Victoria Now Reviews Your Controls Before the AI Ships

The review now lands before go-live, not after.

Regulation 16(1)(a) of the Occupational Health and Safety (Psychological Health) Regulations 2025 (Vic) requires a Victorian employer to review, and if necessary revise, its psychosocial risk control measures before any alteration is made to a thing, process or system of work that is likely to change the risks associated with psychosocial hazards. An artificial intelligence (AI) deployment that changes how work is allocated, paced, monitored or decided is that kind of alteration. The practitioner consequence is a date in the change schedule rather than a paragraph in a policy.

Two cautions attach to that. First, the Regulations do not use the words artificial intelligence, automation or algorithmic management anywhere in the instrument, so the application set out here is an inference drawn from the regulation 4 definition of a psychosocial hazard and the regulation 16(1)(a) trigger, and it is written as one. Second, Victoria sits outside the harmonised scheme. Safe Work Australia states on its model WHS laws page that "The model laws have been implemented in all jurisdictions except Victoria", which remains the position as at 26 September 2026.

What regulation 16(1)(a) now requires

The Occupational Health and Safety (Psychological Health) Regulations 2025 (Vic), S.R. No. 103/2025, were made on 30 September 2025. Regulation 3 provides that "These Regulations come into operation on 1 December 2025". The Victorian Legislation in-force listing for the Regulations records version 001 as the current version. Every date, version and figure in this article is stated as at 26 September 2026.

There was no such regulation before 1 December 2025. The general duty in section 21(1) of the Act and the section 35 consultation duty both applied, and neither fixes a date for a psychosocial control review. The Regulations have been in operation for close to eleven months, so the question is not whether the duty exists but whether the AI changes already on the schedule are being run through regulation 16(1)(a).

The WorkSafe Victoria frequently asked questions page frames the duty set as identify, control, then review and revise.

Regulation 16(1) is where the timing sits. An employer must review, and if necessary revise, its control measures "before any alteration is made to any thing, process or system of work that is likely to result in changes to risks associated with psychosocial hazards". The word carrying the obligation is "before".

Regulation 16(1) sets further triggers as well, including regulation 16(1)(f), which requires a review "after receiving a request from a health and safety representative". Paragraph (f) is reactive by design. Paragraph (a) is not. It attaches to the alteration itself, so the duty falls due before the change rather than after a complaint.

The test is whether the alteration is likely to result in changes to psychosocial risks. A deployment that alters who decides, how fast work moves, how performance is measured or how much discretion a person retains is difficult to place outside that test.

Is an AI rollout an alteration to a system of work?

Regulation 4 defines a psychosocial hazard as any factor or factors in the work design, the systems of work, the management of work, the carrying out of the work, or personal or work-related interactions, "that may arise in the working environment and may cause an employee to experience one or more negative psychological responses that create a risk to the employee's health or safety". It does not attach to a named technology, which is why no amendment was needed for software to fall inside it.

Regulation 4 then lists fifteen examples of the hazard, among them "low role clarity, poor environmental conditions, poor organisational change management, poor organisational justice, poor support, poor workplace relationships". A rollout is organisational change, and poor organisational change management is a named example.

The WorkSafe Victoria compliance code Psychological health, Edition 1, September 2025 closes the distance. Among its examples of that hazard, the code names the circumstance where "new technology is introduced and implementation difficulties are poorly managed". The regulator has already written the technology case into the hazard.

The code also supplies the sharpest illustration for an AI control design. It describes surveillance technology used to monitor customer behaviour and reduce the risk of aggression or violence, which "may also be used to monitor employee productivity, without proper communication or consultation". One control, two possible effects. The code records that this "increases the risk of harm from exposure to low job control and poor organisational justice".

A vendor benefit case is built to show the benefit, so the second effect has to be looked for. A quality assurance model that reviews every interaction removes a sampling burden and installs continuous measurement at the same time.

Regulation 14 sets the identification duty: "An employer must, so far as is reasonably practicable, identify psychosocial hazards." Run against a proposed rollout rather than against a workplace in general, and brought forward by regulation 16(1)(a), that duty asks which regulation 4 categories the change touches before it touches them.

Why a launch training module is not the control

Regulation 15 sets the order of operations, and it is stricter than a generic hierarchy of controls.

Regulation 15(1) comes first: "An employer must, so far as is reasonably practicable, eliminate any risk associated with a psychosocial hazard." Not deploying into a particular task, removing a monitoring feature before launch, or keeping a decision with a person are all elimination answers.

Where elimination is not reasonably practicable, regulation 15(2) requires the risk to be reduced so far as is reasonably practicable, and paragraph (a) names five alteration levers. Paragraph (b) is the information, instruction and training limb. The table below reads those five levers against a de-identified scenario in which [EMPLOYER] deploys [SYSTEM_NAME] in [BUSINESS_UNIT] to draft responses to customer complaints.

Then come the two provisions that decide what the review may conclude. Regulation 15(3) provides that "The employer may only exclusively use the control measures set out in subregulation (2)(b) if none of the control measures set out in subregulation (2)(a) are reasonably practicable." Regulation 15(4) adds that where a combination is used, "a control measure set out in subregulation (2)(b) must not be the predominant control measure used".

The Regulations do not ban training. Regulation 15(3) permits training to be used on its own where no design control is reasonably practicable, and the predominant control bar sits in regulation 15(4) rather than in 15(3). What the two provisions do is put the burden on the employer to show why that launch pattern, a change module, an acceptable use policy and a one hour briefing, was the only reasonably practicable answer.

Regulation 8 adds the obligation that outlasts the launch. A person required by the Regulations to use a control measure "must ensure that the measure is properly installed (if applicable), used and maintained". A control that exists in the deployment plan and not in the running configuration is not a control, and a toggle that a vendor update restores is a maintenance failure.

What does a missing review cost?

The Regulations carry no penalty line of their own. Regulation 5 does the routing, and the note at the foot of regulation 16 names section 21 of the Act. A failure to comply with a duty under a section named that way "is an offence to which a penalty applies". The consequence sits in the Occupational Health and Safety Act 2004 (Vic), Act No. 107/2004, authorised version 045, effective 6 August 2025 and current as at 26 September 2026.

Section 21(1) carries the Act's primary employer duty: "An employer must, so far as is reasonably practicable, provide and maintain for employees of the employer a working environment that is safe and without risks to health." That is where the exposure sits. The maximum penalty attached to it is 1,800 penalty units for a natural person and 9,000 penalty units for a body corporate, as at 26 September 2026.

The dollar value is a calculation, not a figure printed in the Act. The Department of Treasury and Finance notice under section 6 of the Monetary Units Act 2004, published 5 May 2026, states that "The value of a penalty unit is $209.10" for the financial year commencing 1 July 2026. Multiplying 9,000 penalty units by $209.10 gives $1,881,900, calculated as at 26 September 2026 and moving whenever the unit value is refixed.

Two limits belong with it. Regulation 17(1)(a) provides that nothing in the Part is to be construed as "conferring a right of action in civil proceedings in respect of a contravention of this Part", so the exposure is regulatory rather than a new civil cause of action. And the compliance code states plainly that "a duty holder will not fail to meet their legal duty simply because they have not followed the Code", while recording in the same passage that "Failure to observe the Code may be used as evidence in proceedings for an offence under the OHS Act or OHS (Psychological Health) Regulations".

On enforcement, use what the regulator said rather than an assumed trend. In its media release New regulations make psychological health a priority of 1 December 2025, WorkSafe Victoria stated that inspectors "will take into account factors such as previous experience with psychosocial risk management", which is what a completed review record evidences.

What does the consultation duty do to the timetable?

The review is not the only dated obligation, and the second one is the harder scheduling constraint.

Section 35(1) of the Act requires an employer, so far as is reasonably practicable, to "consult in accordance with this section with the employees of the employer who are or are likely to be directly affected". Section 35(1)(f) fixes the trigger at "proposing changes, that may affect the health or safety of employees of the employer, to any of the following". Proposing, not implementing.

Section 35(4) adds the representative: "If the employees are represented by a health and safety representative, the consultation must involve that representative". The maximum penalty under section 35(6) is 180 penalty units for a natural person and 900 penalty units for a body corporate, which at the value fixed for the financial year commencing 1 July 2026 gives $188,190, again a calculation as at 26 September 2026.

Regulation 9(2)(b) then sets the order where the employees are represented: the representative receives the information "a reasonable time before providing the information to the employees", unless that is not reasonably practicable. That is a sequencing rule, and the most useful operational point for a rollout team.

Three dated events therefore sit in front of go-live, in order. Where the employees are represented, the health and safety representative receives the information. The affected employees are consulted, so far as is reasonably practicable. The regulation 16(1)(a) review is completed, with the record the compliance code expects. A go-live date set without room for those three leaves the review undone and the employer arguing that the rest was not reasonably practicable, and moving the date afterwards does not repair it.

The scale of what is being managed, and the claims numbers behind it, is covered separately in Mental Health Claims Take Thirty-Five Weeks Off Work.

What belongs in the review record?

The compliance code states the expectation directly: "Employers should keep records of the risk management processes and consultation for all psychosocial hazards."

The record is what makes the regulation 15(3) and regulation 15(4) position defensible a year later, when the people who decided have moved on. Eight fields cover it.

1. The trigger, cited as regulation 16(1)(a), and the proposed alteration described in one paragraph.
2. The review date, and the go-live date it precedes.
3. The hazards identified under regulation 14, mapped to the regulation 4 categories they touch.
4. The elimination options considered under regulation 15(1), and why each was or was not reasonably practicable.
5. Each of the five regulation 15(2)(a) levers, marked considered, adopted or rejected, with a reason for every rejection.
6. Whether information, instruction or training is the predominant control, and if it is, what changes before launch.
7. The consultation record, naming the representative by role, with the date the representative received the information and the date the employees did.
8. The decision owner by role, and the date the controls are next reviewed.

Three prompts for the control review

TheAICommand works to the Verified Draft Method: de-identify the inputs, ground the model in your own source material, keep a person at the decision point, verify against the primary source, and log what happened.

Each prompt below runs on the reader's own change documentation. Each produces a candidate that a named person verifies. None of them produces a decision.

You are assisting with a psychosocial hazard identification step under Victorian
occupational health and safety law. Use only the attached documents. Do not use
outside knowledge and do not infer facts that are not written down.

Attached: the change proposal for [SYSTEM_NAME] in [BUSINESS_UNIT], the vendor
feature description, and the current position description for the affected role.
All documents are de-identified. Do not ask for names.

Task: produce a candidate list of psychosocial hazards this change may create or
increase. Map each candidate to one of the fifteen regulation 4 examples listed
below: aggression or violence; bullying; exposure to traumatic events or content;
high job demands; low job control; low job demands; low recognition and reward;
low role clarity; poor environmental conditions; poor organisational change
management; poor organisational justice; poor support; poor workplace
relationships; remote or isolated work; sexual harassment. These are the
instrument's own examples and not an exhaustive list, so where a candidate does
not fit one of them, write DOES NOT FIT A LISTED EXAMPLE and describe it in one
line rather than forcing a fit.

For each candidate give: the category, the specific task or feature it comes from,
the document and the location within it, being a page number or a heading, and a
confidence marker of high, medium or low. Mark any item you cannot trace to an
attached document as NOT SUPPORTED and list it separately. Do not rank, score or
recommend.

What to check: every candidate must name a document and a locatable point within it, being a page or a heading, and any item marked NOT SUPPORTED is discarded rather than corrected. Read the mapping against the fifteen regulation 4 examples in the prompt yourself, because a model that has not been given the instrument maps to generic wellbeing language instead of the named categories.

You are helping structure a control options analysis. Use only the attached
documents and the hazard list provided. Do not propose controls that are not
supported by the attached material.

Attached: the de-identified hazard list, the change proposal for [SYSTEM_NAME] in
[BUSINESS_UNIT], and the vendor feature description. All documents are
de-identified. Use roles, never names, and keep the placeholders [EMPLOYER],
[BUSINESS_UNIT] and [SYSTEM_NAME].

Work in this fixed order and do not reorder it.
Step 1: for each hazard, state whether the risk can be eliminated, and what
eliminating it would require.
Step 2: for each hazard that cannot be eliminated on the attached evidence, work
through these five design levers one at a time and state a specific option for each
or write NO OPTION IDENTIFIED: altering the management of work; altering the plant;
altering the systems of work; altering the work design; altering the workplace
environment.
Step 3: only after step 2, list any information, instruction or training options.

Output a table with one row per hazard and these seven columns: elimination option;
altering the management of work; altering the plant; altering the systems of work;
altering the work design; altering the workplace environment; information,
instruction or training options. At the end, count how many hazards carry at least
one design lever option and how many rely only on information, instruction or
training, and present the two counts. Do not state whether information, instruction
or training is the predominant control measure.

What to check: confirm the model produced an option under step 2 before it reached step 3, because the common failure is a table where four of the five design levers read NO OPTION IDENTIFIED and the training column carries the weight. Each NO OPTION IDENTIFIED is a claim that the lever is not reasonably practicable, and that claim needs a human reason recorded against it. The regulation 15(4) predominant control call is the reviewer's, made from the two counts.

Draft a psychosocial control review record. Use only the attached material: the
hazard list, the control options table, the consultation log and the change
schedule. Leave any field you cannot fill from the attachments as TO BE CONFIRMED.

Use these headings in this order and no others:
1. Trigger and proposed alteration
2. Review date and go-live date
3. Hazards identified and categories touched
4. Elimination options considered
5. Design levers considered, adopted or rejected, with reasons
6. Counts: hazards with at least one design lever option, and hazards
   relying only on information, instruction or training
7. Consultation record, by role only, with dates
8. Decision owner by role and next review date

Rules: use roles, never names. Use placeholders [EMPLOYER], [BUSINESS_UNIT],
[SYSTEM_NAME], [GO_LIVE_DATE], [HSR], [REVIEW_DATE] and [DECISION_OWNER]. Write in
plain statements of fact. Do not write recommendations and do not write conclusions
about legal compliance.

What to check: fields 6 and 7 are the two that fail. Confirm the two counts in field 6 match the control options table, then make the regulation 15(4) predominant control call yourself and write it in. Confirm the dates in field 7 place the health and safety representative ahead of the employees and both ahead of the alteration. Any field left as TO BE CONFIRMED is an open item on the change schedule.

Do this Monday

Build one artefact: a Psychosocial Control Review Record for the next AI or automation change already on the schedule.

The owner is the change manager for that deployment, countersigned by the health and safety lead for the business unit. Naming the change manager is deliberate: the person who controls the alteration date is the only one who can move the review in front of it.

The first step fits in an hour. Open the change schedule, find the go-live date, and write two earlier dates against it: when the health and safety representative receives the information, and when the control review is completed. Then paste the eight fields above into a document, fill fields 1, 2 and 7 from what is already known, and leave the rest as open items.

The check on the hour is a comparison of dates: the review date is earlier than the go-live date, the representative date is earlier than the employee briefing date, field 1 names the trigger and the alteration, and fields 2 and 7 carry planned dates rather than blanks. The completion check comes before go-live, when every one of the five design levers in field 5 carries either an adopted control or a written reason for rejection. If any lever is blank, the record is not finished and the date is not defensible.

The bottom line

Victoria moved the psychosocial control review to the front of the change. Regulation 16(1)(a) attaches it to the alteration rather than to a complaint, and the regulation 15 order of operations decides what the review is allowed to conclude. Regulation 5 routes a failure to the section of the Act named in the note at the foot of the regulation, which for regulation 16 is section 21, so the maximum body corporate exposure calculates to $1,881,900 as at 26 September 2026. None of that mentions artificial intelligence, because the duty attaches to the change in the work rather than to the tool. The practitioner move is a date and a record, both produced before go-live, naming which design controls were considered and why any was set aside.