A Risk Register Is Not Current Because AI Reworded It.

A fluent rewrite can leave every material control assumption untouched. Make the register route change signals to accountable people, evidence and consultation. AI can help find and organise those signals, but a human must decide whether the control remains effective and what happens next.

A risk register is current only when it reflects the work, the controls and the evidence now. Asking AI to refresh the wording may improve readability while preserving a closed branch, an obsolete escalation route or a control that workers have stopped using.

The better design is a trigger-routing register. Every control is connected to an owner, an operating evidence source, defined change signals, consultation status and a recorded human review decision. AI can assist with detection and routing. It cannot decide that a legal review trigger has occurred, that a control remains effective or that no revision is required.

That distinction matters in financial services, where a vendor release, queue redesign, branch-hours change or new hybrid-work pattern can alter exposure without changing the risk label. The register must notice operating change, not merely wait for its annual editing appointment.

Why is a polished risk register still stale?

The legal duty is not to possess a universally prescribed spreadsheet called a risk register. Under the current Commonwealth framework, the Work Health and Safety Regulations 2011, compilation dated 25 March 2025, require duty holders within Part 3.1 to identify reasonably foreseeable hazards, eliminate or minimise risks so far as is reasonably practicable, maintain controls and review them in specified circumstances.

Regulation 37 requires an implemented control to remain effective, including by being fit for purpose, suitable for the nature and duration of the work, and installed, set up and used correctly. Regulation 38 requires review and, as necessary, revision when a control is ineffective, before a workplace change likely to create a new or different risk that the existing control may not effectively control, when a new relevant hazard or risk is identified, when consultation indicates a review is needed, or when an HSR makes a qualifying request.

The recording format is more flexible. Safe Work Australia's November 2024 model Code of Practice on managing WHS risks says a PCBU may prepare a risk register. It also says it is useful to keep information on how and when controls were implemented, monitored and reviewed, who was consulted and any plans for changes, while noting that the Regulations impose specific record-keeping requirements for some hazards.

The Commonwealth psychosocial hazards Code of Practice 2024, which is in force and commenced on 1 November 2024, is equally direct about method. It says a PCBU should record the risk-management process and outcomes, should choose a recording method suited to its circumstances, and can use a risk register. The same Code warns that, without a written record, the duty holder would need to demonstrate by other means how duties were met.

So the register is a practical governance mechanism, not universal proof of compliance and not a document every organisation is required to keep in the same form. A completed row cannot prove that consultation occurred, a supervisor can operate the escalation path or a staffing control survives peak demand.

AI rewording creates four particular traps. It can make an old assumption sound present, merge distinct controls into one vague statement, fill an evidence gap with plausible prose and erase the reason a human previously accepted or rejected a change. None of those acts tests operation.

There is a useful role for AI. It can compare approved versions, extract nominated change events from controlled sources, identify missing fields and assemble a review packet. Keep it in that clerical and analytical lane. The accountable person must examine the underlying evidence and decide whether review, consultation, revision, escalation or no change is justified.

How should a trigger-routing register work?

Build the register around each material control, not only around a broad risk label. A single psychosocial risk row may contain staffing, break, escalation, training and technology controls. Each can fail for a different reason and needs its own evidence, owner and trigger route.

Use these fields as a control-currency checklist:

• Control and purpose: the specific measure, the risk it addresses and the workers or other people it is intended to protect.
• Accountable owner: the person with authority and resources to test the control and recommend a change. This field does not transfer the legal duty.
• Operating evidence: the source that shows what is happening, such as sampled escalation records, roster coverage, worker feedback, system tests or observations.
• Change signals: defined events that may alter exposure or effectiveness, including a software release, process change, incident, complaint pattern, new hazard information, failed test or HSR request.
• Route: who receives each signal, the triage deadline, who must be consulted and which jurisdictional trigger requires checking.
• Consultation status: affected work group, HSR involvement where applicable, information shared, views raised, response and outcome communicated.
• Human decision: review required, interim action, revision, no change with reasons, further evidence required or escalation for specialist advice.
• Closure evidence: who verified the action in operation, when, by what method and what will trigger the next review.

This is not a feed-everything-to-a-model exercise. Use approved, access-controlled sources and the minimum information needed. Aggregate or de-identify worker reports where the task does not require identity, and do not turn control review into individual productivity or mental-state surveillance.

Safe Work Australia's current AI and digital-technologies risk guidance identifies software updates as a possible change trigger and says PCBUs must maintain and review controls. It also places human oversight, worker consultation and audits among the relevant measures.

Use this prompt to build a proposed trigger map from approved, de-identified material. A WHS practitioner and each control owner must verify the sources, triggers and routing before the map is used.

Act as a WHS control-currency analyst, not a duty holder or decision-maker.

Jurisdiction: [JURISDICTION]
Risk and affected work group: [RISK_AND_WORK_GROUP]
Current controls: [CONTROL_LIST]
Approved evidence sources: [SOURCE_LIST]
Known operational changes: [CHANGE_LOG]

Create a trigger-routing table with one row per control. Include control
purpose, accountable owner, operating evidence, possible change signals,
review route, consultation point, missing information and verification action.

Separate confirmed facts from assumptions. Do not decide compliance, control
effectiveness or whether a legal review trigger is met. Do not invent evidence.
Flag personal, confidential or security-sensitive material for removal.

Fictional worked example: [BANK_NAME] records customer aggression as a psychosocial hazard for its contact-centre workers. One control requires a supervisor to accept an urgent transfer and authorise recovery time after a severe interaction.

The risk description and control wording have not changed. The approved technology change log, however, shows that [ROUTING_PLATFORM] altered its transfer interface. De-identified escalation samples show more abandoned transfers after the release, while workers report that the after-hours route is unclear.

AI assists by connecting the release note, sampled records and existing control ID, then proposing a route to the operational control owner and WHS lead. It does not conclude that the control failed. The owner verifies the records, consults affected workers and their HSR, tests the after-hours route and decides that an interim phone escalation plus a system correction is required.

Under the current Commonwealth Act compilation dated 1 July 2024, sections 47 to 49 require consultation with directly affected workers so far as is reasonably practicable on relevant WHS matters, including identifying hazards, deciding controls and proposing changes that may affect health or safety. Consultation includes sharing relevant information, giving workers a reasonable opportunity to contribute, taking their views into account and advising them of the outcome. Where workers are represented by an HSR, that representative must be involved.

Use this prompt to assemble a review packet after a signal is verified. The WHS manager, control owner and affected workers or HSR must review the evidence and retain the decision.

Prepare a control-review packet from these approved, de-identified records:
[PASTE_RECORDS]

Control ID: [CONTROL_ID]
Possible trigger: [TRIGGER]
Jurisdiction: [JURISDICTION]

Return: confirmed chronology, source table, control purpose, evidence for and
against effective operation, affected work groups, consultation questions,
missing evidence, interim-action options and decisions required from people.

Quote source identifiers for every factual statement. Do not decide whether
the statutory trigger is met, whether the control is effective, or what control
must be selected. Mark conflicts and unknowns without resolving them.

Jurisdiction must be visible in the route. The current NSW Work Health and Safety Regulation 2025 uses the model-style review architecture in regulation 38. Victoria has a separate OHS regime, and WorkSafe Victoria's current psychological-health compliance code explains the distinct regulation 16 triggers for psychosocial controls. These include relevant alterations, new or additional hazard information, a report of a psychological injury or psychosocial hazard, a Part 5 notifiable incident involving a psychosocial hazard, inadequate control and an HSR request. Do not copy Commonwealth section labels into a Victorian register.

Do this Monday

1. Choose one control, not the whole register. Pick a material office, branch, contact-centre or hybrid-work control with a known operational dependency. Confirm the jurisdiction and owner.
2. Name the evidence of operation. Identify one source that can show whether the control is used and works as intended. If none exists, record the gap rather than asking AI to infer effectiveness.
3. Define five signals. Include an operating failure, a system or process change, new hazard information, a consultation result and an HSR request route. Add any hazard-specific trigger that applies, and borrow the discipline of the five-signal test for AI pace and work intensification where the change is AI-driven.
4. Test the route. Use a recent, de-identified change to confirm that the signal reaches a person with authority, prompts consultation where required and produces a recorded decision.
5. Close the loop. Record the evidence checked, worker views, interim measures, human decision, action owner, due date and next trigger. Keep the former version and rationale so later reviewers can reconstruct the change.

The aim is not to create a larger register. It is to make one important control traceable from signal to evidence, consultation, decision and operating verification. Once that route works, repeat it for the controls where unnoticed change could cause the most harm.

Bottom line

A risk register is not current because AI improved its prose. Currency comes from live evidence, defined change signals, consultation and an accountable human decision about review and revision. Use AI to compare, extract and route approved information, never to declare a control effective or a duty discharged. Design the register as a trigger system, then verify the control in the work.

This article is general information and education only. It is not legal, compliance, financial or professional advice. Obligations vary by organisation and circumstance. Verify current requirements against the primary sources cited and seek advice specific to your situation.

References

1. Federal Register of Legislation, Work Health and Safety Regulations 2011, current text: https://www.legislation.gov.au/F2011L02664/latest/text
2. Safe Work Australia, Model Code of Practice: How to manage work health and safety risks: https://www.safeworkaustralia.gov.au/doc/model-code-practice-how-manage-work-health-and-safety-risks
3. Federal Register of Legislation, Work Health and Safety (Managing Psychosocial Hazards at Work) Code of Practice 2024, current text: https://www.legislation.gov.au/F2024L01380/latest/text
4. Safe Work Australia, Artificial intelligence and digital technologies: Managing risks: https://www.safeworkaustralia.gov.au/safety-topic/hazards/digital-technologies-ai/managing-risks
5. Federal Register of Legislation, Work Health and Safety Act 2011, current text: https://www.legislation.gov.au/C2011A00137/latest/text
6. NSW legislation, Work Health and Safety Regulation 2025, current text: https://legislation.nsw.gov.au/view/html/inforce/current/sl-2025-0440/lh
7. WorkSafe Victoria, Compliance code: Psychological health, Part 3, Step 4: Review risk controls: https://www.worksafe.vic.gov.au/compliance-code-psychological-health-part-3-step-4-review-risk-controls