Your AI Register Is Not Licence Evidence Until It Maps to the SRCC Criteria

An approved AI use case proves that someone recorded an intention. Licence evidence must show which existing obligation is engaged, what control operated, what exception occurred, who owned it and what independent assurance actually found.

An AI register is inventory, not proof. A row marked “approved” can identify the tool, purpose and owner while saying nothing about whether a workers compensation control operated on Tuesday morning when a case manager used it.

For a Comcare-scheme self-insured licensee, the stronger artefact is a criterion-to-evidence crosswalk. Each approved WC AI use case links to the licensee's actual conditions, relevant SRCC performance material and applicable claims audit criteria, then points to time-bounded operating evidence, exceptions, ownership and assurance results.

That crosswalk is a proposed internal control. It is not an SRCC form, a new licence condition or proof of compliance by itself. As at 31 July 2026, no AI-specific wording was located in the current publicly published LCPM standard licence and LCPI templates or CMS and RMS audit suite. That does not exclude a special condition, variation, direction or correspondence applying to a particular licensee.

The SRCC does publish a June 2026 AI Transparency Statement. It concerns the SRCC's own AI governance and alignment with Comcare because Comcare supplies its systems, services and secretariat support. It does not state a licence condition for self-insured licensees.

What does the licence architecture actually require?

Start with the legal hierarchy, not the AI register. The current Safety, Rehabilitation and Compensation Act 1988 is Compilation No. 82, in force from 1 July 2026. Section 108B permits a licence to authorise the licensee, or a specified person acting on its behalf, to manage claims. Section 108C requires an authorised licensee to determine the claims it manages within the scope of its licence.

Section 108D allows the Safety, Rehabilitation and Compensation Commission to grant a licence on conditions it considers necessary to achieve the Act's objects as applied to the licensee. Section 108E includes functions to make payments accurately and quickly, to determine claims accurately and quickly and take all necessary action in respect of their subsequent management, to maintain contact with the SRCC and Comcare, and to comply with the licence conditions. None of those functions transfers to an AI system. The authorised organisation and its human decision-makers remain responsible.

Next, open the licensee's executed licence and every current variation. The SRCC's licence-compliance page explains that licences can contain scope, general, prudential, performance and special conditions. A standard template cannot reveal whether a particular bank, insurer, transport operator or university has a different clause, third-party claims manager arrangement or special condition.

The current Licence Compliance and Performance Model, Version 14, with updates agreed at the SRCC's meeting of 18 June 2026, provides the regulatory structure. Its standard licence template includes conditions about legal and privacy compliance, management systems, reporting, notification of relevant events, record retention and third-party claims managers. Those model condition numbers are not a substitute for the executed licence.

The LCPM's claims management performance material expects an established system that enables accurate and timely payments, including quality-assurance processes or other decision-making activities. It identifies annual assessment, audits or equivalent reviews, claims data and self-reporting of system changes as information sources. Whether a particular AI deployment is a reportable system change is a human licence-management judgement against the actual licence, current LCPM and advice specific to the circumstances.

Comcare's Claims management system audit tool, Version 5.0, dated October 2025, adds 31 criteria across five elements. Relevant examples may include risk control at 1.3, competency at 3.4, lawful claim decisions at 3.5, confidentiality at 3.16, records at 3.17, monitoring at 4.1, audit at 4.2, documented and actioned audit outcomes at 4.3 and continuous improvement at 5.1. The tool says it draws on legislation and better-practice elements, is used by Comcare, self-insured licensees and claims management providers working in the scheme, and is used by the SRCC in its monitoring role. It is guidance and an assessment tool, not legislation.

That hierarchy produces a disciplined starting question: which existing obligation or criterion does this AI use genuinely affect? If the answer is none, record it as an internal AI control. Do not force a licence label onto it.

When does a register entry become usable evidence?

Use a seven-field evidence chain for each approved WC use case:

1. Criterion. Cite the exact executed licence clause, LCPM performance item or audit criterion. Record the source version and date.
2. Control. State what must operate, who must act and what the AI is prohibited from doing.
3. Operating evidence. Point to dated artefacts showing the control ran, not merely that a policy exists.
4. Exception. Record failures, overrides, blocked outputs and unresolved gaps without rewriting history.
5. Owner. Name the accountable human role for the control and evidence, including third-party arrangements.
6. Assurance result. Record who tested the control, when, what was tested and the result.
7. Reporting decision. Record the human assessment of whether the change or exception requires notification, LCPI treatment or another response.

This is not about selecting claim files for a claims management audit. The audit population and sample methodology are separate. The crosswalk asks whether a use case can be traced from authority to control to evidence without trusting the model or the register owner.

Use this prompt to build a candidate crosswalk from de-identified material. The licence owner and claims assurance lead must verify every source, delete false mappings and approve the final position.

Build a candidate evidence crosswalk for approved workers compensation AI use case [AI_USE_CASE_ID].

Use only the supplied executed licence, current variations, LCPM extracts, claims audit criteria and control documents.

Return:
Criterion | control | dated operating evidence | exception | human owner | assurance result | reporting decision.

Quote exact source coordinates. Mark a field UNMAPPED where no source supports it and DESIGN ONLY where no operating evidence exists. Do not invent a licence obligation, treat the AI register as evidence, assess compliance, decide reportability or claim regulator endorsement.

A human-review policy is design evidence. Dated review logs and competency checks show operation. Model settings show intended behaviour. Exception records show what happened when the behaviour failed.

Comcare's audit tool lists policies and procedures, minutes or outcomes of meetings, training records, internal audit reports, internal performance reports and staff bulletins as possible documentation, then adds file review and interviews. An AI control packet can organise those sources. It cannot dictate what a competent auditor will accept or convert weak evidence into conformance.

How do you avoid overstating the crosswalk?

Consider this fictional, de-identified example. Use case [AI_USE_CASE_ID] assists a case manager to extract source-linked facts from de-identified records before a human prepares a chronology. It cannot assess credibility, apply the SRC Act or draft a determination outcome.

The register records the purpose, approved environment and owner. The crosswalk then links only the controls that are genuinely engaged. Audit criterion 3.4 maps to role training and a completed competency check. Criterion 3.16 maps to the de-identification gate, access configuration and privacy review. Criterion 3.17 maps to the source-linked output, review record and retention location. Criterion 4.1 maps to an approved error measure and monthly control report. The human licence owner separately checks the executed licence and LCPM before deciding whether the deployment is a system change requiring external notification.

Operating evidence shows that output [RUN_ID_07] omitted a source coordinate. The workflow blocked the chronology from use, recorded the exception, corrected the configuration and completed a human-approved retest. The assurance result is not “compliant”. It states the control tested, period, exception, remediation status and any residual gap.

The proposed status labels should make uncertainty visible:

• UNMAPPED: no verified criterion supports the claimed licence link
• DESIGN ONLY: a control exists but no operating evidence was supplied
• EXCEPTION OPEN: a failure awaits human disposition or retest
• ASSURED FOR PERIOD: identified evidence was tested for the stated period and scope
• HUMAN REPORTING DECISION REQUIRED: reportability has not been decided.

These are internal workflow labels, not SRCC ratings. The conformance ratings in Comcare's claims management system audit workbook and the LCPI certification remain under their published processes and competent human ownership.

Use this second prompt to test a completed packet. A human assurance practitioner must investigate every gap and make every finding.

Test the evidence packet for [AI_USE_CASE_ID] against its approved crosswalk.

For each row, verify source version, control owner, evidence date, run or record ID, exception status, assurance scope and reporting decision. Flag stale sources, policy-only evidence, missing failures, unsupported claims and third-party evidence outside the licensee's control.

Do not rate an SRCC audit criterion, certify licence compliance, close an exception, decide notification, infer control operation or rewrite the evidence. Return gaps with exact coordinates for human review.

The current LCPM embeds an annual Licensee Compliance and Performance Improvement report template. It covers prior-year performance, management-system activity, results, future strategies and executive certification. The template says it is guidance and permits licensees to prepare the report in their own branding and preferred formatting and orders. The crosswalk may support accurate LCPI inputs, but it is not an LCPI annex mandated by the SRCC. A human executive must be satisfied with any certification.

Privacy evidence also needs substance. The OAIC's commercial AI guidance calls for product due diligence, embedded human oversight, lifecycle monitoring and careful handling of personal information. De-identify examples with placeholders such as [CLAIMANT_NAME] and [CLAIM_NUMBER], and keep controlled records outside public AI tools.

Do this Monday

1. Export the WC AI register and remove every column that asserts “licence compliant” without a verified source and assurance result.
2. Load the executed licence, variations, LCPM Version 14 and current claims audit criteria into a controlled source pack.
3. Crosswalk one approved use case using the seven fields. Mark unsupported links UNMAPPED rather than selecting a nearby criterion.
4. Collect one month of operating evidence, including failed runs, blocked outputs, human reviews and remediation records.
5. Have claims assurance, privacy and the licence owner test the packet and record a scoped result, not a global conclusion.
6. Set review triggers for model, vendor, prompt, data, role, workflow or source changes, and require a fresh human reporting decision when the trigger fires.

Bottom line

An AI register says what the organisation intends to permit. Licence evidence shows how an existing obligation was translated into a control and whether that control operated within a stated period. The proposed crosswalk makes that chain inspectable without inventing an AI-specific SRCC requirement. Human licence owners, auditors and executives retain every judgement, notification and certification.

This article is general information and education only. It is not legal advice, and it is not advice about any individual claim. Decisions under the Safety, Rehabilitation and Compensation Act 1988 are made by human decision-makers on the individual merits of each claim, and claimants have reconsideration and review rights in respect of determinations. Seek advice specific to your scheme and circumstances.

References

1. Federal Register of Legislation, Safety, Rehabilitation and Compensation Act 1988, Compilation No. 82, 1 July 2026: https://www.legislation.gov.au/C2004A03668/latest/text
2. Safety, Rehabilitation and Compensation Commission, Licence compliance and performance: https://www.srcc.gov.au/current-self-insurers/licence-compliance-and-performance
3. Safety, Rehabilitation and Compensation Commission, Licence Compliance and Performance Model, Version 14, June 2026: https://www.srcc.gov.au/sites/default/files/docs/srcc-licence-compliance-performance-model.pdf
4. Safety, Rehabilitation and Compensation Commission, SRCC's AI Transparency Statement, June 2026: https://www.srcc.gov.au/about-us/governance-and-accountability/srccs-ai-transparency-statement
5. Safety, Rehabilitation and Compensation Commission, Audit tools and templates: https://www.srcc.gov.au/current-self-insurers/audit-tools-and-templates
6. Comcare, Claims management system audit tool, Version 5.0, October 2025: https://www.comcare.gov.au/sites/default/files/docs/claims-management-system-audit-tool.pdf
7. Office of the Australian Information Commissioner, Guidance on privacy and the use of commercially available AI products: https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products