where the person is an individual, and for that individual the answer, the production, and anything obtained as a direct or indirect consequence are inadmissible against them. So the immunity does nothing for the body corporate, and what the organisation produces is admissible against it. The Commonwealth version also covers derivative material where NSW does not: NSW section 172(2) protects only the answer, information or document itself, in proceedings other than proceedings arising out of its false or misleading nature.

Victoria differs again, and the difference bites on documents. Section 154(1) of the Occupational Health and Safety Act 2004 (Vic) lets a natural person refuse to give incriminating information, but section 154(2)(a) removes that protection for a document the person is required to produce. In Victoria, the document goes.

Legal professional privilege is preserved. Section 269 says nothing in the Commonwealth Act requires production of a document that would disclose privileged information. Section 155 of the Victorian Act is to the same effect, and also names client legal privilege.

The protections are checkable on the face of the notice. Section 155(3) requires it to name the section, warn that non-compliance without reasonable excuse is an offence and, where it seeks information, documents or answers, explain the effect of sections 172 and 269 and state that the person may attend with a legal practitioner.

Inspectors carry a further step, and it does not travel to a section 155 notice. Section 173 operates on requirements made under Part 9, where the inspector powers sit, while section 155 sits in Part 8. Under section 173(2), refusal on self-incrimination grounds is no offence for an individual who was neither warned about the effect of section 172 nor given a notice containing the statement section 173(1A)(d) requires. That second limb is the one that matters for a section 171(2A) written notice, because section 173(1) excuses the inspector from the oral warning in that case and puts the statement in the notice instead.

The retention setting is the real exposure

All of that assumes the material still exists. Often it does not, because a product decision set the deletion date.

On the Anthropic API, inputs and outputs are automatically deleted on the backend within 30 days of receipt or generation, subject to stated exceptions including longer retention under the customer's control (Anthropic's page last updated 1 July 2026, checked 21 September 2026). If a workflow runs through the API and nobody built an independent log, what the model was asked six weeks ago is gone. In Claude for Work and Enterprise chats stay in the product, and a deleted conversation leaves back-end storage within 30 days.

OpenAI puts control in the customer's hands. Its enterprise privacy page, updated 8 January 2026, states that You control how long your data is retained for ChatGPT Enterprise, Healthcare and Edu, and that deleted conversations go within 30 days unless retention is legally required. Production happens elsewhere: administrators reach an audit log through the Enterprise Compliance API, not the chat window.

Microsoft shows most sharply that the visible product is not the record. Retention for Microsoft 365 Copilot and other AI apps runs through a Purview policy, and the data lands in a hidden mailbox folder not designed to be directly accessible, searched with eDiscovery tools. Microsoft states it plainly: Messages visible in your AI apps are not an accurate reflection of whether they are retained or permanently deleted for compliance requirements. For its other AI apps category, which includes ChatGPT, Google Gemini and DeepSeek, prompts are captured only where a collection policy with the setting to capture content exists. Without one, nothing reaches the store eDiscovery searches.

Three products, three answers, none chosen by the people who hold the safety duty.

Deletion after the notice is served is its own problem. The Act's answer to non-production is section 155(5) or section 171(6), and section 188 makes intentional obstruction of an inspector an offence. An unattended job that ran three days after the notice is a position you must defend in writing.

This is officer territory. Section 27(5)(f) defines due diligence to include reasonable steps to verify the provision and use of resources and processes. An officer who has never asked where AI records live, how long they last and who can change that has verified nothing, and the officer evidence file has a hole in it.

The AI evidence preservation and production pack

Lift this out and run it. Four parts and one decision list that work without the article.

Part A. The systems inventory. One row per system that creates a prompt, an output or an agent action. Eight fields:

• Name, vendor, plan tier and tenancy, yours or the vendor's.
• What is captured: prompts, outputs, attachments, retrieval sources, tool calls, agent actions, and the configuration version.
• Where the record lives: product store, admin or compliance API, mailbox folder, log platform, or your own.
• Retention setting today, in days, with the date checked.
• Who can change it, by name and role, not by team.
• Who can export, by which route and format.
• The Part C privilege and confidentiality flag.
• Owner, and next check date.

Build it from where AI is used, not the approved tool register. The shadow AI work inventory is the input, because an undeclared system still creates records.

Part B. The hold instruction. A retention policy expires on a timer. A hold overrides it, in writing, to named people, on the day.

AI EVIDENCE PRESERVATION HOLD

Issued by: [NAME], [ROLE]
Issued at: [DATE], [TIME], [TIMEZONE]
Trigger: [SECTION 155 NOTICE DATED ... / INSPECTOR ENTRY ON ... / INCIDENT REF ...]
Matter: [PLAIN DESCRIPTION OF THE WORK, LOCATION AND PERIOD]
Period covered: [START DATE] to [END DATE OR ONGOING]
Systems in scope, from the inventory: [LIST SYSTEM IDS]

Required actions, completed by [DATE] and confirmed in writing:
1. Suspend automated deletion, retention expiry and archive jobs for the
   listed systems and periods.
2. Suspend end-user deletion for the listed accounts, or export a preserved
   copy where suspension is not available in the product.
3. Preserve the configuration in force during the period, including system
   prompts, tool permissions, model version and any change log.
4. Record the exact method used to suspend deletion, and who applied it.
5. Confirm whether any in-scope material was already deleted, and on what date.

Named holder responsible for confirming, per system: [NAME, ROLE]
Hold remains in force until released in writing by: [NAME, ROLE]

Do not delete, edit, re-run, regenerate or overwrite any in-scope record.
Do not export in-scope material to a personal device or personal account.
Do not use an AI tool to summarise or rewrite in-scope material before
production.
Do not release the hold on a verbal instruction.

Item 2 carries a fallback because in-product suspension is not always available, and item 5 exists because a hold nobody confirms is not a hold.

Part C. The privilege and confidentiality flag. Flag every source now, with one or more of four values:

• Legal privilege claimed. Section 269 preserves it, but the claim is per document, not per system, so mixed storage means somebody separates them against a deadline.
• Personal information. Production is still compelled, and section 271 governs what the regulator may then do with it.
• Worker health information. A different requester gets a different answer: under section 68(3) a health and safety representative is not entitled to a worker's personal or medical information without consent, unless the information is in a form that does not identify the worker and could not reasonably be expected to lead to the identification of the worker. A de-identified extract is the route, so build the export that produces one.
• Third-party confidential. Vendor material, another client's data, or contractor records.

Part D. The production log. One entry per item, written at the time, never reconstructed:

• Item reference and description.
• Source system, export route, date range, and any filter or search terms.
• Format, file count, size, and a hash of the export.
• To whom produced, by name and agency, and when.
• The power relied on: a section 155 notice, a section 171(2A) notice, an inspector requirement on entry, or voluntary production.
• Who authorised it, and whether privilege or confidentiality was claimed, over what and on what basis.

What stays a human decision. Four things, and no model makes any: what falls inside the notice, whether privilege is claimed, whether a reasonable excuse exists, and the decision to produce. A model can list candidates. It does not sign the covering letter, and the same rule applies when a financial regulator asks for the file.

Bottom line

A prompt history is not a new kind of evidence, it is an old kind in a new place, and the statute reached it long before the tool existed. What changed is that the record expires on a schedule the safety function did not set, inside products where the visible conversation is not the compliance copy. The vendor default deleted it is not an argument to run in front of an inspector. Inventory the systems, record the retention setting, and draft the hold now.

Do this Monday

• List every system that creates a prompt, an output or an agent action, starting from where AI is used, not the approved tool register.
• Record each system's retention setting in days, the date you checked it, and the named person who can change it.
• Test one export route over a non-sensitive period, so you know whether production takes an hour or a fortnight.
• Draft the preservation hold with named holders, and store it where the duty manager finds it.
• Put retention, change authority and export routes to your officers as a verification item under section 27(5)(f).

This article is general information and education only. It is not legal, compliance, financial or professional advice. Obligations vary by organisation and circumstance. Verify current requirements against the primary sources cited and seek advice specific to your situation.

References

1. Federal Register of Legislation, Work Health and Safety Act 2011 (Cth), Compilation No. 16, C2024C00243. https://www.legislation.gov.au/C2011A00137/2024-07-01/2024-07-01/text
2. Federal Register of Legislation, Acts Interpretation Act 1901 (Cth), Compilation No. 39, C2026C00117. https://www.legislation.gov.au/C1901A00002/2026-03-28/2026-03-28/text
3. Federal Register of Legislation, Work Health and Safety (Public Notification of Indexed Penalty Amounts) Notifiable Instrument 2026, F2026N00550, dated 27 July 2026. https://www.legislation.gov.au/F2026N00550
4. NSW Legislation, Work Health and Safety Act 2011 (NSW), current version. https://legislation.nsw.gov.au/view/whole/html/inforce/current/act-2011-010
5. Victorian Legislation, Occupational Health and Safety Act 2004 (Vic), authorised version 045. https://content.legislation.vic.gov.au/sites/default/files/2025-08/04-107aa045-authorised.PDF
6. Anthropic Privacy Center, How long do you store my organization's data?, Commercial Customers, Data Handling and Retention, dated 1 July 2026. https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data
7. OpenAI, Enterprise privacy at OpenAI, updated 8 January 2026. https://openai.com/enterprise-privacy/
8. Microsoft, Learn about retention for Copilot and AI apps, accessed 21 September 2026. https://learn.microsoft.com/en-us/purview/retention-policies-copilot